misc/appmesh-plugin-validator/appmesh-plugin-validator.go
func validateIPRules() error {
	var iptable *iptables.IPTables
	var err error

	if iptable, err = iptables.NewWithProtocol(iptables.ProtocolIPv4); err != nil {
		return err
	}

	// Print detailed info for debugging.
	str, _ := iptable.ListChains("nat")
	fmt.Printf("List Chains:%v", str)

	strs, _ := iptable.Stats("nat", ingressChain)
	for _, str = range strs {
		fmt.Printf("Ingress chain stats:%v", str)
	}
	strs, _ = iptable.Stats("nat", egressChain)
	for _, str = range strs {
		fmt.Printf("Egress chain stats:%v", str)
	}

	if exist, err := iptable.Exists("nat", ingressChain, "-p", "tcp", "-m", "multiport", "--dports",
		appPorts, "-j", "REDIRECT", "--to-port", proxyIngressPort); !exist {
		return fmt.Errorf("failed to set rules to redirect app ports to proxy: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", "PREROUTING", "-p", "tcp", "-m", "addrtype", "!",
		"--src-type", "LOCAL", "-j", ingressChain); !exist {
		return fmt.Errorf("failed to set rule to jump from PREROUTING to ingress chain: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-m", "owner", "--gid-owner", gid, "-j", "RETURN"); !exist {
		return fmt.Errorf("failed to set ignoredGID: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-p", "tcp", "-m", "multiport", "--dports",
		egressIgnoredPorts, "-j", "RETURN"); !exist {
		return fmt.Errorf("failed to set egressIgnoredPorts: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-p", "tcp", "-d", egressIgnoredIPv4Addresses,
		"-j", "RETURN"); !exist {
		return fmt.Errorf("failed to set egressIgnoredIPv4IPs: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-p", "tcp", "-j", "REDIRECT", "--to",
		proxyEgressPort); !exist {
		return fmt.Errorf("failed to set rule to redirect traffic to proxyEgressPort: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", "OUTPUT", "-p", "tcp", "-m", "addrtype", "!",
		"--dst-type", "LOCAL", "-j", egressChain); !exist {
		return fmt.Errorf("failed to set rule to jump from OUTPUT to egress chain: %v\n", err)
	}

	return nil
}
func validateIPRules() error {
	var iptable *iptables.IPTables
	var err error

	if iptable, err = iptables.NewWithProtocol(iptables.ProtocolIPv4); err != nil {
		return err
	}

	// Print detailed info for debugging.
	str, _ := iptable.ListChains("nat")
	fmt.Printf("List Chains:%v", str)

	strs, _ := iptable.Stats("nat", ingressChain)
	for _, str = range strs {
		fmt.Printf("Ingress chain stats:%v", str)
	}
	strs, _ = iptable.Stats("nat", egressChain)
	for _, str = range strs {
		fmt.Printf("Egress chain stats:%v", str)
	}

	if exist, err := iptable.Exists("nat", ingressChain, "-p", "tcp", "-m", "multiport", "--dports",
		appPorts, "-j", "REDIRECT", "--to-port", proxyIngressPort); !exist {
		return fmt.Errorf("failed to set rules to redirect app ports to proxy: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", "PREROUTING", "-p", "tcp", "-m", "addrtype", "!",
		"--src-type", "LOCAL", "-j", ingressChain); !exist {
		return fmt.Errorf("failed to set rule to jump from PREROUTING to ingress chain: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-m", "owner", "--gid-owner", gid, "-j", "RETURN"); !exist {
		return fmt.Errorf("failed to set ignoredGID: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-p", "tcp", "-m", "multiport", "--dports",
		egressIgnoredPorts, "-j", "RETURN"); !exist {
		return fmt.Errorf("failed to set egressIgnoredPorts: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-p", "tcp", "-d", egressIgnoredIPv4Addresses,
		"-j", "RETURN"); !exist {
		return fmt.Errorf("failed to set egressIgnoredIPv4IPs: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", egressChain, "-p", "tcp", "-j", "REDIRECT", "--to",
		proxyEgressPort); !exist {
		return fmt.Errorf("failed to set rule to redirect traffic to proxyEgressPort: %v\n", err)
	}

	if exist, err := iptable.Exists("nat", "OUTPUT", "-p", "tcp", "-m", "addrtype", "!",
		"--dst-type", "LOCAL", "-j", egressChain); !exist {
		return fmt.Errorf("failed to set rule to jump from OUTPUT to egress chain: %v\n", err)
	}

	return nil
}
// validateIPRules validates IP rules created in the container network namespace.