ip6tables -t nat -F ISTIO_INBOUND
ip6tables -t nat -X ISTIO_INBOUND
ip6tables -t mangle -F ISTIO_INBOUND
ip6tables -t mangle -X ISTIO_INBOUND
ip6tables -t mangle -F ISTIO_DIVERT
ip6tables -t mangle -X ISTIO_DIVERT
ip6tables -t mangle -F ISTIO_TPROXY
ip6tables -t mangle -X ISTIO_TPROXY
ip6tables -t mangle -D PREROUTING -p tcp -m mark --mark 1337 -j CONNMARK --save-mark
ip6tables -t mangle -D OUTPUT -p tcp -m connmark --mark 1337 -j CONNMARK --restore-mark

iptables -t mangle -D PREROUTING -p tcp -j ISTIO_INBOUND
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t nat -F ISTIO_OUTPUT
iptables -t nat -X ISTIO_OUTPUT
iptables -t nat -F ISTIO_INBOUND
iptables -t nat -X ISTIO_INBOUND
iptables -t mangle -F ISTIO_INBOUND
iptables -t mangle -X ISTIO_INBOUND
iptables -t mangle -F ISTIO_DIVERT
iptables -t mangle -X ISTIO_DIVERT
iptables -t mangle -F ISTIO_TPROXY

iptables -t mangle -A PREROUTING -p tcp -m mark --mark 1337 -j CONNMARK --save-mark
iptables -t mangle -A OUTPUT -p tcp -o lo -m mark --mark 1337 -j RETURN
iptables -t mangle -A OUTPUT ! -d 127.0.0.1/32 -p tcp -o lo -m owner --uid-owner 1337 -j MARK --set-mark 1338
iptables -t mangle -A OUTPUT ! -d 127.0.0.1/32 -p tcp -o lo -m owner --gid-owner 1337 -j MARK --set-mark 1338

iptables -t mangle -I ISTIO_INBOUND 1 -p tcp -m mark --mark 1337 -j RETURN
iptables -t mangle -I ISTIO_INBOUND 2 -p tcp -s 127.0.0.6/32 -i lo -j RETURN
iptables -t mangle -I ISTIO_INBOUND 3 -p tcp -i lo -m mark ! --mark 1338 -j RETURN
ip6tables -t nat -N ISTIO_INBOUND
ip6tables -t nat -N ISTIO_REDIRECT
ip6tables -t nat -N ISTIO_IN_REDIRECT
ip6tables -t mangle -N ISTIO_DIVERT
ip6tables -t mangle -N ISTIO_TPROXY
ip6tables -t mangle -N ISTIO_INBOUND

iptables -t mangle -N ISTIO_PRERT
iptables -t nat -N ISTIO_OUTPUT
iptables -t mangle -N ISTIO_OUTPUT
iptables -t mangle -A PREROUTING -j ISTIO_PRERT
iptables -t mangle -A OUTPUT -j ISTIO_OUTPUT
iptables -t nat -A OUTPUT -j ISTIO_OUTPUT
iptables -t mangle -A ISTIO_PRERT -m mark --mark 0x539/0xfff -j CONNMARK --set-xmark 0x111/0xfff
iptables -t mangle -A ISTIO_PRERT -s 169.254.7.127 -p tcp -m tcp -j ACCEPT

iptables -t mangle -D PREROUTING -p tcp -j ISTIO_INBOUND
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t nat -F ISTIO_OUTPUT
iptables -t nat -X ISTIO_OUTPUT
iptables -t nat -F ISTIO_INBOUND
iptables -t nat -X ISTIO_INBOUND
iptables -t mangle -F ISTIO_INBOUND
iptables -t mangle -X ISTIO_INBOUND
iptables -t mangle -F ISTIO_DIVERT
iptables -t mangle -X ISTIO_DIVERT
iptables -t mangle -F ISTIO_TPROXY

	flushAndDeleteChains(ext, iptV, constants.NAT, chains)
	// Flush and delete the istio chains from MANGLE table.
	chains = []string{constants.ISTIOINBOUND, constants.ISTIODIVERT, constants.ISTIOTPROXY}
	flushAndDeleteChains(ext, iptV, constants.MANGLE, chains)

	if cfg.InboundInterceptionMode == constants.TPROXY {
		DeleteRule(ext, iptV, constants.MANGLE, constants.PREROUTING,

     * @param bufferIndex
     * @param maxLen
     * @return position of terminating null bytes
     */
    public static int findUNITermination ( byte[] buffer, int bufferIndex, int maxLen ) {
        int len = 0;
        while ( buffer[ bufferIndex + len ] != (byte) 0x00 || buffer[ bufferIndex + len + 1 ] != (byte) 0x00 ) {
            len += 2;
            if ( len > maxLen ) {
                if ( log.isDebugEnabled() ) {

	testenv.MustHaveExec(t)

	const input = "pä世🜃"
	tests := []struct {
		env     string
		fail    bool
		mangled string
	}{
		{
			env:     "v1",
			mangled: "p___",
		},
		{
			env:     "v2",
			mangled: "p..u00e4..u4e16..U0001f703",
		},
		{
			env:     "v3",
			mangled: "p_u00e4_u4e16_U0001f703",
		},
		{
			env:  "error",
			fail: true,
		},
	}

	cmd := os.Args[0]

// Huffman-encoded strings.
var ErrInvalidHuffman = errors.New("hpack: invalid Huffman-encoded data")

// huffmanDecode decodes v to buf.
// If maxLen is greater than 0, attempts to write more to buf than
// maxLen bytes will return ErrStringLength.
func huffmanDecode(buf *bytes.Buffer, maxLen int, v []byte) error {
	rootHuffmanNode := getRootHuffmanNode()
	n := rootHuffmanNode
	// cur is the bit buffer that has not been fed into n.