) {
	// TODO: add ip6 as well
	for _, uid := range split(proxyUID) {
		// Packets with dst port 53 from istio to zone 1. These are Istio calls to upstream resolvers
		f.Run("-p", "udp", "--dport", "53", "-m", "owner", "--uid-owner", uid, "-j", constants.CT, "--zone", "1")
		// Packets with src port 15053 from istio to zone 2. These are Istio response packets to application clients

/** A simple index that of trusted root certificates that have been loaded into memory. */
class BasicTrustRootIndex(vararg caCerts: X509Certificate) : TrustRootIndex {
  private val subjectToCaCerts: Map<X500Principal, Set<X509Certificate>>

  init {
    val map = mutableMapOf<X500Principal, MutableSet<X509Certificate>>()
    for (caCert in caCerts) {
      map.getOrPut(caCert.subjectX500Principal) { mutableSetOf() }.add(caCert)
    }

	// Cycles in the static call graph are broken
	// arbitrarily but deterministically.
	// We create noReturn facts as discovered.
	for _, fn := range decls {
		c.buildDecl(fn, funcDecls[fn])
	}

	// Build CFGs for literal functions.
	// These aren't relevant to facts (since they aren't named)
	// but are required for the CFGs.FuncLit API.
	for _, lit := range lits {
		li := funcLits[lit]

apiVersion: release-notes/v2
kind: feature
area: security
issue:
  - 43104
releaseNotes:
  - |

	{abcd, "", -1, []string{"a", "b", "c", "d"}},
	{commas, ",", -1, []string{"1,", "2,", "3,", "4"}},
	{dots, "...", -1, []string{"1...", ".2...", ".3...", ".4"}},
	{faces, "☹", -1, []string{"☺☻☹", ""}},
	{faces, "~", -1, []string{faces}},
	{faces, "", -1, []string{"☺", "☻", "☹"}},
	{"1 2 3 4", " ", 3, []string{"1 ", "2 ", "3 4"}},
	{"1 2 3", " ", 3, []string{"1 ", "2 ", "3"}},
	{"1 2", " ", 3, []string{"1 ", "2"}},

		certs = append(certs, s)
	}
	return certs
}

// CreateCASecret creates a k8s secret "cacerts" to store the CA key and cert.
func CreateCASecret(ctx resource.Context) error {
	return CreateCustomCASecret(ctx,
		"ca-cert.pem", "ca-key.pem",
		"cert-chain.pem", "root-cert.pem")
}

// CreateCASecretAlt creates a k8s secret "cacerts" to store the CA key and cert using an alternative set of certs.

org.gradle.plugins.ide.eclipse.model.EclipseWtp
org.gradle.plugins.ide.eclipse.model.EclipseWtpComponent
org.gradle.plugins.ide.eclipse.model.EclipseWtpFacet
org.gradle.plugins.ide.eclipse.model.Facet
org.gradle.plugins.ide.eclipse.model.Facet$FacetType
org.gradle.plugins.ide.eclipse.model.Link
org.gradle.plugins.ide.eclipse.model.Output
org.gradle.plugins.ide.eclipse.model.Project
org.gradle.plugins.ide.eclipse.model.WbDependentModule

    fun get(trustManager: X509TrustManager): CertificateChainCleaner {
      return Platform.get().buildCertificateChainCleaner(trustManager)
    }

    fun get(vararg caCerts: X509Certificate): CertificateChainCleaner {
      return BasicCertificateChainCleaner(BasicTrustRootIndex(*caCerts))
    }
  }

		},
	)

	// iptablesCTStateInvalidDroppedPacketsDescription describe the metrics for the number of packets dropped
	// by iptables which were marked INVALID by conntrack.
	iptablesCTStateInvalidDroppedPacketsDescription = metrics.NewDesc(
		"kubeproxy_iptables_ct_state_invalid_dropped_packets_total",
		"packets dropped by iptables to work around conntrack problems",
		nil, nil, metrics.ALPHA, "")

			// 2. if `istio-ca-secret` not exist and use cacerts enabled, fallback to fetch `cacerts`
			if useCacertsSecretName {
				caCertName = CACertsSecret
				err := loadSelfSignedCaSecret(client, namespace, caCertName, rootCertFile, caOpts)
				if err == nil {
					return nil
				} else if apierror.IsNotFound(err) { // if neither `istio-ca-secret` nor `cacerts` exists, we create a `cacerts`
					// continue to create `cacerts`
				} else {