* table
-N chain
-A chain -f foo -b bar
-A chain -f fu -b bar
-A chain -f foo -b baz

    @Override public Response intercept(Chain chain) throws IOException {
      for (Certificate certificate : chain.connection().handshake().peerCertificates()) {
        String pin = CertificatePinner.pin(certificate);
        if (denylist.contains(pin)) {
          throw new IOException("Denylisted peer certificate: " + pin);
        }
      }
      return chain.proceed(chain.request());
    }
  };

import okhttp3.internal.platform.Platform

/**
 * Computes the effective certificate chain from the raw array returned by Java's built in TLS APIs.
 * Cleaning a chain returns a list of certificates where the first element is `chain[0]`, each
 * certificate is signed by the certificate that follows, and the last certificate is a trusted CA
 * certificate.
 *
 * Use of the chain cleaner is necessary to omit unexpected certificates that aren't relevant to

#include "textflag.h"

// func kimd(function code, chain *[200]byte, src []byte)
TEXT ·kimd(SB), NOFRAME|NOSPLIT, $0-40
	MOVD function+0(FP), R0
	MOVD chain+8(FP), R1
	LMG  src+16(FP), R2, R3 // R2=base, R3=len

continue:
	WORD $0xB93E0002 // KIMD --, R2
	BVS  continue    // continue if interrupted
	MOVD $0, R0      // reset R0 for pre-go1.8 compilers
	RET

// func klmd(function code, chain *[200]byte, dst, src []byte)

/**
 * Defines a variant that is the result of applying a transform chain to produce a variant with the given attributes.
 */
public interface VariantDefinition {
    /**
     * @return This variant's attributes after all chain transforms are applied.
     */
    ImmutableAttributes getTargetAttributes();

    /**
     * @return The transform chain which transforms the root variant to this variant.
     */

type FilterChainMatchOptions struct {
	// Application protocols of the filter chain match
	ApplicationProtocols []string
	// Transport protocol of the filter chain match. "tls" or empty
	TransportProtocol string
	// Filter chain protocol. HTTP for HTTP proxy and TCP for TCP proxy
	Protocol networking.ListenerProtocol
	// Whether this chain should terminate TLS or not
	TLS bool
}

    /**
     * @param init The initial steps of this chain, or null if this chain only contains one step.
     * @param last The last step of this chain.
     */
    public TransformChain(@Nullable TransformChain init, TransformStep last) {
        this.init = init;
        this.last = last;
    }

    /**
     * @return The initial steps of this chain, or null if this chain only contains one step.
     */
    @Nullable

import java.io.File;
import java.util.List;

/**
 * The <a href="https://swift.org/">Swift Compiler</a> tool chain.
 *
 * @since 4.1
 */
@Incubating
public interface Swiftc extends NativeToolChain {
    /**
     * The paths setting required for executing the tool chain.
     * These are used to locate tools for this tool chain, and are prepended to the system PATH when executing these tools.
     */
    List<File> getPath();

import okhttp3.internal.connection.Exchange
import okhttp3.internal.connection.RealCall

/**
 * A concrete interceptor chain that carries the entire interceptor chain: all application
 * interceptors, the OkHttp core, all network interceptors, and finally the network caller.
 *
 * If the chain is for an application interceptor then [exchange] must be null. Otherwise it is for
 * a network interceptor and [exchange] must be non-null.
 */

	// Pilot injects this outbound filter if the service port name is `mysql`.
	EnableMysqlFilter = env.Register(
		"PILOT_ENABLE_MYSQL_FILTER",
		false,
		"EnableMysqlFilter enables injection of `envoy.filters.network.mysql_proxy` in the filter chain.",
	).Get()

	// EnableRedisFilter enables injection of `envoy.filters.network.redis_proxy` in the filter chain.