for _, s := range strs {
		if s == "" {
			continue
		}
		filtered = append(filtered, s)
	}
	return filtered
}

type InterceptFilter struct {
	Values []string
	Except bool
}

func ParseInterceptFilter(include, exclude string) InterceptFilter {
	if include == "*" {
		excludes := Split(exclude)
		return InterceptAllExcept(excludes...)
	}
	includes := Split(include)
	return InterceptOnly(includes...)
}

	//
	// Most common Linux distributions allow no more than 128-1200
	// match expressions per rule.
	maxOwnerGroupsInclude = 64
)

func ValidateOwnerGroups(include, exclude string) error {
	filter := ParseInterceptFilter(include, exclude)
	if !filter.Except && len(filter.Values) > maxOwnerGroupsInclude {
		return fmt.Errorf("number of owner groups whose outgoing traffic "+
			"should be redirected to Envoy cannot exceed %d, got %d: %v",

	// Remove the old DNS UDP rules
	if cfg.RedirectDNS {
		ownerGroupsFilter := types.ParseInterceptFilter(cfg.OwnerGroupsInclude, cfg.OwnerGroupsExclude)

		common.HandleDNSUDP(common.DeleteOps, builder.NewIptablesRuleBuilder(nil), ext, iptV, ipt6V, cfg.ProxyUID, cfg.ProxyGID,

		cfg.ruleBuilder.AppendRule(iptableslog.UndefinedCommand, constants.ISTIOOUTPUT, constants.NAT, "-m", "owner", "--gid-owner", gid, "-j", constants.RETURN)
	}

	ownerGroupsFilter := config.ParseInterceptFilter(cfg.cfg.OwnerGroupsInclude, cfg.cfg.OwnerGroupsExclude)

	cfg.handleCaptureByOwnerGroup(ownerGroupsFilter)

	if redirectDNS {
		if cfg.cfg.CaptureAllDNS {