contents:
  repositories:
    - https://packages.wolfi.dev/os
  keyring:
    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
  packages:
    - ca-certificates-bundle
    - wolfi-baselayout
    - glibc
    - iptables
    - ip6tables
    - libnetfilter_conntrack
    - libnfnetlink
    - libmnl
    - libgcc
archs:
  - x86_64
  - aarch64
paths:
- path: /run
  type: directory
  permissions: 0o755
accounts:

	tables := make(map[string]sets.Set[string])
	tables["mangle"] = sets.New[string]()
	tables["filter"] = sets.New[string]()
	tables["nat"] = sets.New[string]()
	return &monitorFakeExec{tables: tables}
}

func (mfe *monitorFakeExec) blockIPTables(block bool) {
	mfe.Lock()
	defer mfe.Unlock()

	mfe.block = block
}

func (mfe *monitorFakeExec) getWasBlocked() bool {
	mfe.Lock()
	defer mfe.Unlock()

  **Fixed** an issue causing mTLS errors for traffic on port 22, by including port 22 in iptables by default.

upgradeNotes:
- title: Port 22 iptables capture changes
  content: |
    In previous versions, port 22 was excluded from iptables capture. This mitigates risk of getting locked out of a VM
    when using Istio on VMs. This configuration was hardcoded into the iptables logic, meaning there was no way to
    capture traffic on port 22.

func NewFakeProxier(ipFamily v1.IPFamily) (*knftables.Fake, *Proxier) {
	// TODO: Call NewProxier after refactoring out the goroutine
	// invocation into a Run() method.
	nftablesFamily := knftables.IPv4Family
	podCIDR := "10.0.0.0/8"
	serviceCIDRs := "172.30.0.0/16"
	if ipFamily == v1.IPv6Protocol {
		nftablesFamily = knftables.IPv6Family
		podCIDR = "fd00:10::/64"
		serviceCIDRs = "fd00:10:96::/112"
	}

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
  - |

//
// The returned index is a 1-based HPACK index. For dynamic tables, HPACK says
// that index 1 should be the newest entry, but t.ents[0] is the oldest entry,
// meaning t.ents is reversed for dynamic tables. Hence, when t is a dynamic
// table, the return value i actually refers to the entry t.ents[t.len()-i].
//
// All tables are assumed to be a dynamic tables except for the global staticTable.
//
// See Section 2.3.3.

		if parseErr != nil {
			return IptablesVersion{}, fmt.Errorf("iptables version %q is not a valid version string: %v", verStdOut.Bytes(), parseErr)
		}
		// Legacy will have no marking or 'legacy', so just look for nf_tables
		isNft = strings.Contains(verStdOut.String(), "nf_tables")
	} else {

		// receivers instead of creating stack objects and relying on RVO
		v.points[i+1].FromP3(tmpP3.fromP1xP1(tmpP1xP1.Add(q, &v.points[i])))
	}
}

// This is not optimised for speed; fixed-base tables should be precomputed.
func (v *affineLookupTable) FromP3(q *Point) {
	// Goal: v.points[i] = (i+1)*Q, i.e., Q, 2Q, ..., 8Q
	// This allows lookup of -8Q, ..., -Q, 0, Q, ..., 8Q
	v.points[0].FromP3(q)
	tmpP3 := Point{}

			ver:  "iptables v1.6.1",

			want: utilversion.MustParseGeneric("1.6.1"),
		},
		{
			name: "centos 7",
			ver:  "iptables v1.4.21",

			want: utilversion.MustParseGeneric("1.4.21"),
		},
		{
			name: "centos 8",
			ver:  "iptables v1.8.4 (nf_tables)",

			want: utilversion.MustParseGeneric("1.8.4"),
		},
		{
			name: "alpine 3.18",
			ver:  "iptables v1.8.9 (legacy)",

apiVersion: release-notes/v2
kind: bug-fix
area: networking
issue:
- 29556
releaseNotes:
- |