}
	iv, nonce := random[:16], random[16:]

	prf := hmac.New(sha256.New, s.key)
	prf.Write(iv)
	key := prf.Sum(make([]byte, 0, prf.Size()))

	block, err := aes.NewCipher(key)
	if err != nil {
		return DEK{}, err
	}
	aead, err := cipher.NewGCM(block)
	if err != nil {
		return DEK{}, err
	}

	plaintext, err := sioutil.Random(32)
	if err != nil {
		return DEK{}, err
	}

	}

	return []SecretItem{secret}, nil
}

func secretMetaFromCert(rawCert []byte, trustDomain string) (SecretMeta, error) {
	block, _ := pem.Decode(rawCert)
	if block == nil {
		return SecretMeta{}, fmt.Errorf("failed to parse certificate PEM")
	}
	cert, err := x509.ParseCertificate(block.Bytes)
	if err != nil {
		return SecretMeta{}, err
	}
	var certType string
	if cert.IsCA {
		certType = "CA"
	} else {

func (t *transitionState) addLastDayStats(tier string, ts tierStats) {
	t.lastDayMu.Lock()
	defer t.lastDayMu.Unlock()

	if _, ok := t.lastDayStats[tier]; !ok {
		t.lastDayStats[tier] = &lastDayTierStats{}
	}
	t.lastDayStats[tier].addStats(ts)
}

func (t *transitionState) getDailyAllTierStats() DailyAllTierStats {
	t.lastDayMu.RLock()
	defer t.lastDayMu.RUnlock()

	sync.Mutex
}

func (l *logOnceType) logOnceConsoleIf(ctx context.Context, subsystem string, err error, id string, errKind ...interface{}) {
	if err == nil {
		return
	}

	nerr := unwrapErrs(err)
	l.Lock()
	shouldLog := true
	prev, ok := l.IDMap[id]
	if !ok {
		l.IDMap[id] = onceErr{
			Err:   nerr,
			Count: 1,
		}
	} else if prev.Err.Error() == nerr.Error() {
		// if errors are equal do not log.

	globalAuthPluginMutex.Lock()
	defer globalAuthPluginMutex.Unlock()
	return globalAuthNPlugin
}

func newGlobalAuthZPluginFn() *polplugin.AuthZPlugin {
	globalAuthPluginMutex.Lock()
	defer globalAuthPluginMutex.Unlock()
	return globalAuthZPlugin
}

func setGlobalAuthNPlugin(authn *idplugin.AuthNPlugin) {
	globalAuthPluginMutex.Lock()
	globalAuthNPlugin = authn

	AmzFwdHeaderLastModified       = "x-amz-fwd-header-Last-Modified"

	AmzFwdHeaderObjectLockMode        = "x-amz-fwd-header-x-amz-object-lock-mode"
	AmzFwdHeaderObjectLockLegalHold   = "x-amz-fwd-header-x-amz-object-lock-legal-hold"
	AmzFwdHeaderObjectLockRetainUntil = "x-amz-fwd-header-x-amz-object-lock-retain-until-date"
	AmzFwdHeaderMPPartsCount          = "x-amz-fwd-header-x-amz-mp-parts-count"

     * @param batchMaxSize The maximum batch size delegate should receive (default {@code 500}).
     * @param blockOnLastEvent Should this listener block on last transfer end (completed or corrupted) block? (default {@code true}).
     */
    public SimplexTransferListener(
            TransferListener delegate, int queueSize, int batchMaxSize, boolean blockOnLastEvent) {

   * additional context. Otherwise [e] is returned as-is.
   */
  private fun <E : IOException?> callDone(e: E): E {
    lock.assertNotHeld()

    val connection = this.connection
    if (connection != null) {
      connection.lock.assertNotHeld()
      val toClose: Socket? =
        connection.withLock {
          // Sets this.connection to null.
          releaseConnectionNoEvents()

    public static final int NTLMSSP_REQUEST_NON_NT_SESSION_KEY = 0x00400000;

    /**
    * Sent by the server in the Type 2 message to indicate that it is
    * including a Target Information block in the message.  The Target
    * Information block is used in the calculation of the NTLMv2 response.
    */
    public static final int NTLMSSP_NEGOTIATE_TARGET_INFO = 0x00800000;

    /**
    * Indicates that 128-bit encryption is supported.

				defer t.updating.Unlock()
				t.update(context.Background())
			}()
		}
		return *v, nil
	}

	// Get lock. Either we get it or we wait for it.
	t.updating.Lock()
	defer t.updating.Unlock()

	if time.Since(time.UnixMilli(t.lastUpdateMs.Load())) < ttl {
		// There is a new value, release lock and return it.
		if v = t.val.Load(); v != nil {
			return *v, nil
		}
	}