fs.StringVar(&o.config.Winkernel.SourceVip, "source-vip", o.config.Winkernel.SourceVip, "The IP address of the source VIP for non-DSR.")
	fs.StringVar(&o.config.Winkernel.NetworkName, "network-name", o.config.Winkernel.NetworkName, "The name of the cluster network.")
	fs.BoolVar(&o.config.Winkernel.EnableDSR, "enable-dsr", o.config.Winkernel.EnableDSR, "If true make kube-proxy apply DSR policies for service VIP")

	if v := unsafe.Sizeof(si); v != 128 {
		t.Fatalf("sizeof: got %d, want 128", v)
	}

	ofSigno := 0
	ofErrno := 4
	ofCode := 8
	if strings.HasPrefix(runtime.GOARCH, "mips") {
		// These two fields are swapped on MIPS platforms.
		ofErrno, ofCode = ofCode, ofErrno
	}
	ofPid := 12
	if host64bit {
		ofPid = 16
	}
	ofUid := ofPid + 4
	ofStatus := ofPid + 8

	offsets := []struct {
		name string

// Copyright 2023 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

//go:build linux && !(mips || mipsle || mips64 || mips64le)

package unix

type siErrnoCode struct {
	Errno int32
	Code  int32

	{"illumos", "amd64"},
	{"ios", "amd64"},
	{"ios", "arm64"},
	{"js", "wasm"},
	{"linux", "386"},
	{"linux", "amd64"},
	{"linux", "arm"},
	{"linux", "arm64"},
	{"linux", "loong64"},
	{"linux", "mips"},
	{"linux", "mips64"},
	{"linux", "mips64le"},
	{"linux", "mipsle"},
	{"linux", "ppc64"},
	{"linux", "ppc64le"},
	{"linux", "riscv64"},
	{"linux", "s390x"},
	{"linux", "sparc64"},
	{"netbsd", "386"},

the forward path.

## kube-proxy's use of nftables hooks

Kube-proxy uses nftables for seven things:

  - Using DNAT to rewrite traffic from service IPs (cluster IPs, external IPs, load balancer
    IP, and NodePorts on node IPs) to the corresponding endpoint IPs.

  - Using SNAT to masquerade traffic as needed to ensure that replies to it will come back
    to this node/namespace (so that they can be un-DNAT-ed).

	for dnsName := range seenDNSNames {
		dnsNames = append(dnsNames, dnsName)
	}
	for ip := range seenIPs {
		ips = append(ips, netutils.ParseIPSloppy(ip))
	}

	// return in stable order
	sort.Strings(dnsNames)
	sort.Slice(ips, func(i, j int) bool { return ips[i].String() < ips[j].String() })

	return dnsNames, ips
}

// NewKubeletClientCertificateManager sets up a certificate manager without a

// Copyright 2014 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

//go:build (linux && 386) || (linux && arm) || (linux && mips) || (linux && mipsle)

package syscall

func init() {
	// On 32-bit Linux systems, the fcntl syscall that matches Go's
	// Flock_t type is SYS_FCNTL64, not SYS_FCNTL.
	fcntl64Syscall = SYS_FCNTL64

func benchmarkIPEqual(b *testing.B, size int) {
	ips := make([]IP, 1000)
	for i := range ips {
		ips[i] = make(IP, size)
		rand.Read(ips[i])
	}
	// Half of the N are equal.
	for i := 0; i < b.N/2; i++ {
		x := ips[i%len(ips)]
		y := ips[i%len(ips)]
		x.Equal(y)
	}
	// The other half are not equal.
	for i := 0; i < b.N/2; i++ {
		x := ips[i%len(ips)]
		y := ips[(i+1)%len(ips)]
		x.Equal(y)
	}

	}
}

var giantResponse = func() []dns.RR {
	ips := make([]netip.Addr, 0)
	for i := 0; i < 64; i++ {
		ips = append(ips, netip.MustParseAddr(fmt.Sprintf("240.0.0.%d", i)))
	}
	return a("aaaaaaaaaaaa.aaaaaa.", ips)
}()

func makeUpstream(t test.Failer, responses map[string]string) string {
	mux := dns.NewServeMux()

	ipa, err := netip.ParseAddr(ip)
	if err != nil {
		return false
	}
	return ipa.Is4()
}

// IPsSplitV4V6 returns two slice of ipv4 and ipv6 string slice.
func IPsSplitV4V6(ips []string) (ipv4 []string, ipv6 []string) {
	for _, i := range ips {
		ip, err := netip.ParseAddr(i)
		if err != nil {
			log.Debugf("ignoring un-parsable IP address: %v", err)
			continue
		}
		if ip.Is4() {
			ipv4 = append(ipv4, ip.String())