* Updates defaultbackend to 1.5 ([#69380](https://github.com/kubernetes/kubernetes/pull/69380), [@bowei](https://github.com/bowei))
* Restrict redirect following from the apiserver to same-host redirects, and ignore redirects in some cases. ([#66516](https://github.com/kubernetes/kubernetes/pull/66516), [@tallclair](https://github.com/tallclair))

import javax.net.ssl.X509TrustManager
import okhttp3.internal.SuppressSignatureCheck
import okhttp3.internal.tls.CertificateChainCleaner

/**
 * Android implementation of CertificateChainCleaner using direct Android API calls.
 * Not used if X509TrustManager doesn't implement [X509TrustManager.checkServerTrusted] with
 * an additional host param.
 */
internal class AndroidCertificateChainCleaner(

        // Mocking SmbFile constructor is tricky, so we'll just verify the call to the delegate
        // and ensure no exception is thrown for a valid URL.
        // The actual SmbFile creation is outside the scope of this wrapper's direct responsibility.

        // For coverage, we'll ensure the method doesn't throw MalformedURLException for a valid URL
        // and that it attempts to create an SmbFile.

   * address.
   */
  private fun routeMatchesAny(candidates: List<Route>): Boolean =
    candidates.any {
      it.proxy.type() == Proxy.Type.DIRECT &&
        route.proxy.type() == Proxy.Type.DIRECT &&
        route.socketAddress == it.socketAddress
    }

  private fun supportsUrl(url: HttpUrl): Boolean {
    assertLockHeld()

    val routeUrl = route.address.url

        // If a defensive copy were made, this test would fail, and the behavior would be more robust.
        // Given the current implementation, direct modification of the passed array affects the AvPair.
        // If this is not desired, a defensive copy should be added in the AvPair constructor.
        assertEquals(0x05, avPair.getRaw()[0],

          "",
        )
      },
    ).containsExactly(
      "callStart: Request{method=GET, url=http://google.com/robots.txt}",
      "proxySelectStart: http://google.com/",
      "proxySelectEnd: [DIRECT]",
      "dnsStart: google.com",
      "callFailed: java.net.UnknownHostException: shortcircuit",
    )
    // We should consider if these logs should retain Exceptions
    assertThat(logs.last().throwable).isNull()

        // Hexdump.toHexString produces uppercase hex
        assertTrue(result.toLowerCase().contains("0x001200a9"));
        // ACE.toString() outputs "Direct    " with 4 spaces
        assertTrue(result.contains("Direct"));
        assertTrue(result.contains("This folder only"));
    }

    @Test
    @DisplayName("Test toString format for deny ACE")

      assertThat(handshake.localPrincipal).isNull()
      assertThat(handshake.localCertificates.size).isEqualTo(0)
    }

  /**
   * Asserts that the current response was redirected and returns the prior response.
   */
  fun priorResponse(): RecordedResponse {
    val priorResponse = response!!.priorResponse!!
    return RecordedResponse(priorResponse.request, priorResponse, null, null, null)
  }

 * This filter processes requests with specific encoding requirements and converts
 * character encodings according to configured mapping rules.
 *
 * <p>The filter intercepts requests matching configured path patterns and
 * redirects them with proper character encoding applied to parameters.</p>
 */
public class EncodingFilter implements Filter {
    /** Configuration key for encoding rules mapping */

    /**
     * Create new RDMA negotiation response
     */
    public RdmaNegotiateResponse() {
        // Initialize with default values
        this.status = 0; // Success
        this.selectedVersion = 0x0100; // SMB Direct 1.0
        this.creditsGranted = 0;
        this.maxReceiveSize = RdmaCapabilities.DEFAULT_MAX_RECEIVE_SIZE;
        this.maxReadWriteSize = RdmaCapabilities.DEFAULT_MAX_READ_WRITE_SIZE;