}

			for _, family := range []v1.IPFamily{v1.IPv4Protocol, v1.IPv6Protocol} {
				npa := NewNodePortAddresses(family, tc.cidrs)

				if npa.MatchAll() != tc.expected[family].matchAll {
					t.Errorf("unexpected MatchAll(%s), expected: %v", family, tc.expected[family].matchAll)
				}

				ips, err := npa.GetNodeIPs(nw)
				expectedIPs := tc.expected[family].ips

				// The fake InterfaceAddrs() never returns an error, so

			npa.cidrs = []*net.IPNet{cidr}
			npa.matchAll = true
			break
		}

		npa.cidrs = append(npa.cidrs, cidr)
	}

	return npa
}

func (npa *NodePortAddresses) String() string {
	return fmt.Sprintf("%v", npa.cidrStrings)
}

// MatchAll returns true if npa matches all node IPs (of npa's given family)
func (npa *NodePortAddresses) MatchAll() bool {
	return npa.matchAll
}

type Archive struct {
	a        *archive.Archive
	files    []string // Explicit list of files to be processed.
	pad      int      // Padding bytes required at end of current archive file
	matchAll bool     // match all files in archive
}

// archive opens (and if necessary creates) the named archive.
func openArchive(name string, mode int, files []string) *Archive {
	f, err := os.OpenFile(name, mode, 0666)

	tx.Add(&knftables.Set{
		Name:    nodePortIPsSet,
		Type:    ipvX_addr,
		Comment: ptr.To("IPs that accept NodePort traffic"),
	})
	if proxier.nodePortAddresses.MatchAll() {
		tx.Delete(&knftables.Set{
			Name: nodePortIPsSet,
		})
	} else {
		tx.Flush(&knftables.Set{
			Name: nodePortIPsSet,
		})

	b.Run("big-match-all", func(b *testing.B) {
		benchmarkConvertIstioListenerToWrapper(b, 300, 15, "", true)
	})
}

func benchmarkConvertIstioListenerToWrapper(b *testing.B, vsNum int, hostNum int, wildcard string, matchAll bool) {
	// virtual service
	cfgs := make([]config.Config, 0)
	for i := 0; i < vsNum; i++ {
		cfgs = append(cfgs, config.Config{
			Meta: config.Meta{
				GroupVersionKind: gvk.VirtualService,

		}
	}

	// Finally, tail-call to the nodePorts chain.  This needs to be after all
	// other service portal rules.
	if proxier.nodePortAddresses.MatchAll() {
		destinations := []string{"-m", "addrtype", "--dst-type", "LOCAL"}
		// Block localhost nodePorts if they are not supported. (For IPv6 they never

		}
	}

	// List of node IP addresses to be used as IPVS services if nodePort is set. This
	// can be reused for all nodePort services.
	var nodeIPs []net.IP
	if hasNodePort {
		if proxier.nodePortAddresses.MatchAll() {
			for _, ipStr := range nodeAddressSet.UnsortedList() {
				nodeIPs = append(nodeIPs, netutils.ParseIPSloppy(ipStr))
			}
		} else {

,r=Z.extname(i)){let n=jC(Z.resolve(e,i),LC.includes(r)?NC:$C);if(n===null||t.has(n))return;t.add(n),yield n,e=Z.dirname(n),r=Z.extname(n);let a=te.readFileSync(n,"utf-8");for(let s of[...a.matchAll(/import[\s\S]*?['"](.{3,}?)['"]/gi),...a.matchAll(/import[\s\S]*from[\s\S]*?['"](.{3,}?)['"]/gi),...a.matchAll(/require\(['"`](.+)['"`]\)/gi)])!s[1].startsWith(".")||(yield*uh(s[1],e,t,r))}function wo(i){return i===null?new Set:new Set(uh(i,Z.dirname(i),new Set))}var LC,NC,$C,fh=C(()=>{l();je();gt();...

		return true
	}

	catchall := false

	switch m := in.MatchType.(type) {
	case *networking.StringMatch_Regex:
		// `*` is NOT a RE2 style regex, it's a metacharacter.
		// It will be translated as present_match, rather than matching "any string".
		// see https://github.com/istio/istio/pull/20629
		catchall = m.Regex == "*"
	}

	return catchall
}

						},
					},
				},
			},
			want: false,
		},
	}

	for _, tt := range cases {
		t.Run(tt.name, func(t *testing.T) {
			catchall := IsCatchAllRoute(tt.route)
			if catchall != tt.want {
				t.Errorf("Unexpected catchAllMatch want %v, got %v", tt.want, catchall)
			}
		})
	}
}

func TestTranslateCORSPolicyForwardNotMatchingPreflights(t *testing.T) {
	node := &model.Proxy{