}
			w = w<<24 | w>>8
		}
	}
}

// Test vectors are from FIPS 197:
//	https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf

// Appendix A of FIPS 197: Key expansion examples
type KeyTest struct {
	key []byte
	enc []uint32
	dec []uint32 // decryption expansion; not in FIPS 197, computed from C implementation.
}

var keyTests = []KeyTest{
	{

		cidrs      []*networkingapiv1alpha1.ServiceCIDR
		ips        []*networkingapiv1alpha1.IPAddress
		cidrSynced *networkingapiv1alpha1.ServiceCIDR
		want       bool
	}{
		{
			name:       "empty",
			cidrSynced: makeServiceCIDR(defaultservicecidr.DefaultServiceCIDRName, "192.168.0.0/24", "2001:db2::/64"),
			want:       true,
		},
		{
			name: "CIDR and no IPs",
			cidrs: []*networkingapiv1alpha1.ServiceCIDR{

	info.externalIPs = ipFamilyMap[ipFamily]

	// Log the IPs not matching the ipFamily
	if ips, ok := ipFamilyMap[proxyutil.OtherIPFamily(ipFamily)]; ok && len(ips) > 0 {
		klog.V(4).InfoS("Service change tracker ignored the following external IPs for given service as they don't match IP Family",
			"ipFamily", ipFamily, "externalIPs", ips, "service", klog.KObj(service))
	}

	for dnsName := range seenDNSNames {
		dnsNames = append(dnsNames, dnsName)
	}
	for ip := range seenIPs {
		ips = append(ips, netutils.ParseIPSloppy(ip))
	}

	// return in stable order
	sort.Strings(dnsNames)
	sort.Slice(ips, func(i, j int) bool { return ips[i].String() < ips[j].String() })

	return dnsNames, ips
}

// NewKubeletClientCertificateManager sets up a certificate manager without a

func benchmarkIPEqual(b *testing.B, size int) {
	ips := make([]IP, 1000)
	for i := range ips {
		ips[i] = make(IP, size)
		rand.Read(ips[i])
	}
	// Half of the N are equal.
	for i := 0; i < b.N/2; i++ {
		x := ips[i%len(ips)]
		y := ips[i%len(ips)]
		x.Equal(y)
	}
	// The other half are not equal.
	for i := 0; i < b.N/2; i++ {
		x := ips[i%len(ips)]
		y := ips[(i+1)%len(ips)]
		x.Equal(y)
	}

	}
}

var giantResponse = func() []dns.RR {
	ips := make([]netip.Addr, 0)
	for i := 0; i < 64; i++ {
		ips = append(ips, netip.MustParseAddr(fmt.Sprintf("240.0.0.%d", i)))
	}
	return a("aaaaaaaaaaaa.aaaaaa.", ips)
}()

func makeUpstream(t test.Failer, responses map[string]string) string {
	mux := dns.NewServeMux()

		add rule ip6 kube-proxy services ip6 daddr @nodeport-ips meta l4proto . th dport vmap @service-nodeports
		add element ip6 kube-proxy cluster-ips { fd00:172:30::41 }
		add element ip6 kube-proxy nodeport-ips { 2001:db8::1 }
		add element ip6 kube-proxy nodeport-ips { 2001:db8:1::2 }

			service.Hostname, ServiceHostname(serviceName, namespace, domainSuffix))
	}

	ips := service.ClusterVIPs.GetAddressesFor(clusterID)
	if len(ips) != 1 {
		t.Fatalf("number of ips incorrect => %q, want 1", len(ips))
	}

	if ips[0] != ip {
		t.Fatalf("service IP incorrect => %q, want %q", ips[0], ip)
	}

	actualIPs := service.ClusterVIPs.GetAddressesFor(clusterID)
	expectedIPs := []string{ip}

		t.Errorf("expected ext key usage %v, got %v", expectedConfig.Usages, cfg.Usages)
	}

	if len(cfg.AltNames.IPs) != 1 || cfg.AltNames.IPs[0].String() != expectedConfig.AltNames.IPs[0].String() {
		t.Errorf("expected SAN IPs %v, got %v", expectedConfig.AltNames.IPs, cfg.AltNames.IPs)
	}

	if len(cfg.AltNames.DNSNames) != 1 || cfg.AltNames.DNSNames[0] != expectedConfig.AltNames.DNSNames[0] {

	// amd64/v3:"LZCNTQ", -"BSRQ"
	// s390x:"FLOGR"
	// arm:"CLZ" arm64:"CLZ"
	// mips:"CLZ"
	// wasm:"I64Clz"
	// ppc64x:"CNTLZD"
	return bits.LeadingZeros(n)
}

func LeadingZeros64(n uint64) int {
	// amd64/v1,amd64/v2:"BSRQ"
	// amd64/v3:"LZCNTQ", -"BSRQ"
	// s390x:"FLOGR"
	// arm:"CLZ" arm64:"CLZ"
	// mips:"CLZ"
	// wasm:"I64Clz"
	// ppc64x:"CNTLZD"
	return bits.LeadingZeros64(n)
}