apiVersion: v1
kind: Service
metadata:
  name: tcp-echo
  labels:
    app: tcp-echo
    service: tcp-echo
spec:
  ipFamilyPolicy: SingleStack
  ipFamilies:
  - IPv4
  ports:
  - name: tcp
    port: 9000
  - name: tcp-other
    port: 9001
  # Port 9002 is omitted intentionally for testing the pass through filter chain.
  selector:
    app: tcp-echo
---

Ben Leggett <******@****.***> 1710179183 -0400

			},
			want: []string{
				"kernel.shm_rmid_forced",
				"net.ipv4.ip_local_port_range",
				"net.ipv4.tcp_syncookies",
				"net.ipv4.ping_group_range",
				"net.ipv4.ip_unprivileged_port_start",
				"net.ipv4.ip_local_reserved_ports",
				"net.ipv4.tcp_keepalive_time",
				"net.ipv4.tcp_fin_timeout",
				"net.ipv4.tcp_keepalive_intvl",
				"net.ipv4.tcp_keepalive_probes",
			},
		},
	}
	for _, tt := range tests {

		{
			name: "empty ip address",
			ips:  []string{},
			ipv4: []string{},
			ipv6: []string{},
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			ipv4, ipv6 := IPsSplitV4V6(tt.ips)
			if ipv4 == nil {
				ipv4 = []string{}
			}
			if ipv6 == nil {
				ipv6 = []string{}
			}
			if !reflect.DeepEqual(ipv4, tt.ipv4) || !reflect.DeepEqual(ipv6, tt.ipv6) {

			expr:         `isIP("192.168.0.1")`,
			expectResult: trueVal,
		},
		{
			name:         "isIP invalid ipv4",
			expr:         `isIP("192.168.0.1.0")`,
			expectResult: falseVal,
		},
		{
			name:         "ip.isCanonical valid ipv4",
			expr:         `ip.isCanonical("127.0.0.1")`,
			expectResult: trueVal,
		},
		{
			name:             "ip.isCanonical invalid ipv4",

			continue
		}
		if ip.Is4() {
			ipv4 = append(ipv4, ip.String())
		} else if ip.Is6() {
			ipv6 = append(ipv6, ip.String())
		} else {
			log.Debugf("ignoring un-parsable IP address: %v", ip)
		}
	}
	return
}

// ParseIPsSplitToV4V6 returns two slice of ipv4 and ipv6 netip.Addr.
func ParseIPsSplitToV4V6(ips []string) (ipv4 []netip.Addr, ipv6 []netip.Addr) {
	for _, i := range ips {

	"syscall"
	_ "unsafe" // for linkname
)

// probe probes IPv4, IPv6 and IPv4-mapped IPv6 communication
// capabilities which are controlled by the IPV6_V6ONLY socket option
// and kernel configuration.
//
// Should we try to use the IPv4 socket interface if we're only
// dealing with IPv4 sockets? As long as the host system understands
// IPv4-mapped IPv6, it's okay to pass IPv4-mapped IPv6 addresses to

	{
		name: "kernel.shm_rmid_forced",
	}, {
		name: "net.ipv4.ip_local_port_range",
	}, {
		name: "net.ipv4.tcp_syncookies",
	}, {
		name: "net.ipv4.ping_group_range",
	}, {
		name: "net.ipv4.ip_unprivileged_port_start",
	}, {
		name:   "net.ipv4.ip_local_reserved_ports",
		kernel: utilkernel.IPLocalReservedPortsNamespacedKernelVersion,
	}, {
		name:   "net.ipv4.tcp_keepalive_time",

		},
		{
			name:         "contains IP ipv4 (IP)",
			expr:         `cidr("192.168.0.0/24").containsIP(ip("192.168.0.1"))`,
			expectResult: trueVal,
		},
		{
			name:         "does not contain IP ipv4 (IP)",
			expr:         `cidr("192.168.0.0/24").containsIP(ip("192.168.1.1"))`,
			expectResult: falseVal,
		},
		{
			name:         "contains IP ipv4 (string)",

// IPLocalReservedPortsNamespacedKernelVersion is the kernel version in which net.ipv4.ip_local_reserved_ports was namespaced(netns).
// (ref: https://github.com/torvalds/linux/commit/122ff243f5f104194750ecbc76d5946dd1eec934)
const IPLocalReservedPortsNamespacedKernelVersion = "3.16"

// IPVSConnReuseModeMinSupportedKernelVersion is the minium kernel version supporting net.ipv4.vs.conn_reuse_mode.