{"server:http", "server", "80"},
	}

	for _, testCase := range testCases {
		host, port := mustSplitHostPort(testCase.hostPort)
		if testCase.expectedHost != host {
			t.Fatalf("host: expected = %v, got = %v", testCase.expectedHost, host)
		}

		if testCase.expectedPort != port {
			t.Fatalf("port: expected = %v, got = %v", testCase.expectedPort, port)
		}
	}
}

func TestSortIPs(t *testing.T) {
	testCases := []struct {

c&-swa.stessa-weivbew,.s&fv,tessa-weivbew,??adbmal-tcejbo-3s,dorp-&iupparme,oidutsrme,skoobetonrme,?etisbew-3s,ipa-etucexe,kcatslaud.&3s,tniopssecca-3s,?tniopssecca-3s,??uos-&em&-3s,.&3s,9duolc&-swa.stessa-weivbew,.s&fv,tessa-weivbew,??adbmal-tcejbo-3s,dorp-&iupparme,oidutsrme,skoobetonrme,?etisbew-3s,ipa-etucexe,kcatslaud.&3s,tniopssecca-3s,?tniopssecca-3s,??fa.&3s,9duolc&-swa.stessa-weivbew,.s&fv,tessa-weivbew,??adbmal-tcejbo-3s,dorp-&iupparme,oidutsrme,skoobetonrme,?etisbew-3s,ipa-etucexe,kca...

c&-swa.stessa-weivbew,.s&fv,tessa-weivbew,??adbmal-tcejbo-3s,dorp-&iupparme,oidutsrme,skoobetonrme,?etisbew-3s,ipa-etucexe,kcatslaud.&3s,tniopssecca-3s,?tniopssecca-3s,??uos-&em&-3s,.&3s,9duolc&-swa.stessa-weivbew,.s&fv,tessa-weivbew,??adbmal-tcejbo-3s,dorp-&iupparme,oidutsrme,skoobetonrme,?etisbew-3s,ipa-etucexe,kcatslaud.&3s,tniopssecca-3s,?tniopssecca-3s,??fa.&3s,9duolc&-swa.stessa-weivbew,.s&fv,tessa-weivbew,??adbmal-tcejbo-3s,dorp-&iupparme,oidutsrme,skoobetonrme,?etisbew-3s,ipa-etucexe,kca...

	"istio.io/istio/pkg/slices"
)

type EndpointFilter struct {
	Address string
	Port    uint32
	Cluster string
	Status  string
}

// Verify returns true if the passed host matches the filter fields
func (e *EndpointFilter) Verify(ep *endpoint.LbEndpoint, cluster string) bool {
	if e.Address == "" && e.Port == 0 && e.Cluster == "" && e.Status == "" {
		return true
	}
	if e.Address != "" {

-A ISTIO_OUTPUT -d 169.254.7.127 -p tcp -m tcp -j ACCEPT
-A ISTIO_PRERT ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m mark ! --mark 0x539/0xfff -j REDIRECT --to-ports 15006
-A ISTIO_OUTPUT ! -o lo -p udp -m mark ! --mark 0x539/0xfff -m udp --dport 53 -j REDIRECT --to-port 15053
-A ISTIO_OUTPUT ! -d 127.0.0.1/32 -p tcp --dport 53 -m mark ! --mark 0x539/0xfff -j REDIRECT --to-ports 15053
-A ISTIO_OUTPUT -p tcp -m mark --mark 0x111/0xfff -j ACCEPT

-A ISTIO_OUTPUT -d 169.254.7.127 -p tcp -m tcp -j ACCEPT
-A ISTIO_PRERT ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m mark ! --mark 0x539/0xfff -j REDIRECT --to-ports 15006
-A ISTIO_OUTPUT ! -o lo -p udp -m mark ! --mark 0x539/0xfff -m udp --dport 53 -j REDIRECT --to-port 15053
-A ISTIO_OUTPUT ! -d 127.0.0.1/32 -p tcp --dport 53 -m mark ! --mark 0x539/0xfff -j REDIRECT --to-ports 15053
-A ISTIO_OUTPUT -p tcp -m mark --mark 0x111/0xfff -j ACCEPT

			"-p", iptablesconstants.TCP,
			"-i", "lo",
			"-j", "ACCEPT")
		// CLI: -A ISTIO_PRERT -p tcp -m tcp --dport <INPORT> -m mark ! --mark 0x539/0xfff -j TPROXY --on-port <INPORT> --on-ip 127.0.0.1 --tproxy-mark 0x111/0xfff
		//
		// DESC: Anything heading to <INPORT> that does not have the mark, TPROXY to ztunnel inbound port <INPORT>
		iptablesBuilder.AppendRule(
			iptableslog.UndefinedCommand, ChainInpodPrerouting, iptablesconstants.MANGLE,

        assertEquals(
            listOf(
                "-Dorg.gradle.workers.max=%maxParallelForks%",
                "-PmaxParallelForks=%maxParallelForks%",
                "-Dorg.gradle.internal.plugins.portal.url.override=%gradle.plugins.portal.url%",
                "-s",
                "--no-configuration-cache",

		inListener *listener.Listener
		expect     bool
	}{
		{
			desc: "filter-fields-empty",
			inFilter: &ListenerFilter{
				Address: "",
				Port:    0,
				Type:    "",
			},
			inListener: &listener.Listener{},
			expect:     true,
		},
		{
			desc: "addrs-dont-match",
			inFilter: &ListenerFilter{
				Address: "0.0.0.0",
			},
			inListener: &listener.Listener{
				Address: &core.Address{

COMMIT
* raw
-N ISTIO_OUTPUT
-A OUTPUT -p udp -j ISTIO_OUTPUT
-A ISTIO_OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j CT --zone 1
-A ISTIO_OUTPUT -p udp --sport 15053 -m owner --uid-owner 1337 -j CT --zone 2
-A ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j CT --zone 1
-A ISTIO_OUTPUT -p udp --sport 15053 -m owner --gid-owner 1337 -j CT --zone 2
-A ISTIO_OUTPUT -p udp --dport 53 -j CT --zone 2