kube-apiserver: OIDC authentication now supports requiring specific claims with `--oidc-required-claim=<claim>=<value>` Previously, there was no mechanism for a user to specify claims in the OIDC authentication process that were requid to be present in the ID Token with an expected value. This version now makes it possible to require claims support for the OIDC authentication. It allows users to pass in a `--oidc-required-claims` flag, and `key=value` pairs in the API config, which will ensure that the...

  /**
   * Consume the next header in the stream and return it. If there is no header to read because we
   * have reached a limit, this returns [END_OF_DATA].
   */
  internal fun readHeader(): DerHeader {
    require(peekedHeader == null)

    // We've hit a local limit.
    if (byteCount == limit) return END_OF_DATA

    // We've exhausted the source stream.
    if (limit == -1L && source.exhausted()) return END_OF_DATA

  sink(file).use {
    try {
      delete(file)
      return true
    } catch (_: IOException) {
    }
  }
  delete(file)
  return false
}

/** Delete file we expect but don't require to exist. */
internal fun FileSystem.deleteIfExists(path: Path) {
  try {
    delete(path)
  } catch (fnfe: FileNotFoundException) {
    return
  }
}

 *
 * This test class verifies the basic functionality of DirFileEntryAdapterIterator.
 * Due to the iterator's constructor calling advance() immediately, which requires
 * the adapt() method to be functional, we test the behavior using simple mock
 * scenarios that don't require complex filter setups.
 */
@ExtendWith(MockitoExtension.class)
class DirFileEntryAdapterIteratorTest {

    @Mock
    private SmbResource mockParent;

   * Returns -1 if no further cleanups are required.
   */
  fun closeConnections(now: Long): Long {
    // Find the longest-idle connections in 2 categories:
    //
    //  1. OLD: Connections that have been idle for at least keepAliveDurationNs. We close these if
    //     we find them, regardless of what the address policies need.
    //
    //  2. EVICTABLE: Connections not required by any address policy. This matches connections that

        // Enforced -> required+enabled
        SmbTransportImpl enforced = new SmbTransportImpl(ctx, address, 445, null, 0, true);
        assertEquals(Smb2Constants.SMB2_NEGOTIATE_SIGNING_REQUIRED | Smb2Constants.SMB2_NEGOTIATE_SIGNING_ENABLED,
                enforced.getRequestSecurityMode(first));

        // Server indicates required -> required+enabled

import com.google.common.escape.Escaper;

/**
 * {@code Escaper} instances suitable for strings to be included in particular sections of URLs.
 *
 * <p>If the resulting URLs are inserted into an HTML or XML document, they will require additional
 * escaping with {@link com.google.common.html.HtmlEscapers} or {@link
 * com.google.common.xml.XmlEscapers}.
 *
 * @author David Beaumont
 * @author Chris Povirk
 * @since 15.0
 */
@GwtCompatible

/**
 * RegexRule is a rule implementation that uses regular expressions to match against the ResponseData.
 * It allows defining multiple regular expressions for different fields of the ResponseData.
 * The rule can be configured to require all regular expressions to match (allRequired = true) or
 * only one of them (allRequired = false). It also supports a default rule that always matches.
 *
 * <p>

- **Key Derivation**: SMB3 KDF implementation with dialect-specific parameters
- **Pre-Authentication Integrity**: SMB 3.1.1 PAI for preventing downgrade attacks
- **Automatic Detection**: Encryption automatically enabled when servers require it
- **Secure Key Management**: Proper key derivation and nonce generation

### Core Features
- **Per-context configuration**: No global state, each context encapsulates configuration

      if (bytesRemaining == 0L) {
        responseBodyComplete(trailers = Headers.EMPTY)
      }
    }

    override fun read(
      sink: Buffer,
      byteCount: Long,
    ): Long {
      require(byteCount >= 0L) { "byteCount < 0: $byteCount" }
      check(!closed) { "closed" }
      if (bytesRemaining == 0L) return -1

      val read = super.read(sink, minOf(bytesRemaining, byteCount))
      if (read == -1L) {