port:   basePortRange + sizePortRange,
			errMsg: fmt.Sprintf("provided port is not in the valid range. The range of valid ports is %d-%d", basePortRange, basePortRange+sizePortRange-1),
		},
		{
			name:   "Allocate invalid port",
			port:   -2,

  creationTimestamp: null
  name: echo-port-0-istio-autogenerated-k8s-gateway
  namespace: default
spec:
  gateways:
  - mesh
  hosts:
  - echo-port.default.svc.domain.suffix
  http:
  - match:
    - port: 80
    name: default.echo-port.0
    route:
    - destination:
        host: echo.default.svc.domain.suffix
        port:
          number: 80
---
apiVersion: networking.istio.io/v1alpha3

	// Then generate the per-port passthrough filter chains.
	for port := range b.applier.PortLevelSetting() {
		// Skip the per-port passthrough filterchain if the port is already handled by InboundMTLSConfiguration().
		if !needPerPortPassthroughFilterChain(port, b.proxy) {
			continue
		}

		authnLog.Debugf("InboundMTLSConfiguration: build extra pass through filter chain for %v:%d", b.proxy.ID, port)

            # on this list. Setting this to the health check port will ensure that health
            # checks always work. https://github.com/istio/istio/issues/12503
            - port: 15021
              targetPort: 15021
              name: status-port
            - port: 80
              targetPort: 8080
              name: http2
            - port: 443
              targetPort: 8443

			},
			valid: true,
			desc:  "port number can be empty, default is 0. And port number is in the range of its ipset's port range",
		},
		{ // case[1]
			entry: &Entry{
				SetType: BitmapPort,
				Port:    0,
			},
			set: &IPSet{
				PortRange: DefaultPortRange,
			},
			valid: true,
			desc:  "port number can be 0. And port number is in the range of its ipset's port range",
		},

	instances := make(map[int][]*model.IstioEndpoint)
	for _, port := range service.Ports {
		instances[port.Port] = makeInstances(proxy, service, port.Port, port.Port)
		instances[port.Port][0].HostName = hostname
		instances[port.Port][0].SubDomain = subdomain
		instances[port.Port][0].Network = proxy.Metadata.Network
		instances[port.Port][0].Locality.ClusterID = proxy.Metadata.ClusterID
	}
	return instances
}

            path: /
            port: 8080
          initialDelaySeconds: 1
          periodSeconds: 2
          failureThreshold: 10
        livenessProbe:
          tcpSocket:
            port: tcp-health-port
          initialDelaySeconds: 10
          periodSeconds: 10
          failureThreshold: 10
        startupProbe:
          tcpSocket:
            port: tcp-health-port
          periodSeconds: 1

    }

    @Override
    public void releasePort(int port) {
        if (port == null || port < MIN_PRIVATE_PORT || port > MAX_PRIVATE_PORT) {
            return
        }

        try {
            lock.lock()
            for (int i = 0; i < reservations.size(); i++) {
                ReservedPortRange range = reservations.get(i)
                if (range.allocated.contains(port)) {
                    range.deallocate(port)

	var listener net.PacketConn
	var port int
	var err error
	if s.Port.TLS {
		return fmt.Errorf("TLS not supported for UDP")
	}
	// Listen on the given port and update the port if it changed from what was passed in.
	listener, port, err = listenUDPAddress(s.ListenerIP, s.Port.Port)
	// Store the actual listening port back to the argument.
	s.Port.Port = port
	if err != nil {
		return err
	}

	s.l = listener

		{
			testName:    "service definition wrong port",
			serviceName: "foo",
			servicePorts: []corev1.ServicePort{
				{Name: "foo", Port: 8080, Protocol: "TCP", TargetPort: intstr.FromInt32(8080)},
			},
			serviceType: corev1.ServiceTypeClusterIP,
			service: &corev1.Service{
				ObjectMeta: om("foo"),
				Spec: corev1.ServiceSpec{
					Ports: []corev1.ServicePort{