testClientCert(t, "basic (client cert)", r1pool, L2_I.key, [][]byte{L2_I.der, I_R1.der}, true)
	fipstls.Force()
	testServerCert(t, "basic (fips)", r1pool, L2_I.key, [][]byte{L2_I.der, I_R1.der}, false)
	testClientCert(t, "basic (fips, client cert)", r1pool, L2_I.key, [][]byte{L2_I.der, I_R1.der}, false)
	fipstls.Abandon()

	if t.Failed() {
		t.Fatal("basic test failed, skipping exhaustive test")
	}

func AddressSet(isValid func(ip net.IP) bool, addrs []net.Addr) sets.Set[string] {
	ips := sets.New[string]()
	for _, a := range addrs {
		var ip net.IP
		switch v := a.(type) {
		case *net.IPAddr:
			ip = v.IP
		case *net.IPNet:
			ip = v.IP
		default:
			continue
		}
		if isValid(ip) {
			ips.Insert(ip.String())
		}
	}
	return ips
}

// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

//go:build 386 || amd64 || s390x || arm || arm64 || loong64 || ppc64 || ppc64le || mips || mipsle || wasm || mips64 || mips64le || riscv64

package bytealg

import _ "unsafe" // For go:linkname

//go:noescape
func Compare(a, b []byte) int

func CompareString(a, b string) int {

		telemetry.Inc("go/platform/target/goamd64:" + cfg.GOAMD64)
	case "arm":
		telemetry.Inc("go/platform/target/goarm:" + cfg.GOARM)
	case "arm64":
		telemetry.Inc("go/platform/target/goarm64:" + cfg.GOARM64)
	case "mips":
		telemetry.Inc("go/platform/target/gomips:" + cfg.GOMIPS)
	case "ppc64":
		telemetry.Inc("go/platform/target/goppc64:" + cfg.GOPPC64)
	case "riscv64":
		telemetry.Inc("go/platform/target/goriscv64:" + cfg.GORISCV64)

// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/mips/include /tmp/mips/include/asm/unistd.h
// Code generated by the command above; see README.md. DO NOT EDIT.

//go:build mips && linux

package unix

const (
	SYS_SYSCALL                      = 4000
	SYS_EXIT                         = 4001
	SYS_FORK                         = 4002
	SYS_READ                         = 4003
	SYS_WRITE                        = 4004

				if cidr.Contains(proxier.nodeIP) {
					allowFromNode = true
				}
			}
			// For VIP-like LBs, the VIP is often added as a local
			// address (via an IP route rule).  In that case, a request
			// from a node to the VIP will not hit the loadbalancer but
			// will loop back with the source IP set to the VIP.  We
			// need the following rules to allow requests from this node.
			if allowFromNode {

//
// NOTE fields are exported to be used by TestSiginfoChildLayout.
type SiginfoChild struct {
	Signo       int32
	siErrnoCode                // Two int32 fields, swapped on MIPS.
	_           [is64bit]int32 // Extra padding for 64-bit hosts only.

	// End of common part. Beginning of signal-specific part.

	Pid    int32
	Uid    uint32
	Status int32

	// Pad to 128 bytes.

	b.ReportAllocs()
	ips := []net.IP{}
	for i := 0; i < b.N; i++ {
		ip := net.IPv4(8, 8, 8, 8)
		ips = ips[:0]
		for i := 0; i < 100; i++ {
			ips = append(ips, ip)
		}
	}
}

func BenchmarkIPv4(b *testing.B) {
	b.ReportAllocs()
	ips := []Addr{}
	for i := 0; i < b.N; i++ {
		ip := IPv4(8, 8, 8, 8)
		ips = ips[:0]
		for i := 0; i < 100; i++ {

// license that can be found in the LICENSE file.

//go:build !purego

// SHA256 block routine. See sha256block.go for Go equivalent.
//
// The algorithm is detailed in FIPS 180-4:
//
//  https://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf
//
// Wt = Mt; for 0 <= t <= 15
// Wt = SIGMA1(Wt-2) + SIGMA0(Wt-15) + Wt-16; for 16 <= t <= 63
//
// a = H0
// b = H1
// c = H2
// d = H3
// e = H4
// f = H5

	testCases := []struct {
		name      string
		pods      []*corev1.Pod
		ips       []string
		ports     []corev1.ServicePort
		wantPorts []model.ServiceInstancePort
	}{
		{
			name: "multiple proxy ips single port",
			pods: []*corev1.Pod{pod1},
			ips:  []string{"128.0.0.1", "192.168.2.6"},
			ports: []corev1.ServicePort{
				{
					Name:       "tcp-port",