releaseNotes:
- |
  **Added** new configuration options to `istio-iptables` and `istio-clean-iptables`
  for including/excluding certain user groups from interception of the outgoing traffic
  generated by them.

  This feature is intended primarily for use on VMs, where system administrators need
  to restrain interception of the outgoing traffic down to a few applications instead
  of intercepting all outgoing traffic.

	outdirflag = flag.String("o", "", "Output directory to write")
	s := &sstate{
		mode:  mode,
		mm:    newMetaMerge(),
		inidx: -1,
	}
	return s
}

// sstate holds state needed to implement subtraction and intersection
// operations on code coverage data files. This type provides methods
// to implement the CovDataVisitor interface, and is designed to be
// used in concert with the CovDataReader utility, which abstracts

    default ExcludeSpec fromUnion(Set<ExcludeSpec> remainder) {
        if (remainder.isEmpty()) {
            // It's an intersection, and this method is always called on the remainder
            // of a reduction operation. If the remainder is empty then it means that
            // the intersection is empty
            return nothing();
        }
        return remainder.size() == 1 ? remainder.iterator().next() : anyOf(remainder);

# If not set, defaults to "REDIRECT".
# ISTIO_INBOUND_INTERCEPTION_MODE=REDIRECT

# When the interception mode is "TPROXY", the iptables skb mark that is set on
# every inbound packet to be redirected to Envoy.
# If not set, defaults to "1337".
# ISTIO_INBOUND_TPROXY_MARK=1337

# When the interception mode is "TPROXY", the number of the routing table that

      if (subRange.contains(key)) {
        Entry<Range<K>, V> entry = TreeRangeMap.this.getEntry(key);
        if (entry != null) {
          return Maps.immutableEntry(entry.getKey().intersection(subRange), entry.getValue());
        }
      }
      return null;
    }

    @Override
    public Range<K> span() {
      Cut<K> lowerBound;
      Entry<Cut<K>, RangeMapEntry<K, V>> lowerEntry =

              newRequirement,
              earlierRequirement),
          intersection(newFeatures, earlierFeatures),
          source);
    }
  }

  /** Construct a new {@link java.util.Set} that is the intersection of the given sets. */
  public static <T> Set<T> intersection(Set<? extends T> set1, Set<? extends T> set2) {
    Set<T> result = Helpers.<T>copyToSet(set1);

    checkNotNull(domain);
    Range<C> effectiveRange = range;
    try {
      if (!range.hasLowerBound()) {
        effectiveRange = effectiveRange.intersection(Range.atLeast(domain.minValue()));
      }
      if (!range.hasUpperBound()) {
        effectiveRange = effectiveRange.intersection(Range.atMost(domain.maxValue()));
      }
    } catch (NoSuchElementException e) {
      throw new IllegalArgumentException(e);
    }

		}
	})
}

func TestIntersection(t *testing.T) {
	s1 := New("a", "b", "d")
	s2 := New("a", "b", "c")
	want := New("a", "b")

	t.Run("intersection", func(t *testing.T) {
		d := s1.Intersection(s2)
		if !d.Equals(want) {
			t.Errorf("want %+v, but got %+v", want, d)
		}
	})

	t.Run("intersect in replace", func(t *testing.T) {
		s1c := s1.Copy()
		d := s1c.IntersectInPlace(s2)

		// We need to filter down to only ones we actually support
		intersection := []k8s.RouteGroupKind{}
		for _, s := range supported {
			for _, kind := range l.AllowedRoutes.Kinds {
				if routeGroupKindEqual(s, kind) {
					intersection = append(intersection, s)
					break
				}
			}
		}
		return intersection, len(intersection) == len(l.AllowedRoutes.Kinds)
	}
	return supported, true
}

	}

	nonInterIPV4s := mustGetLocalIP4().Intersection(hostIPs)
	if nonInterIPV4s.IsEmpty() {
		hostIPs = hostIPs.ApplyFunc(func(ip string) string {
			if net.ParseIP(ip).IsLoopback() {
				// Any loopback IP which is not 127.0.0.1
				// convert it to check for intersections.
				return "127.0.0.1"
			}
			return ip
		})
		nonInterIPV4s = mustGetLocalIP4().Intersection(hostIPs)
	}