Function GetRedirectedChain

pkg/testutil/iptables/iptables_linux.go:64–99

GetRedirectedChain returns the chain where the traffic is being redirected. This is how libcni manage its port maps. Suppose you have the following rule: -A CNI-HOSTPORT-DNAT -p tcp -m comment --comment "dnat name: \"bridge\" id: \"default-YYYYYY\"" -m multiport --dports 9999 -j CNI-DN-XXXXXX So the

(t *testing.T, ipt *iptables.IPTables, chain, namespace, containerID string)

// So the chain where the traffic is redirected is CNI-DN-XXXXXX
// Returns an empty string in case nothing was found.
func GetRedirectedChain(t *testing.T, ipt *iptables.IPTables, chain, namespace, containerID string) string {
	rules, err := ipt.List("nat", chain)
	if err != nil {
		t.Logf("error listing rules in chain: %q\n", err)
		return ""
	}

	if len(rules) < 1 {
		t.Logf("not enough rules: %d", len(rules))
		return ""
	}

	var redirectedChain string
	re := regexp.MustCompile(`-j\s+([^ ]+)`)
	for _, rule := range rules {
		// first we verify the comment section is present: "dnat name: \"bridge\" id: \"default-YYYYYY\""
		matchesContainer, err := regexp.MatchString(namespace+"-"+containerID, rule)
		if err != nil {
			t.Logf("error in match string: %q\n", err)
			return ""
		}
		if matchesContainer {
			// then we find the appropriate chain in the rule
			matches := re.FindStringSubmatch(rule)
			fmt.Println(matches)
			if len(matches) >= 2 {
				redirectedChain = matches[1]
			}
		}
	}
	if redirectedChain == "" {
		t.Logf("no redirectced chain found")
		return ""
	}
	return redirectedChain
}