iptablesBuilder := builder.NewIptablesRuleBuilder(ipbuildConfig(cfg.cfg))

	// Insert jumps to our custom chains
	// This is mostly just for visual tidiness and cleanup, as we can delete the secondary chains and jumps
	// without polluting the main table too much.

	// -t mangle -A PREROUTING -j ISTIO_PRERT
	iptablesBuilder.AppendRule(

start 0 call f1
f1 0 nosplit call f2
f2 0 nosplit call f3
f3 0 nosplit call f2
REJECT

# Chains of ordinary functions okay.
start 0 call f1
f1 80 call f2
f2 80

# Chains of nosplit must fit in the stack limit, 128 bytes.
start 0 call f1
f1 80 nosplit call f2
f2 80 nosplit
REJECT

# Larger chains.
start 0 call f1
f1 16 call f2
f2 16 call f3
f3 16 call f4
f4 16 call f5
f5 16 call f6

	})

	fmt.Fprintln(w, "LISTENER\tCHAIN\tMATCH\tDESTINATION")
	for _, l := range listeners {
		chains := getFilterChains(l)
		lname := "envoy://" + l.GetName()
		// Avoid duplicating the listener and filter name
		if l.GetInternalListener() != nil && len(chains) == 1 && chains[0].GetName() == lname {
			lname = "internal"
		}
		for _, fc := range chains {

			name := fc.GetName()

	}
	cert, err := ParsePemEncodedCertificate(certBytes)
	if err != nil {
		return fmt.Errorf("failed to parse cert PEM: %v", err)
	}
	chains, err := cert.Verify(opts)

	if len(chains) == 0 || err != nil {
		return fmt.Errorf(
			"cannot verify the cert with the provided root chain and cert "+
				"pool with error: %v", err)
	}

	// Verify that the key can be correctly parsed.

    @Rule public final Sample variants = sample(testDirectoryProvider, 'variants')
    @Rule public final Sample toolChains = sample(testDirectoryProvider, 'tool-chains')
    @Rule public final Sample prebuilt = sample(testDirectoryProvider, 'prebuilt')
    @Rule public final Sample targetPlatforms = sample(testDirectoryProvider, 'target-platforms')

      }
    }
  }

  /**
   * Not checking the CA bit created a vulnerability in old OkHttp releases. It is exploited by
   * triggering different chains to be discovered by the TLS engine and our chain cleaner. In this
   * attack there's several different chains.
   *
   *
   * The victim's gets a non-CA certificate signed by a CA, and pins the CA root and/or
   * intermediate. This is business as usual.
   *

            }
            descriptor.language === Language.CPP -> {
                "* An installed {cpp} compiler. See which link:{userManualPath}/building_cpp_projects.html#sec:cpp_supported_tool_chain[{cpp} tool chains] are supported by Gradle."
            }
            else -> {
                ""

				COMMIT
				`),
			output: &IPTablesDump{
				Tables: []Table{{
					Name: iptables.TableFilter,
					Chains: []Chain{{
						Name: iptables.Chain("KUBE-SERVICES"),
					}, {
						Name: iptables.Chain("KUBE-EXTERNAL-SERVICES"),
					}, {
						Name: iptables.Chain("KUBE-FORWARD"),
						Rules: []*Rule{

    tf_executor.fetch
  }
  func.return
}

// -----

// Tests one group with multiple branches.
// We expect the following dependency chains after the pass
// A -> B -> fetch, C -> D -> fetch, E -> fetch.
func.func @one_group_multiple_branches() {
  tf_executor.graph {
    // CHECK: %[[control:.*]] = tf_executor.island wraps "tf.A"()

  // CHECK: [[out_ch:%.*]] = tfrt.merge.chains [[cond_res]]#0, %arg0 : !tfrt.chain, !tfrt.chain
  // CHECK: tfrt.return [[out_ch]], [[cond_res]]#1 : !tfrt.chain, !tfrt_fallback.tf_tensor
  func.return %2 : tensor<i32>
}

// CHECK-LABEL: func @cond_stateful(%arg0: !tfrt.chain, %arg1: !tfrt_fallback.tf_tensor) -> (!tfrt.chain, !tfrt_fallback.tf_tensor)
func.func @cond_stateful(%arg0: tensor<i32>) -> tensor<i32> {