pkg math/rand/v2, method (*Rand) Uint() uint #61716
pkg net, method (*DNSError) Unwrap() error #63116
pkg net, method (*TCPConn) SetKeepAliveConfig(KeepAliveConfig) error #62254
pkg net, type DNSError struct, UnwrapErr error #63116
pkg net, type Dialer struct, KeepAliveConfig KeepAliveConfig #62254
pkg net, type KeepAliveConfig struct #62254
pkg net, type KeepAliveConfig struct, Count int #62254
pkg net, type KeepAliveConfig struct, Enable bool #62254

// are higher.
module example.com/m

go 1.17

replace (
	example.net/lazy v0.1.0 => ./lazy
	example.net/requireincompatible v0.1.0 => ./requireincompatible
)

require example.net/lazy v0.1.0
-- implicit.go --
package implicit

import _ "example.net/lazy"
-- lazy/go.mod --
// Module lazy requires example.com/retract/incompatible v1.0.0.
//

// IPLocalReservedPortsNamespacedKernelVersion is the kernel version in which net.ipv4.ip_local_reserved_ports was namespaced(netns).
// (ref: https://github.com/torvalds/linux/commit/122ff243f5f104194750ecbc76d5946dd1eec934)
const IPLocalReservedPortsNamespacedKernelVersion = "3.16"

// IPVSConnReuseModeMinSupportedKernelVersion is the minium kernel version supporting net.ipv4.vs.conn_reuse_mode.

// limitations under the License.

package hbone

import (
	"context"
	"crypto/tls"
	"fmt"
	"io"
	"net"
	"net/http"
	"strings"
	"sync"
	"time"

	"golang.org/x/net/http2"
	"golang.org/x/net/proxy"

	istiolog "istio.io/istio/pkg/log"
	"istio.io/istio/security/pkg/pki/util"
)

var log = istiolog.RegisterScope("hbone", "")

package netutil

import (
	"net/url"
	"strings"
)

// FROM: http://golang.org/src/net/http/client.go
// Given a string of the form "host", "host:port", or "[ipv6::address]:port",
// return true if the string includes a port.
func hasPort(s string) bool { return strings.LastIndex(s, ":") > strings.LastIndex(s, "]") }

// FROM: http://golang.org/src/net/http/transport.go
var portMap = map[string]string{
	"http":   "80",
	"https":  "443",

// Package deadlineconn implements net.Conn wrapper with configured deadlines.
package deadlineconn

import (
	"net"
	"time"
)

// DeadlineConn - is a generic stream-oriented network connection supporting buffered reader and read/write timeout.
type DeadlineConn struct {
	net.Conn
	readDeadline  time.Duration // sets the read deadline on a connection.

	public final fun -deprecated_keyManager ()Ljavax/net/ssl/X509KeyManager;
	public final fun -deprecated_trustManager ()Ljavax/net/ssl/X509TrustManager;
	public synthetic fun <init> (Ljavax/net/ssl/X509KeyManager;Ljavax/net/ssl/X509TrustManager;Lkotlin/jvm/internal/DefaultConstructorMarker;)V
	public final fun keyManager ()Ljavax/net/ssl/X509KeyManager;
	public final fun sslContext ()Ljavax/net/ssl/SSLContext;

	*fakeNetFD
}

func newFD(net string, sysfd int) *netFD {
	return newPollFD(net, poll.FD{
		Sysfd:         sysfd,
		IsStream:      true,
		ZeroReadIsEOF: true,
	})
}

func newPollFD(net string, pfd poll.FD) *netFD {
	var laddr Addr
	var raddr Addr
	// WASI preview 1 does not have functions like getsockname/getpeername,
	// so we cannot get access to the underlying IP address used by connections.
	//

import assertk.assertions.isEqualTo
import assertk.assertions.isNotNull
import assertk.assertions.isNull
import assertk.assertions.matches
import java.net.http.HttpClient
import java.net.http.HttpClient.Redirect.NORMAL
import java.net.http.HttpRequest
import java.net.http.HttpResponse.BodyHandlers
import mockwebserver3.MockResponse
import mockwebserver3.MockWebServer
import okhttp3.testing.PlatformRule

	}

	return res, nil
}

func checkInterfacesForMatchingAddr(targetAddr net.IP) (match bool, err error) {
	var interfaces []net.Interface
	if interfaces, err = net.Interfaces(); err != nil {
		return false, fmt.Errorf("failed to get interfaces")
	}

	for _, ief := range interfaces {
		var addrs []net.Addr
		if addrs, err = ief.Addrs(); err != nil {
			return
		}
		for _, addr := range addrs {