import (
	"istio.io/istio/pilot/pkg/features"
	"istio.io/istio/pilot/pkg/model"
	dnsProto "istio.io/istio/pkg/dns/proto"
	dnsServer "istio.io/istio/pkg/dns/server"
)

// BuildNameTable produces a table of hostnames and their associated IPs that can then
// be used by the agent to resolve DNS. This logic is always active. However, local DNS resolution
// will only be effective if DNS capture is enabled in the proxy

area: traffic-management
issue:
- 28659
releaseNotes:
- |
  **Optimized** generated routing configuration to merge virtual hosts with the same routing configuration. This improves performance for Virtual Services with multiple hostnames defined.

upgradeNotes:
- title: EnvoyFilter `match.routeConfiguration.vhost.name` semantics change
  content: |

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
spec:
  addresses:
  - value: istio-ingressgateway
    type: Hostname
  gatewayClassName: istio
  listeners:
  - name: default
    hostname: "*.example.com"
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute

package main

import (
	"flag"
	"fmt"
	"os"

	"istio.io/istio/pkg/log"
	"istio.io/istio/security/pkg/pki/util"
)

var (
	host    = flag.String("host", "", "Comma-separated hostnames and IPs to generate a certificate for.")
	org     = flag.String("organization", "Juju org", "Organization for the cert.")
	outCsr  = flag.String("out-csr", "csr.pem", "Output csr file.")

kind: HTTPRoute
metadata:
  creationTimestamp: null
  name: http
  namespace: default
spec: null
status:
  parents:
  - conditions:
    - lastTransitionTime: fake
      message: hostnames matched parent hostname "*.domain.example", but namespace
        "default" is not allowed by the parent
      reason: NotAllowedByListeners
      status: "False"
      type: Accepted
    - lastTransitionTime: fake

{!../../../docs_src/advanced_middleware/tutorial002.py!}
```

The following arguments are supported:

* `allowed_hosts` - A list of domain names that should be allowed as hostnames. Wildcard domains such as `*.example.com` are supported for matching subdomains. To allow any hostname either use `allowed_hosts=["*"]` or omit the middleware.

If an incoming request does not validate correctly then a `400` response will be sent.

## `GZipMiddleware`

    assertThat(response.isSuccessful).isTrue()

    val recordedRequest = server.takeRequest()
    assertThat(recordedRequest.handshakeServerNames).containsExactly(url.host)
  }

  /**
   * Use different hostnames for the TLS handshake (including SNI) and the HTTP request (in the
   * Host header).
   */
  @Test
  fun domainFronting() {
    val heldCertificate =
      HeldCertificate.Builder()

    assertThat(
      "0:0:0:0:0:FFFF:129.144.52.38".toCanonicalHost(),
    ).isEqualTo("129.144.52.38")

    assertThat("::FFFF:129.144.52.38".toCanonicalHost()).isEqualTo("129.144.52.38")

    // Hostnames
    assertThat("WwW.GoOgLe.cOm".toCanonicalHost()).isEqualTo("www.google.com")
    assertThat("localhost".toCanonicalHost()).isEqualTo("localhost")
    assertThat("☃.net".toCanonicalHost()).isEqualTo("xn--n3h.net")

	BuildHTTPRoutes(node *model.Proxy, req *model.PushRequest, routeNames []string) ([]*discovery.Resource, model.XdsLogDetails)

	// BuildNameTable returns list of hostnames and the associated IPs
	BuildNameTable(node *model.Proxy, push *model.PushContext) *dnsProto.NameTable

metadata:
  creationTimestamp: null
  name: http-not-selected
  namespace: default
spec: null
status:
  parents:
  - conditions:
    - lastTransitionTime: fake
      message: no hostnames matched parent hostname "*.domain.example"
      reason: NoMatchingListenerHostname
      status: "False"
      type: Accepted
    - lastTransitionTime: fake
      message: All references resolved
      reason: ResolvedRefs