t.Fatalf("got ports of %dst service, got:\n%#v\nwanted:\n%#v\n", i+1, svcList[i].Ports, exp.Ports)
		}
		if svcList[i].MeshExternal != exp.MeshExternal {
			t.Fatalf("i=%v, MeshExternal==%v, should be %v: externalName='%s'", i+1, exp.MeshExternal, svcList[i].MeshExternal, k8sSvcs[i].Spec.ExternalName)
		}
		if svcList[i].Resolution != exp.Resolution {

// "snitest.com", which happens to match the CN of testSNICertificate. The test
// verifies that the server correctly selects that certificate.
func TestHandshakeServerSNI(t *testing.T) {
	test := &serverTest{
		name:    "SNI",
		command: []string{"openssl", "s_client", "-no_ticket", "-cipher", "AES128-SHA", "-servername", "snitest.com"},
	}
	runServerTestTLS12(t, test)
}

	}
}

func TestPrefixMasking(t *testing.T) {
	type subtest struct {
		ip   Addr
		bits uint8
		p    Prefix
		ok   bool
	}

	// makeIPv6 produces a set of IPv6 subtests with an optional zone identifier.
	makeIPv6 := func(zone string) []subtest {
		if zone != "" {
			zone = "%" + zone
		}

		return []subtest{
			{
				ip:   mustIP(fmt.Sprintf("2001:db8::1%s", zone)),

			// called tb.Helper from inside that test function).
			// If this is a top-level test, only skip up to the test function itself.
			// If we're in a subtest, continue searching in the parent test,
			// starting from the point of the call to Run which created this subtest.
			if c.level > 1 {
				frames = runtime.CallersFrames(c.creator)
				parent := c.parent
				// We're no longer looking at the current c after this point,

	svcHost := extendFQDN(fmt.Sprintf("%s.%s", svc.ObjectMeta.Name, svc.ObjectMeta.Namespace))
	facts := []string{}
	mismatchNotes := []string{}
	match := false
	for _, dest := range route.Route {
		fqdn := string(model.ResolveShortnameToFQDN(dest.Destination.Host, config.Meta{Namespace: vs.Namespace}))
		if extendFQDN(fqdn) == svcHost {
			if dest.Destination.Subset != "" {

	// service
	svcList := make([]*Service, 0, vsNum)
	for i := 0; i < vsNum; i++ {
		svcList = append(svcList, &Service{
			Attributes: ServiceAttributes{Namespace: "default"},
			Hostname:   host.Name("host-" + strconv.Itoa(i) + ".com"),
		})
	}
	ps.ServiceIndex.public = svcList

	hosts := make([]string, 0)
	if matchAll {
		// default/*

				addressesToReport = internalIP
			} else {
				for _, hostport := range internal {
					svchost, _, _ := net.SplitHostPort(hostport)
					if !slices.Contains(pending, svchost) && !slices.Contains(addressesToReport, svchost) {
						addressesToReport = append(addressesToReport, svchost)
					}
				}
			}
		}

			services := scScope.Services()
			numSvc := 0
			svcList := []string{}
			for _, service := range services {
				svcName := service.Attributes.Name
				svcNS := service.Attributes.Namespace
				if svcNS != ns && svcNS != rootNS {
					numSvc++
				}
				svcList = append(svcList, fmt.Sprintf("%v.%v.cluster.local", svcName, svcNS))
			}
			if sidecarScopeEnabled && numSvc > 0 {

			vcs.VCSTestHosts = vcstest.Hosts
			vcsTestTLSHost := os.Getenv("TESTGO_VCSTEST_TLS_HOST")
			vcsTestClient, err := vcstest.TLSClient(os.Getenv("TESTGO_VCSTEST_CERT"))
			if err != nil {
				fmt.Fprintf(os.Stderr, "loading certificates from $TESTGO_VCSTEST_CERT: %v", err)
			}
			var interceptors []web.Interceptor
			for _, host := range vcstest.Hosts {
				interceptors = append(interceptors,

	}
	log.Debugf("GatewayServices: gateway %v is exposing these hosts:%v", proxy.ID, hostsFromGateways)

	gwSvcs := make([]*Service, 0, len(svcs))

	for _, s := range svcs {
		svcHost := string(s.Hostname)

		if _, ok := hostsFromGateways[svcHost]; ok {
			gwSvcs = append(gwSvcs, s)
		}
	}

	log.Debugf("GatewayServices: gateways len(services)=%d, len(filtered)=%d", len(svcs), len(gwSvcs))

	return gwSvcs
}