* by Kadatch and Jenkins, 2010.
     */

    Crc32cHasher() {
      super(16);
    }

    private boolean finished = false;

    /*
     * This trick allows us to avoid having separate states for "first four ints" and "all other
     * four int chunks."  The state we want after the first four bytes is
     *
     * crc0 = ~int0
     * crc1 = int1
     * crc2 = int2

import java.nio.charset.Charset;
import java.nio.charset.UnsupportedCharsetException;
import java.util.Arrays;
import junit.framework.TestCase;

/**
 * Tests for {@link MediaType}.
 *
 * @author Gregory Kick
 */
@GwtCompatible(emulated = true)
public class MediaTypeTest extends TestCase {
  @J2ktIncompatible
  @GwtIncompatible // reflection
  public void testParse_useConstants() throws Exception {

            waitForIo() // Wait until we receive a WINDOW_UPDATE for this stream.
          }
        } finally {
          writeTimeout.exitAndThrowIfTimedOut()
        }

        checkOutNotClosed() // Kick out if the stream was reset or closed while waiting.
        toWrite = minOf(writeBytesMaximum - writeBytesTotal, sendBuffer.size)
        writeBytesTotal += toWrite

 *
 * <p>The tested methods and constructors are invoked -- each time with one parameter being null and
 * the rest not null -- and the test fails if no expected exception is thrown. {@code
 * NullPointerTester} uses best effort to pick non-null default values for many common JDK and Guava
 * types, and also for interfaces and public classes that have public parameter-less constructors.

Incoming requests have multiple "layers": TLS wrapping HTTP CONNECT that is wrapping the user's connection.

To unwrap the first layer, we terminate TLS.
As part of this, we need to pick the correct certificate to serve on behalf of the destination workload.
As discussed in [HBONE](#hbone), this is based on the destination IP.

		err = reduceWriteQuorumErrs(ctx, errs, objectOpIgnoredErrs, writeQuorum)
	} else {
		err = reduceReadQuorumErrs(ctx, errs, objectOpIgnoredErrs, readQuorum)
	}
	if err != nil {
		return fi, nil, err
	}

	// Pick one from the first valid metadata.
	fi, err = pickValidFileInfo(ctx, partsMetadata, modTime, etag, quorum)
	return fi, partsMetadata, err
}

 *
 * <h3>Further reading</h3>
 *
 * <p>See the Guava User Guide article on <a
 * href="https://github.com/google/guava/wiki/RangesExplained">{@code Range}</a>.
 *
 * @author Kevin Bourrillion
 * @author Gregory Kick
 * @since 10.0
 */
@GwtCompatible
@SuppressWarnings("rawtypes") // https://github.com/google/guava/issues/989
@Immutable(containerOf = "C")
@ElementTypesAreNonnullByDefault

stick, and held it out to the puppy; whereupon the puppy jumped
into the air off all its feet at once, with a yelp of delight,
and rushed at the stick, and made believe to worry it; then Alice
dodged behind a great thistle, to keep herself from being run
over; and the moment she appeared on the other side, the puppy
made another rush at the stick, and tumbled head over heels in

}

function cidr_to_ips() {
    CIDR="$1"
    # cidr_to_ips returns a list of single IPs from a CIDR. We skip 1000 (since they are likely to be allocated
    # already to other services), then pick the next 100.
    python3 - <<EOF
from ipaddress import ip_network, IPv6Network;
from itertools import islice;

net = ip_network('$CIDR')
net_bits = 128 if type(net) == IPv6Network else 32;

    // an SSL context for an attacking webserver. It includes both these rogue certificates plus the
    // trusted good certificate above. The attack is that by including the good certificate in the
    // chain, we may trick the certificate pinner into accepting the rouge certificate.
    val compromisedIntermediateCa =
      HeldCertificate.Builder()
        .signedBy(rootCa)
        .certificateAuthority(0)
        .serialNumber(4L)