length: 16
      sourceIps:
      - address: AQIDBA==
        length: 32
      - address: BQYAAA==
        length: 16
- rules:
  - matches:
    - destinationPorts:
      - 80
      - 90
      notDestinationPorts:
      - 800
      - 900
- rules:
  - matches:
    - notSourceIps:
      - address: WgoKCg==
        length: 32
      - address: WqgKAA==
        length: 24

We used DefaultVMImage in the example.

For example,

```go
ports := []echo.Port{
   {
       Name:     "http",
       Protocol: protocol.HTTP,
       InstancePort: 8090,
       ServicePort:  8090,
   },
}
echo.Config{
   Service:    "vm",
   Namespace:  "virtual-machine",
   Ports:      ports,
   Pilot:      p,
   DeployAsVM: true,
   VMImage:    vm.DefaultVMImage
}
```

		}).
		With(&server, echo.Config{
			Service:   "server",
			Namespace: testNs,
			Ports: []echo.Port{
				{
					Name:         "http",
					Protocol:     protocol.HTTP,
					WorkloadPort: 8090,
				},
			},
		}).
		BuildOrFail(t)

	return testNs, client, server
}

func RunTrafficTestClientServer(t framework.TestContext, client, server echo.Instance) {
	_ = client.CallOrFail(t, echo.CallOptions{

  - to:
    - operation:
        hosts: ["exact.com", "*.suffix.com", "prefix.*", "*"]
        notHosts: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
  - to:
    - operation:
        ports: ["80", "90"]
        notPorts: ["800", "900"]
  - to:
    - operation:
        paths: ["/exact", "/prefix/*", "*/suffix", "*"]
        notPaths: ["/not-exact", "/not-prefix/*", "*/not-suffix", "*"]
  - when:

      to:
        - operation:
            methods: ["method", "method-prefix-*", "*-suffix-method", "*"]
            hosts: ["exact.com", "*.suffix.com", "prefix.*", "*"]
            ports: ["80", "90"]
            paths: ["/exact", "/prefix/*", "*/suffix", "*", "/path/template/{*}", "/{**}/path/template"]
            notMethods: ["not-method", "not-method-prefix-*", "*-not-suffix-method", "*"]

				Protocol:     protocol.HTTP,
				ServicePort:  8090,
				WorkloadPort: 8090,
			},
			{
				Name:         httpMTLS,
				Protocol:     protocol.HTTP,
				ServicePort:  8091,
				WorkloadPort: 8091,
			},
			{
				Name:         tcpPlaintext,
				Protocol:     protocol.TCP,
				ServicePort:  8092,
				WorkloadPort: 8092,
			},
			{
				Name:         tcpMTLS,

				}).
				WithConfig(echo.Config{
					Service:   "server",
					Namespace: canary,
					Ports: []echo.Port{
						{
							Name:         "http",
							Protocol:     protocol.HTTP,
							WorkloadPort: 8090,
						},
					},
				}).
				WithConfig(echo.Config{
					Service:    "vm",
					Namespace:  canary,
					DeployAsVM: true,
					Ports:      []echo.Port{},
				}).
				BuildOrFail(t)

			{
				Name:         "grpc",
				Protocol:     protocol.GRPC,
				WorkloadPort: 8090,
				TLS:          true,
			},
			{
				Name:         "http",
				Protocol:     protocol.HTTP,
				WorkloadPort: 8091,
				TLS:          true,
			},
			{
				Name:         "tcp",
				Protocol:     protocol.TCP,
				WorkloadPort: 8092,
				TLS:          true,
			},
		},

		t.Errorf("received unecpected config %v/%v", vs.Namespace, vs.Name)
	}

	// We change service port number.
	serviceConfig.Spec.Ports[0].Port = 8090
	service.Update(&serviceConfig)
	vs = wait()
	if vs.Name != ingressConfig.Name+"-"+"virtualservice" || vs.Namespace != ingressConfig.Namespace {
		t.Errorf("received unecpected config %v/%v", vs.Namespace, vs.Name)
	}

				SetType:  HashIPPort,
				IP:       "1-2-3-4",
				Protocol: ProtocolTCP,
				Port:     8900,
			},
			set: &IPSet{
				Name: "bad-ip",
			},
			valid: false,
		},
		{ // case[10]
			entry: &Entry{
				SetType:  HashIPPort,
				IP:       "10.20.30.40",
				Protocol: "",
				Port:     8090,
			},
			set: &IPSet{
				Name: "empty-protocol",
			},
			valid: true,