if isInRange(ip, cidr) {
			return true
		}
	}
	// Always trust local host addresses.
	return netip.MustParseAddr(ip).IsLoopback()
}

func isInRange(addr, cidr string) bool {
	if strings.Contains(cidr, "/") {
		ipp, err := netip.ParsePrefix(cidr)
		if err != nil {
			return false
		}

		return ipp.Contains(netip.MustParseAddr(addr))
	}
	return false

func GetPodIPsIfPresent(pod *corev1.Pod) []netip.Addr {
	var podIPs []netip.Addr
	if len(pod.Status.PodIPs) != 0 {
		for _, pip := range pod.Status.PodIPs {
			ip := netip.MustParseAddr(pip.IP)
			podIPs = append(podIPs, ip)
		}
	} else if len(pod.Status.PodIP) != 0 {
		ip := netip.MustParseAddr(pod.Status.PodIP)
		podIPs = append(podIPs, ip)
	}
	return podIPs

	NodeName          = env.RegisterStringVar("NODE_NAME", "", "").Get()
	Revision          = env.RegisterStringVar("REVISION", "", "").Get()
	HostProbeSNATIP   = netip.MustParseAddr(env.RegisterStringVar("HOST_PROBE_SNAT_IP", DefaultHostProbeSNATIP, "").Get())
	HostProbeSNATIPV6 = netip.MustParseAddr(env.RegisterStringVar("HOST_PROBE_SNAT_IPV6", DefaultHostProbeSNATIPV6, "").Get())
)

const (

	// Connect to ::6       will redirect to ::1
	isIPv6 := config.HostIP.Is6()
	listenIP, _ := netip.AddrFromSlice([]byte{127, 0, 0, 1})
	serverIP, _ := netip.AddrFromSlice([]byte{127, 0, 0, 6})
	if isIPv6 {
		listenIP, _ = netip.AddrFromSlice([]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1})
		serverIP, _ = netip.AddrFromSlice([]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 6})
	}
	return &Validator{

		// In practice we see 7 for the next one, but allow some slop.
		// Before pre-allocation in appendQuotedWith, we saw 39.
		{10, `AppendQuoteToASCII(nil, oneMB)`, func() { AppendQuoteToASCII(nil, string(oneMB)) }},
		{0, `ParseFloat("123.45", 64)`, func() { ParseFloat("123.45", 64) }},
		{0, `ParseFloat("123.456789123456789", 64)`, func() { ParseFloat("123.456789123456789", 64) }},

				break
			}
		}
		if nodePort == 0 {
			return nil, false, fmt.Errorf("no port %d found in service: %s/%s", port, ns, svcName)
		}

		ipAddr, err := netip.ParseAddr(ip)
		if err != nil {
			return nil, false, err
		}
		return []any{netip.AddrPortFrom(ipAddr, uint16(nodePort))}, true, nil
	}

	// Otherwise, get the load balancer IP.

	for i := 0; i < n; i++ {
		bytes[i] = uint8(c.Rand.Intn(255))
	}

	ip, ok := netip.AddrFromSlice(bytes)
	if ok {
		return ip.String()
	}
	// this should not happen
	panic(fmt.Sprintf("invalid IP %v", bytes))
}

func generateRandomCIDR(is6 bool, c fuzz.Continue) string {
	ip, err := netip.ParseAddr(generateRandomIP(is6, c))
	if err != nil {

			Name:      "test",
			Namespace: "test",
			UID:       types.UID("test"),
		},
	}

	fakeCtx := context.Background()
	fakeClientSet := fake.NewSimpleClientset(pod)

	podIP := netip.MustParseAddr("99.9.9.1")
	podIPs := []netip.Addr{podIP}

	server := &fakeServer{}
	server.On("AddPodToMesh",
		fakeCtx,
		pod,
		podIPs,
		"",
	).Return(nil)

	server.Start(fakeCtx)
	m := meshDataplane{

			want:     true,
		},
		{
			filter:   noTags,
			userTags: "A=3",
			want:     true,
		},
		{
			filter:   oneTag,
			userTags: "A=3",
			want:     false,
		},
		{
			filter:   oneTag,
			userTags: "FOO=1",
			want:     true,
		},
		{
			filter:   oneTag,
			userTags: "A=B&FOO=1",
			want:     true,
		},
		{
			filter:   twoTags,
			userTags: "",
			want:     false,

func (c *ingressImpl) DiscoveryAddresses() []netip.AddrPort {
	hosts, ports := c.AddressesForPort(discoveryPort)
	var addrs []netip.AddrPort
	if hosts == nil {
		return []netip.AddrPort{{}}
	}
	for i, host := range hosts {
		ip, err := netip.ParseAddr(host)
		if err != nil {
			return []netip.AddrPort{}
		}
		addrs = append(addrs, netip.AddrPortFrom(ip, uint16(ports[i])))
	}

	return addrs