XTablesParameterProblem: "xtables parameter problem",
	XTablesVersionProblem:   "xtables version problem",
	XTablesResourceProblem:  "xtables resource problem",
}

// RealDependencies implementation of interface Dependencies, which is used in production
type RealDependencies struct {
	NetworkNamespace string
	CNIMode          bool
}

const iptablesVersionPattern = `v([0-9]+(\.[0-9]+)+)`

		wantSum                []byte
		wantStr                string
		wantUint64             uint64
		wantLittleEndianUint64 uint64
	}{
		{
			name: "foo",
			str:  "foo",
			// note: Different hash implementation may get different hash value
			wantStr:    "33bf00a859c4ba3f",
			wantUint64: 3728699739546630719,
		},
	}

	for _, tt := range testCases {
		t.Run(tt.name, func(t *testing.T) {
			h := New()

apiVersion: release-notes/v2
kind: feature
area: security
issue:
  - 33472
releaseNotes:
  - |

      Wherever we would match `Host: <concrete service>` we additionally will match `Host: <external name service>`.
      Note that the primary implementation of `ExternalName` -- DNS -- is handled outside of Istio in the Kubernetes DNS implementation, and remains unchanged.
      
      If you are using `ExternalName` with Istio, please be advised of the following behavioral changes:

apiVersion: release-notes/v2
kind: feature
area: telemetry
releaseNotes:
  - |
    **Removed** legacy `EnvoyFilter` implementation for telemetry. For the majority of users, this change has no impact, and
    was already enabled in previous releases. However, the following fields are no longer respected: `prometheus.configOverride`,

      In this release, the ["Delta"](https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol#incremental-xds) xDS protocol is enabled by default.

      This should be an internal implementation detail, but because this controls the core configuration protocol in Istio,
      an upgrade notice is present in an abundance of caution.

// See the License for the specific language governing permissions and
// limitations under the License.

package config

import (
	"fmt"
	"net/netip"
)

const (
	// Due to implementation constraints, we have to impose a limit on the
	// number of owner groups whose outgoing traffic should be redirected
	// to Envoy.
	//
	// Since all included groups will be translated into a single Iptables

	if features.EnableVtprotobuf {
		if vt, ok := msg.(vtStrictMarshal); ok {
			// Attempt to use more efficient implementation
			// "Strict" is the equivalent to Deterministic=true below
			return vt.MarshalVTStrict()
		}
	}
	// If not available, fallback to normal implementation
	return proto.MarshalOptions{Deterministic: true}.Marshal(msg)
}

// MessageToAny converts from proto message to proto Any

      Wherever we would match `Host: <concrete service>` we additionally will match `Host: <external name service>`.
      Note that the primary implementation of `ExternalName` -- DNS -- is handled outside of Istio in the Kubernetes DNS implementation, and remains unchanged.

      If you are using `ExternalName` with Istio, please be advised of the following behavioral changes:

// See the License for the specific language governing permissions and
// limitations under the License.

package resource

import "istio.io/istio/pkg/cluster"

// Origin of a resource. This is source-implementation dependent.
type Origin interface {
	FriendlyName() string
	Namespace() Namespace
	Reference() Reference

	// FieldMap returns the flat map containing paths of the fields in the resource as keys,