) {
  /** The total number of bytes consumed. */
  var total: Long = 0L
    private set

  /** The total number of bytes acknowledged by outgoing `WINDOW_UPDATE` frames. */
  var acknowledged: Long = 0L
    private set

  val unacknowledged: Long
    @Synchronized get() = total - acknowledged

  @Synchronized
  fun update(
    total: Long = 0,
    acknowledged: Long = 0,
  ) {
    check(total >= 0)

import okhttp3.internal.connection.RealConnection
import okio.FileSystem
import okio.Path

internal fun buildCache(
  file: Path,
  maxSize: Long,
  fileSystem: FileSystem,
): Cache {
  return Cache(fileSystem, file, maxSize)
}

internal var RealConnection.idleAtNsAccessor: Long
  get() = idleAtNs
  set(value) {
    idleAtNs = value
  }

internal val Response.exchangeAccessor: Exchange?
  get() = this.exchange

        nextOutFrame = outFramesIterator.next()
      }

      if (nextOutFrame != null && nextOutFrame.sequence == i) {
        val start = nextOutFrame.start
        var truncated: Boolean
        var end: Long
        if (outFramesIterator.hasNext()) {
          nextOutFrame = outFramesIterator.next()
          end = nextOutFrame.start
          truncated = false
        } else {
          end = outBytes.size.toLong()

internal class UnreadableResponseBody(
  private val mediaType: MediaType?,
  private val contentLength: Long,
) : ResponseBody(), Source {
  override fun contentType() = mediaType

  override fun contentLength() = contentLength

  override fun source() = buffer()

  override fun read(
    sink: Buffer,
    byteCount: Long,
  ): Long {
    throw IllegalStateException(
      """

  var uriHost: String = "example.com"
  var uriPort: Int = 1

  fun newConnection(
    pool: RealConnectionPool,
    route: Route,
    idleAtNanos: Long = Long.MAX_VALUE,
    taskRunner: TaskRunner = this.taskRunner,
  ): RealConnection {
    val result =
      RealConnection.newTestConnection(
        taskRunner = taskRunner,
        connectionPool = pool,

     * type.
     *
     * In practice, we are very unlikely to see `null`: The `WeakReference` to the enum constant
     * won't be cleared as long as the enum constant is referenced somewhere, and the enum constant
     * is referenced somewhere for as long as the enum class is loaded. *Maybe in theory* the enum
     * class could be unloaded after the above call to `getEnumConstants` but before we call

)

var configDumpFile string

func checkCmd(ctx cli.Context) *cobra.Command {
	cmd := &cobra.Command{
		Use:   "check [<type>/]<name>[.<namespace>]",
		Short: "Check AuthorizationPolicy applied in the pod.",
		Long: `Check prints the AuthorizationPolicy applied to a pod by directly checking
the Envoy configuration of the pod. The command is especially useful for inspecting

        if (testTransferListener != null) {
            testTransferListener.addTransfer(resourceName);
        }
    }

    public boolean getIfNewer(String resourceName, File destination, long timestamp)
            throws TransferFailedException, ResourceDoesNotExistException, AuthorizationException {
        if (!insideGet) {
            addTransfer("getIfNewer " + resourceName);
        }

	// since the IP is normally the same), we SNAT identified host probes in the host netns to a fixed
	// APIPA/"link-local" IP.
	//
	// It doesn't matter what this IP is, so long as it's not routable and doesn't collide with anything else.
	//
	// IPv6 link local ranges are designed to be collision-resistant by default, and so probably never need to be overridden
	DefaultHostProbeSNATIP   = "169.254.7.127"

}

func closeNetns(netns NetnsCloser) {
	netns.Close()
}

func (p *podNetnsCache) ReadCurrentPodSnapshot() map[string]WorkloadInfo {
	p.mu.RLock()
	defer p.mu.RUnlock()
	// snapshot the cache to avoid long locking
	return maps.Clone(p.currentPodCache)
}

// Remove and return the Netns for the given uid
// No need to return NetnsCloser here it will be closed automatically on GC.