where.Build(&onStmt)

										if onSQL := onStmt.SQL.String(); onSQL != "" {
											vars := onStmt.Vars
											for idx, v := range vars {
												bindvar := strings.Builder{}
												onStmt.Vars = vars[0 : idx+1]
												db.Dialector.BindVarTo(&bindvar, &onStmt, v)
												onSQL = strings.Replace(onSQL, bindvar.String(), "?", 1)
											}

pkg net/netip, func AddrFromSlice([]uint8) (Addr, bool)
pkg net/netip, func AddrPortFrom(Addr, uint16) AddrPort
pkg net/netip, func IPv4Unspecified() Addr
pkg net/netip, func IPv6LinkLocalAllNodes() Addr
pkg net/netip, func IPv6Unspecified() Addr
pkg net/netip, func MustParseAddr(string) Addr
pkg net/netip, func MustParseAddrPort(string) AddrPort
pkg net/netip, func MustParsePrefix(string) Prefix
pkg net/netip, func ParseAddr(string) (Addr, error)

	fakeIPSetDeps.On("addIP",
		"foo-v4",
		netip.MustParseAddr("99.9.9.9"),
		ipProto,
		podUID,
		false,
	).Return(nil)

	fakeIPSetDeps.On("addIP",
		"foo-v4",
		netip.MustParseAddr("2.2.2.2"),
		ipProto,
		podUID,
		false,
	).Return(nil)

	podIPs := []netip.Addr{netip.MustParseAddr("99.9.9.9"), netip.MustParseAddr("2.2.2.2")}
	_, err := m.addPodToHostNSIpset(pod, podIPs)

			want:     true,
		},
		{
			filter:   noTags,
			userTags: "A=3",
			want:     true,
		},
		{
			filter:   oneTag,
			userTags: "A=3",
			want:     false,
		},
		{
			filter:   oneTag,
			userTags: "FOO=1",
			want:     true,
		},
		{
			filter:   oneTag,
			userTags: "A=B&FOO=1",
			want:     true,
		},
		{
			filter:   twoTags,
			userTags: "",
			want:     false,

	return args.Error(0)
}

func (m *MockedIpsetDeps) clearEntriesWithIP(name string, ip netip.Addr) error {
	args := m.Called(name, ip)
	return args.Error(0)
}

func (m *MockedIpsetDeps) listEntriesByIP(name string) ([]netip.Addr, error) {
	args := m.Called(name)
	return args.Get(0).([]netip.Addr), args.Error(1)

	flush(name string) error
	clearEntriesWithComment(name string, comment string) error
	clearEntriesWithIP(name string, ip netip.Addr) error
	listEntriesByIP(name string) ([]netip.Addr, error)
}

// TODO this should actually create v6 and v6 subsets of type `hash:ip`, add them both to a
// superset of type `list:set` - we can then query the superset directly in iptables (with the same rule),

				cfg.RedirectDNS = true
			},
		},
		{
			name: "ingress",
			config: func(cfg *Config) {
			},
			ingressMode: true,
		},
	}
	probeSNATipv4 := netip.MustParseAddr("169.254.7.127")
	probeSNATipv6 := netip.MustParseAddr("e9ac:1e77:90ca:399f:4d6d:ece2:2f9b:3164")

	for _, tt := range cases {
		for _, ipv6 := range []bool{false, true} {
			t.Run(tt.name+"_"+ipstr(ipv6), func(t *testing.T) {

pkg net, method (IP) AppendText([]uint8) ([]uint8, error) #62384
pkg net/netip, method (Addr) AppendBinary([]uint8) ([]uint8, error) #62384
pkg net/netip, method (Addr) AppendText([]uint8) ([]uint8, error) #62384
pkg net/netip, method (AddrPort) AppendBinary([]uint8) ([]uint8, error) #62384
pkg net/netip, method (AddrPort) AppendText([]uint8) ([]uint8, error) #62384
pkg net/netip, method (Prefix) AppendBinary([]uint8) ([]uint8, error) #62384

	return errors.New("not implemented on this platform")
}

func (m *realDeps) clearEntriesWithIP(name string, ip netip.Addr) error {
	return errors.New("not implemented on this platform")
}

func (m *realDeps) listEntriesByIP(name string) ([]netip.Addr, error) {
	return []netip.Addr{}, errors.New("not implemented on this platform")

	return errors.Join(delErrs...)
}

func (m *realDeps) listEntriesByIP(name string) ([]netip.Addr, error) {
	var ipList []netip.Addr

	res, err := netlink.IpsetList(name)
	if err != nil {
		return ipList, fmt.Errorf("failed to list ipset %s: %w", name, err)
	}

	for _, entry := range res.Entries {
		addr, _ := netip.AddrFromSlice(entry.IP)
		ipList = append(ipList, addr)
	}

	return ipList, nil