misc/appmesh-plugin-validator/appmesh-plugin-validator.go
func validateIPRules() error {
	var iptable *iptables.IPTables
	var err error

	if iptable, err = iptables.NewWithProtocol(iptables.ProtocolIPv4); err != nil {
		return err
	}

	// Print detailed info for debugging.
	str, _ := iptable.ListChains("nat")
	fmt.Printf("List Chains:%v", str)

	strs, _ := iptable.Stats("nat", ingressChain)
	for _, str = range strs {
		fmt.Printf("Ingress chain stats:%v", str)
	}
	strs, _ = iptable.Stats("nat", egressChain)
	for _, str = range strs {
		fmt.Printf("Egress chain stats:%v", str)
	}

	if exist, err := iptable.Exists("nat", ingressChain, "-p", "tcp", "-m", "multiport", "--dports",
		appPorts, "-j", "REDIRECT", "--to-port", proxyIngressPort); !exist {
		return fmt.Errorf("failed to set rules to redirect app ports to proxy: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", "PREROUTING", "-p", "tcp", "-m", "addrtype", "!",
		"--src-type", "LOCAL", "-j", ingressChain); !exist {
		return fmt.Errorf("failed to set rule to jump from PREROUTING to ingress chain: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-m", "owner", "--gid-owner", gid, "-j", "RETURN"); !exist {
		return fmt.Errorf("failed to set ignoredGID: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-p", "tcp", "-m", "multiport", "--dports",
		egressIgnoredPorts, "-j", "RETURN"); !exist {
		return fmt.Errorf("failed to set egressIgnoredPorts: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-p", "tcp", "-d", egressIgnoredIPv4Addresses,
		"-j", "RETURN"); !exist {
		return fmt.Errorf("failed to set egressIgnoredIPv4IPs: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-p", "tcp", "-j", "REDIRECT", "--to",
		proxyEgressPort); !exist {
		return fmt.Errorf("failed to set rule to redirect traffic to proxyEgressPort: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", "OUTPUT", "-p", "tcp", "-m", "addrtype", "!",
		"--dst-type", "LOCAL", "-j", egressChain); !exist {
		return fmt.Errorf("failed to set rule to jump from OUTPUT to egress chain: %v\n", err)
	}

	return nil
}
func validateIPRules() error {
	var iptable *iptables.IPTables
	var err error

	if iptable, err = iptables.NewWithProtocol(iptables.ProtocolIPv4); err != nil {
		return err
	}

	// Print detailed info for debugging.
	str, _ := iptable.ListChains("nat")
	fmt.Printf("List Chains:%v", str)

	strs, _ := iptable.Stats("nat", ingressChain)
	for _, str = range strs {
		fmt.Printf("Ingress chain stats:%v", str)
	}
	strs, _ = iptable.Stats("nat", egressChain)
	for _, str = range strs {
		fmt.Printf("Egress chain stats:%v", str)
	}

	if exist, err := iptable.Exists("nat", ingressChain, "-p", "tcp", "-m", "multiport", "--dports",
		appPorts, "-j", "REDIRECT", "--to-port", proxyIngressPort); !exist {
		return fmt.Errorf("failed to set rules to redirect app ports to proxy: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", "PREROUTING", "-p", "tcp", "-m", "addrtype", "!",
		"--src-type", "LOCAL", "-j", ingressChain); !exist {
		return fmt.Errorf("failed to set rule to jump from PREROUTING to ingress chain: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-m", "owner", "--gid-owner", gid, "-j", "RETURN"); !exist {
		return fmt.Errorf("failed to set ignoredGID: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-p", "tcp", "-m", "multiport", "--dports",
		egressIgnoredPorts, "-j", "RETURN"); !exist {
		return fmt.Errorf("failed to set egressIgnoredPorts: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-p", "tcp", "-d", egressIgnoredIPv4Addresses,
		"-j", "RETURN"); !exist {
		return fmt.Errorf("failed to set egressIgnoredIPv4IPs: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-p", "tcp", "-j", "REDIRECT", "--to",
		proxyEgressPort); !exist {
		return fmt.Errorf("failed to set rule to redirect traffic to proxyEgressPort: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", "OUTPUT", "-p", "tcp", "-m", "addrtype", "!",
		"--dst-type", "LOCAL", "-j", egressChain); !exist {
		return fmt.Errorf("failed to set rule to jump from OUTPUT to egress chain: %v\n", err)
	}

	return nil
}
func validateIPRules ( ) error { var iptable * iptables . IPTables var err error if iptable , err = iptables . NewWithProtocol ( iptables . ProtocolIPv4 ) ; err != nil { return err } // Print detailed info for debugging. str , _ := iptable . ListChains ( " " ) fmt . Printf ( " " , str ) strs , _ := iptable . Stats ( " " , ingressChain ) for _ , str = range strs { fmt . Printf ( " " , str ) } strs , _ = iptable . Stats ( " " , egressChain ) for _ , str = range strs { fmt . Printf ( " " , str ) } if exist , err := iptable . Exists ( " " , ingressChain , " " , " " , " " , " " , " " , appPorts , " " , " " , " " , proxyIngressPort ) ; ! exist { return fmt . Errorf ( " \n " , err ) } if exist , err := iptable . Exists ( " " , " " , " " , " " , " " , " " , " " , " " , " " , " " , ingressChain ) ; ! exist { return fmt . Errorf ( " \n " , err ) } if exist , err := iptable . Exists ( " " , egressChain , " " , " " , " " , gid , " " , " " ) ; ! exist { return fmt . Errorf ( " \n " , err ) } if exist , err := iptable . Exists ( " " , egressChain , " " , " " , " " , " " , " " , egressIgnoredPorts , " " , " " ) ; ! exist { return fmt . Errorf ( " \n " , err ) } if exist , err := iptable . Exists ( " " , egressChain , " " , " " , " " , egressIgnoredIPv4Addresses , " " , " " ) ; ! exist { return fmt . Errorf ( " \n " , err ) } if exist , err := iptable . Exists ( " " , egressChain , " " , " " , " " , " " , " " , proxyEgressPort ) ; ! exist { return fmt . Errorf ( " \n " , err ) } if exist , err := iptable . Exists ( " " , " " , " " , " " , " " , " " , " " , " " , " " , " " , egressChain ) ; ! exist { return fmt . Errorf ( " \n " , err ) } return nil }
// validateIPRules validates IP rules created in the container network namespace.
validateIPRules validates IP rules created in the container network namespace .