*/
    public enum ErrorCode {
        // Network errors
        CONNECTION_FAILED("Network connection failed", ErrorCategory.NETWORK, true), CONNECTION_TIMEOUT("Connection timed out",
                ErrorCategory.NETWORK, true), CONNECTION_RESET("Connection reset by peer", ErrorCategory.NETWORK,
                        true), HOST_NOT_FOUND("Host not found", ErrorCategory.NETWORK, false),

        // Authentication errors

    /** A duplicate name exists on the network */
    int NT_STATUS_DUPLICATE_NAME = 0xC00000bd;
    /** The specified network name is no longer available */
    int NT_STATUS_NETWORK_NAME_DELETED = 0xC00000c9;
    /** Network access is denied */
    int NT_STATUS_NETWORK_ACCESS_DENIED = 0xC00000ca;
    /** The network name cannot be found */
    int NT_STATUS_BAD_NETWORK_NAME = 0xC00000cc;

    /**
     * Network interface capability flag for RSS support
     */
    public static final int NETWORK_INTERFACE_CAP_RSS = 0x00000001;

    /**
     * Network interface capability flag for RDMA support
     */
    public static final int NETWORK_INTERFACE_CAP_RDMA = 0x00000002;

    /**
     * FSCTL code for querying network interface information
     */

* and don't send any authentication credentials.

This type of attack is mainly relevant when:

* the application is running locally (e.g. on `localhost`) or in an internal network
* and the application doesn't have any authentication, it expects that any request from the same network can be trusted.

## Example Attack { #example-attack }

Imagine you build a way to run a local AI agent.

It provides an API at

```

public interface MetadataResolutionRequest extends RepositoryRequest {

    /**
     * Indicates whether network access to remote repositories has been disabled.
     *
     * @return {@code true} if remote access has been disabled, {@code false} otherwise.
     */
    @Override
    boolean isOffline();

    /**
     * Enables/disables network access to remote repositories.
     *

   *
   * @since 29.0
   */
  ElementOrder<N> incidentEdgeOrder();

  /**
   * Returns a live view of this graph as a {@link Network} whose edges {@code E} are {@code
   * EndpointPair<N>} objects (that is, a {@code Network<N, EndpointPair<N>>}). The resulting {@code
   * Network}'s edge-oriented methods (such as {@code inEdges()}) will return views transformed from

      network.addEdge(1, 2, "1-2b");
      network.addEdge(2, 3, "2-3");
      network.addEdge(3, 1, "3-1");
    }
    assertThat(hasCycle(directedNetwork)).isTrue();
    assertThat(hasCycle(undirectedNetwork)).isTrue();
  }

  @Test
  public void hasCycle_deepPathNetwork() {
    for (MutableNetwork<Integer, String> network : networksToTest) {
      for (int i = 0; i < 100000; i++) {

- Azure Cloud Provider now supports using Azure network resources (Virtual Network, Load Balancer, Public IP, Route Table, Network Security Group, etc.) in different AAD Tenant and Subscription than those for the Kubernetes cluster. To use the feature, please reference https://kubernetes-sigs.github.io/cloud-provider-azure/install/configs/#host-network-resources-in-different-aad-tenant-and-subscription. ([#88384](https://github.com/kubernetes/kubernetes/pull/88384),...

import okhttp3.internal.toHostHeader
import okio.GzipSource
import okio.buffer

/**
 * Bridges from application code to network code. First it builds a network request from a user
 * request. Then it proceeds to call the network. Finally it builds a user response from the network
 * response.
 */
class BridgeInterceptor : Interceptor {
  @Throws(IOException::class)

        int access = 123;

        doThrow(new IOException("Network error")).when(mockDcerpcHandle).sendrecv(any(MsrpcLsarOpenPolicy2.class));

        // Act & Assert
        IOException thrown = assertThrows(IOException.class, () -> {
            new LsaPolicyHandle(mockDcerpcHandle, server, access);
        });

        assertEquals("Network error", thrown.getMessage());