flag.AdditionalEnv(fs, constants.DropInvalid, InvalidDropByIptables)

	flag.BindEnv(fs, constants.DualStack, "", "Enable ipv4/ipv6 redirects for dual-stack.", &cfg.DualStack)
	// Allow binding to a different var, for consistency with other components
	flag.AdditionalEnv(fs, constants.DualStack, "ISTIO_DUAL_STACK")

	flag.BindEnv(fs, constants.CaptureAllDNS, "",

	assert.True(t, ipv4EpPresent, "IPV4 endpoint is missing in Dualstack mode")
	assert.Equal(t, endpointIpv4.ip, epIpAddress, "IPV4 IP is missing in Dualstack mode")

	endpointIpv6, ipv6EpPresent := mapEndpointsInfo[ipv6Config.IpAddress]
	assert.True(t, ipv6EpPresent, "IPV6 endpoint is missing in Dualstack mode")
	assert.Equal(t, endpointIpv6.ip, epIpv6Address, "IPV6 IP is missing in Dualstack mode")

	err = Endpoint.Delete()
	if err != nil {

		if err != nil {
			return nil, false, fmt.Errorf("failed to perform dualstack check on serviceCIDR and secondaryServiceCIDR error:%v", err)
		}
		if !dualstackServiceCIDR {
			return nil, false, fmt.Errorf("serviceCIDR and secondaryServiceCIDR are not dualstack (from different IPfamiles)")
		}
	}

	logger := klog.FromContext(ctx)
	var proxier proxy.Provider
	var err error

	localDetectors := getLocalDetectors(logger, s.PrimaryIPFamily, config, s.podCIDRs)

	if config.Mode == proxyconfigapi.ProxyModeIPTables {
		logger.Info("Using iptables Proxier")

		if dualStack {
			ipt, _ := getIPTables(s.PrimaryIPFamily)

		t.Fatal(err)
	}

	for i, tt := range testCases {
		d := &Dialer{DualStack: tt.dualstack, FallbackDelay: tt.delay}

		startTime := time.Now()
		c, err := d.Dial("tcp", JoinHostPort("slow6loopback4", dss.port))
		elapsed := time.Since(startTime)
		if err == nil {
			c.Close()
		} else if tt.dualstack {
			t.Error(err)
		}
		expectMin := tt.expectElapsed - 1*time.Millisecond

		// if DualStack and two cidrs validate if there is at least one of each IP family
		case len(cidrs) == 2:
			isDual, err := netutils.IsDualStackCIDRStrings(cidrs)
			if err != nil || !isDual {
				allErrs = append(allErrs, field.Invalid(newPath.Child("ClusterCIDR"), config.ClusterCIDR, "must be a valid DualStack CIDR (e.g. 10.100.0.0/16,fde4:8dba:82e1::/48)"))

	// actually be for circular dependency reasons.
	DNSDone func(netIPs []any, coalesced bool, err error)

	// ConnectStart is called before a Dial, excluding Dials made
	// during DNS lookups. In the case of DualStack (Happy Eyeballs)
	// dialing, this may be called multiple times, from multiple
	// goroutines.
	ConnectStart func(network, addr string)

	// ConnectDone is called after a Dial with the results, excluding

	excludeInboundPorts  string
	excludeOutboundPorts string
	includeInboundPorts  string
	includeOutboundPorts string
	kubevirtInterfaces   string
	excludeInterfaces    string
	dnsRedirect          bool
	dualStack            bool
	invalidDrop          bool
}

type annotationValidationFunc func(value string) error

type annotationParam struct {
	key        string
	defaultVal string
	validator  annotationValidationFunc

			compareNode: makeNode([]string{"10.0.0.0/8"}, false, false),
		},
		{
			name:        "dualstack 4-6",
			node:        makeNode([]string{"10.0.0.0/8", "2000::/10"}, false, false),
			compareNode: makeNode([]string{"10.0.0.0/8", "2000::/10"}, false, false),
		},
		{
			name:        "dualstack 6-4",
			node:        makeNode([]string{"2000::/10", "10.0.0.0/8"}, false, false),

	// If net.Dialer.DualStack (IPv6 "Happy Eyeballs") support is
	// enabled, this may be called multiple times.
	ConnectStart func(network, addr string)

	// ConnectDone is called when a new connection's Dial
	// completes. The provided err indicates whether the
	// connection completed successfully.
	// If net.Dialer.DualStack ("Happy Eyeballs") support is