return fmt.Errorf("expected valid IPv4 loopback address in CIDR %s; found %v", cidr, ipp.Addr())
	}

	ones := ipp.Bits()
	if ones < 8 || ones > 32 {
		return fmt.Errorf("expected CIDR %s to have mask in range [8, 32]; found %v", cidr, ones)
	}
	return nil

};

#undef sa_handler
#undef sa_flags
#undef sa_restorer
#undef sa_mask

struct xsigaction {
	void (*sa_handler)(void);
	unsigned long sa_flags;
	void (*sa_restorer)(void);
	unsigned int sa_mask;		// mask last for extensibility
};
*/
import "C"

const (
	PROT_NONE  = C.PROT_NONE
	PROT_READ  = C.PROT_READ
	PROT_WRITE = C.PROT_WRITE
	PROT_EXEC  = C.PROT_EXEC

	MAP_ANON    = C.MAP_ANONYMOUS

	use(p1[ui%1001])
	use(p1k[ui%1001])
	use(p100k[ui%1001]) // ERROR "index bounds check elided"

	// Bitwise and truncates the maximum value to the mask value.
	// The result (for a positive mask) cannot be negative, so elision
	// applies to both signed and unsigned indexes.
	use(s[i&999])
	use(a1[i&999])
	use(a1k[i&999])   // ERROR "index bounds check elided"

//
//            IEEE: P'(x) = 0x0edb88320
//      Castagnoli: P'(x) = 0x082f63b78


// IEEE polynomial constants
DATA    ·crclecons+0(SB)/8,  $0x0F0E0D0C0B0A0908       // LE-to-BE mask
DATA    ·crclecons+8(SB)/8,  $0x0706050403020100
DATA    ·crclecons+16(SB)/8, $0x00000001c6e41596       // R2
DATA    ·crclecons+24(SB)/8, $0x0000000154442bd4       // R1

  // perNodeHostBits defines the number of host bits to be configured per node.
  // A subnet mask determines how much of the address is used for network bits
  // and host bits. For example an IPv4 address of 192.168.0.0/24, splits the
  // address into 24 bits for the network portion and 8 bits for the host portion.
  // To allocate 256 IPs, set this field to 8 (a /24 mask for IPv4 or a /120 for IPv6).
  // Minimum value is 4 (16 IPs).
  // This field is immutable.

	// +Inf special cases
	MOVQ    $PosInf, AX
	MOVQ    x+0(FP), R8
	CMPQ    AX, R8
	JEQ     isPosInf
	MOVQ    y+8(FP), R9
	CMPQ    AX, R9
	JEQ     isPosInf
	// NaN special cases
	MOVQ    $~(1<<63), DX // bit mask
	MOVQ    $PosInf, AX
	MOVQ    R8, BX
	ANDQ    DX, BX // x = |x|
	CMPQ    AX, BX
	JLT     isMaxNaN
	MOVQ    R9, CX
	ANDQ    DX, CX // y = |y|
	CMPQ    AX, CX
	JLT     isMaxNaN
	// ±0 special cases

TEXT ·And64(SB), NOSPLIT, $0-20
	MOVL	ptr+0(FP), BP
	// DI:SI = v
	MOVL	val_lo+4(FP), SI
	MOVL	val_hi+8(FP), DI
	// DX:AX = *addr
	MOVL	0(BP), AX
	MOVL	4(BP), DX
casloop:
	// CX:BX = DX:AX (*addr) & DI:SI (mask)
	MOVL	AX, BX
	MOVL	DX, CX
	ANDL	SI, BX
	ANDL	DI, CX
	LOCK
	CMPXCHG8B	0(BP)
	JNZ casloop
	MOVL	AX, ret_lo+12(FP)
	MOVL	DX, ret_hi+16(FP)
	RET

		return ((x - t*PI1) - t*PI2) - t*PI3
	}
	// Must apply Payne-Hanek range reduction
	const (
		mask     = 0x7FF
		shift    = 64 - 11 - 1
		bias     = 1023
		fracMask = 1<<shift - 1
	)
	// Extract out the integer and exponent such that,
	// x = ix * 2 ** exp.
	ix := math.Float64bits(x)
	exp := int(ix>>shift&mask) - bias - shift
	ix &= fracMask
	ix |= 1 << shift

# If a correct GOROOT is baked in to the 'go' command itself, 'go run' and
# 'go test' should not implicitly set GOROOT in the process environment
# (because that could mask an unexpected production dependency on the GOROOT
# environment variable), but 'go generate' should (because the generator may
# reasonably expect to be able to locate the GOROOT for which it is generating
# code).

		inpodMarkRule := netlink.NewRule()
		inpodMarkRule.Family = family
		inpodMarkRule.Table = RouteTableInbound
		inpodMarkRule.Mark = InpodTProxyMark
		inpodMarkRule.Mask = InpodTProxyMask
		inpodMarkRule.Priority = 32764
		rules = append(rules, inpodMarkRule)
	}

	for _, rule := range rules {
		log.Debugf("Iterating netlink rule : %+v", rule)
		if err := f(rule); err != nil {