chain: Array<out X509Certificate>,
    authType: String,
    host: String,
  ): List<Certificate> {
    if (host in insecureHosts) return listOf()
    try {
      val method =
        checkServerTrustedMethod
          ?: throw CertificateException("Failed to call checkServerTrusted")
      return method.invoke(delegate, chain, authType, host) as List<Certificate>
    } catch (e: InvocationTargetException) {

kind: VirtualService
metadata:
  name: valid-virtual-service
spec:
  hosts:
    - c
  http:
    - route:
      - destination:
          host: c
          subset: v1
        weight: 75
      - destination:
          host: c
          subset: v2
        weight: 25`
	validVirtualServiceJSON = `{
"apiVersion": "networking.istio.io/v1alpha3",
"kind": "VirtualService",
"metadata": {

	log.Info("CNI ambient server terminating, cleaning up node net rules")

	log.Debug("removing host iptables rules")
	s.hostIptables.DeleteHostRules()

	log.Debug("destroying host ipset")
	s.hostsideProbeIPSet.Flush()
	if err := s.hostsideProbeIPSet.DestroySet(); err != nil {
		log.Warnf("could not destroy host ipset on shutdown")
	}

	s.netServer.Stop()
}

}

// Given a string of the form "host", "host:port", or "[ipv6::address]:port",
// return true if the string includes a port.
func hasPort(s string) bool { return strings.LastIndex(s, ":") > strings.LastIndex(s, "]") }

// removeEmptyPort strips the empty port in ":port" to ""
// as mandated by RFC 3986 Section 6.2.3.
func removeEmptyPort(host string) string {
	if hasPort(host) {
		return strings.TrimSuffix(host, ":")
	}

import (
	"encoding/json"
	"time"
)

const (
	defaultTTL            = 30
	defaultContextTimeout = 5 * time.Minute
)

// SrvRecord - represents a DNS service record
type SrvRecord struct {
	Host     string      `json:"host,omitempty"`
	Port     json.Number `json:"port,omitempty"`
	Priority int         `json:"priority,omitempty"`
	Weight   int         `json:"weight,omitempty"`
	Text     string      `json:"text,omitempty"`

    }
    protected void parseURL( URL u, String spec, int start, int limit ) {
        String host = u.getHost();
        String path, ref;
        int port;

        if( spec.equals( "smb1://" )) {
            spec = "smb1:////";
            limit += 2;
        } else if( spec.startsWith( "smb1://" ) == false &&
                    host != null && host.length() == 0 ) {
            spec = "//" + spec;
            limit += 2;
        }

  fun encodeQuery(
    host: String,
    type: Int,
  ): ByteString =
    Buffer().apply {
      writeShort(0) // query id
      writeShort(256) // flags with recursion
      writeShort(1) // question count
      writeShort(0) // answerCount
      writeShort(0) // authorityResourceCount
      writeShort(0) // additional

      val nameBuf = Buffer()
      val labels = host.split('.').dropLastWhile { it.isEmpty() }

)

// Exposed for testing "constants"
var (
	CNIBinDir     = "/opt/cni/bin"
	HostCNIBinDir = "/host/opt/cni/bin"
	// Well-known subpath we will mount any needed host-mounts under,
	// to preclude shadowing or breaking any pod-internal mounts
	HostMountsPath = "/host"

	reqQueries := r.Form
	// find whether "host" is part of list of signed headers.
	// if not return ErrUnsignedHeaders. "host" is mandatory.
	if !slices.Contains(signedHeaders, "host") {
		return nil, ErrUnsignedHeaders
	}
	extractedSignedHeaders := make(http.Header)
	for _, header := range signedHeaders {
		// `host` will not be found in the headers, can be found in r.Host.

				"X-Amz-SignedHeaders":  "host;x-amz-content-sha256;x-amz-date",
				"X-Amz-Credential":     fmt.Sprintf(credentialTemplate, accessKeyID, now.Format(yyyymmdd), "us-west-1"),
				"X-Amz-Content-Sha256": payloadSHA256,
			},
			region:   "us-west-1",
			expected: ErrUnsignedHeaders,
		},
		// (3) Should fail to extract headers if the host header is not signed.
		{
			queryParams: map[string]string{