// nf_tables does not use locks
	// legacy added locks in 1.6.2
	return !v.Legacy || v.Version.LessThan(IptablesRestoreLocking)
}

var (
	// IptablesRestoreLocking is the version where locking and -w is added to iptables-restore
	IptablesRestoreLocking = utilversion.MustParseGeneric("1.6.2")
	// IptablesLockfileEnv is the version where XTABLES_LOCKFILE is added to iptables.
	IptablesLockfileEnv = utilversion.MustParseGeneric("1.8.6")
)

//
// Go already sets this (https://github.com/golang/go/issues/46279).
// However, it will restore the original limit for subprocesses (Envoy):
// https://github.com/golang/go/blob/f0d1195e13e06acdf8999188decc63306f9903f5/src/syscall/rlimit.go#L14.
// By explicitly doing it ourselves, we get the limit passed through to Envoy.
//

iptables -t mangle -A ISTIO_PRERT ! -d 127.0.0.1/32 -p tcp -m mark ! --mark 0x539/0xfff -j TPROXY --on-port 15006 --tproxy-mark 0x111/0xfff
iptables -t mangle -A ISTIO_OUTPUT -m connmark --mark 0x111/0xfff -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
iptables -t nat -A ISTIO_OUTPUT ! -o lo -p udp -m udp --dport 53 -j REDIRECT --to-port 15053
iptables -t nat -A ISTIO_OUTPUT -p tcp -m mark --mark 0x111/0xfff -j ACCEPT

			var actual strings.Builder
			for _, rule := range rules {
				fmt.Fprintln(&actual, strings.Join(rule, " "))
			}
			compareToGolden(t, goldenName, actual.String())

			// Check build restore
			compareToGolden(t, goldenName+"-restore", rulesRestore)
		} else {
			if len(rules) > 0 {
				t.Errorf("Unexpected rules to be empty but instead got %#v", rules)
			}
			if rulesRestore != "" {

        return path.replace(File.separatorChar, '/');
    }

    /**
     * Checks if a String is whitespace, empty ("") or null.
     * <p>
     * This function was copied from Apache Commons-Lang to restore TAPI compatibility
     * with Java 6 on old Gradle versions because StringUtils require SQLException which
     * is absent from Java 6.
     */
    public static boolean isBlank(String str) {
        int strLen;

				return err
			}

			// Store the original YAML so we can restore later.
			mu.Lock()
			origCfg[c.Name()] = mcYAML
			mu.Unlock()

			// Parse the YAML.
			mc, err := yamlToInjectConfig(mcYAML)
			if err != nil {
				return err
			}

			// Apply the change.
			if err := update(mc); err != nil {
				return err
			}

			// Store the updated MeshConfig back into the config map.

	"flag"
	"fmt"
	"regexp"

	"k8s.io/klog/v2"
)

//nolint:logcheck // Several functions are normally not okay in a package.
func ExampleHandleErrorWithContext() {
	state := klog.CaptureState()
	defer state.Restore()
	var fs flag.FlagSet
	klog.InitFlags(&fs)
	for flag, value := range map[string]string{
		"one_output":  "true",
		"logtostderr": "false",
	} {
		if err := fs.Set(flag, value); err != nil {

        ++inputTrackingDisabledCounterForThread
    }

    /**
     * Restores the input tracking state to the state it was in before the last call to
     * [disableForCurrentThread].
     */
    fun restoreForCurrentThread() {
        Preconditions.checkState(inputTrackingDisabledCounterForThread > 0, "Restore input tracking state without prior disable is detected")
        --inputTrackingDisabledCounterForThread
    }

// RUN: stablehlo-quant-opt %s -split-input-file -stablehlo-restore-function-name | FileCheck %s

module attributes {tf.versions = {bad_consumers = [], min_consumer = 12 : i32, producer = 1646 : i32}, tf_saved_model.semantics} {
  // CHECK-LABEL: @serving_default
  // CHECK-SAME: %[[ARG0:[^:[:space:]]+]]
  // CHECK-SAME: %[[ARG1:[^:[:space:]]+]]
  func.func private @serving_default(%arg0: tensor<1x4xf32>, %arg1: tensor<4x3xf32>) -> tensor<1x3xf32> {

	if raceenabled {
		racereleasemerge(unsafe.Pointer(&racecgosync))
	}

	// Do not unwind m->g0->sched.sp.
	// Our caller, cgocallback, will do that.
	restore = false
}

func unwindm(restore *bool) {
	if *restore {
		// Restore sp saved by cgocallback during
		// unwind of g's stack (see comment at top of file).
		mp := acquirem()
		sched := &mp.g0.sched