func (s *Waller) removeOrphanRules(chain string, currentContainers map[string][]string) ([]string, error) {
	logrus.Debugf("Retrieving iptables rules for %s", chain)
	rules, err1 := osutils.ExecShellf("iptables -L %s -v --line-number", chain)
	if err1 != nil {
		return nil, err1
	}
	rul, err2 := dsutils.LinesToArray(rules)
	if err2 != nil {
		return nil, err2
	}

	cidregex1, _ := regexp.Compile("match-set ([0-9a-zA-Z]+)-dst dst")
	cidregex2, _ := regexp.Compile("nflog-prefix  ([0-9a-zA-Z]+) nflog-group")
	lineregex, _ := regexp.Compile("^([0-9]+)")

	//invert rules order so that we can remove rules without changing the line numbers
	rul = dsutils.ReverseArray(rul)

	ocids := make([]string, 0)
	for _, v := range rul {
		cid := ""
		ss1 := cidregex1.FindStringSubmatch(v)
		if len(ss1) == 2 {
			cid = ss1[1]
		}
		ss2 := cidregex2.FindStringSubmatch(v)
		if len(ss2) == 2 {
			cid = ss2[1]
		}
		if cid != "" {
			logrus.Debugf("Found container %s in iptables rule %s", cid, chain)
			_, exists := currentContainers[cid]
			if !exists {
				logrus.Infof("Found iptables rule for %s, but it doesn't exist anymore. Removing. v=%s", cid, v)
				ls := lineregex.FindStringSubmatch(v)
				if len(ls) == 2 {
					line := ls[1]

					//IPTABLES RULES
					logrus.Debugf("Found orphan rule %s for container %s. Removing it.", line, cid)
					_, err4 := osutils.ExecShellf("iptables -D %s %s", chain, line)
					if err4 != nil {
						return nil, fmt.Errorf("Error removing rule on line %s for container %s. err=%s", line, cid, err4)
					}
					ocids = append(ocids, cid)
					logrus.Infof("Rule for %s removed successfully", cid)
				}
			} else {
				logrus.Debugf("Rules for %s are not orphan", cid)
			}
		}
	}
	return ocids, nil
}
//returns list of detected orphan rules container ids in iptables
returns list of detected orphan rules container ids in iptables
// returns list of detected orphan rules container ids in iptables
func (s *Waller) removeOrphanRules(chain string, currentContainers map[string][]string) ([]string, error) {
	logrus.Debugf("Retrieving iptables rules for %s", chain)
	rules, err1 := osutils.ExecShellf("iptables -L %s -v --line-number", chain)
	if err1 != nil {
		return nil, err1
	}
	rul, err2 := dsutils.LinesToArray(rules)
	if err2 != nil {
		return nil, err2
	}
	cidregex1, _ := regexp.Compile("match-set ([0-9a-zA-Z]+)-dst dst")
	cidregex2, _ := regexp.Compile("nflog-prefix  ([0-9a-zA-Z]+) nflog-group")
	lineregex, _ := regexp.Compile("^([0-9]+)")
	rul = dsutils.ReverseArray(rul)
	ocids := make([]string, 0)
	for _, v := range rul {
		cid := ""
		ss1 := cidregex1.FindStringSubmatch(v)
		if len(ss1) == 2 {
			cid = ss1[1]
		}
		ss2 := cidregex2.FindStringSubmatch(v)
		if len(ss2) == 2 {
			cid = ss2[1]
		}
		if cid != "" {
			logrus.Debugf("Found container %s in iptables rule %s", cid, chain)
			_, exists := currentContainers[cid]
			if !exists {
				logrus.Infof("Found iptables rule for %s, but it doesn't exist anymore. Removing. v=%s", cid, v)
				ls := lineregex.FindStringSubmatch(v)
				if len(ls) == 2 {
					line := ls[1]
					logrus.Debugf("Found orphan rule %s for container %s. Removing it.", line, cid)
					_, err4 := osutils.ExecShellf("iptables -D %s %s", chain, line)
					if err4 != nil {
						return nil, fmt.Errorf("Error removing rule on line %s for container %s. err=%s", line, cid, err4)
					}
					ocids = append(ocids, cid)
					logrus.Infof("Rule for %s removed successfully", cid)
				}
			} else {
				logrus.Debugf("Rules for %s are not orphan", cid)
			}
		}
	}
	return ocids, nil
}
func ( s * Waller ) removeOrphanRules ( chain string , currentContainers map [ string ] [ ] string ) ( [ ] string , error ) { logrus . Debugf ( " " , chain ) rules , err1 := osutils . ExecShellf ( " " , chain ) if err1 != nil { return nil , err1 } rul , err2 := dsutils . LinesToArray ( rules ) if err2 != nil { return nil , err2 } cidregex1 , _ := regexp . Compile ( " " ) cidregex2 , _ := regexp . Compile ( " " ) lineregex , _ := regexp . Compile ( " " ) rul = dsutils . ReverseArray ( rul ) ocids := make ( [ ] string , 0 ) for _ , v := range rul { cid := " " ss1 := cidregex1 . FindStringSubmatch ( v ) if len ( ss1 ) == 2 { cid = ss1 [ 1 ] } ss2 := cidregex2 . FindStringSubmatch ( v ) if len ( ss2 ) == 2 { cid = ss2 [ 1 ] } if cid != " " { logrus . Debugf ( " " , cid , chain ) _ , exists := currentContainers [ cid ] if ! exists { logrus . Infof ( " " , cid , v ) ls := lineregex . FindStringSubmatch ( v ) if len ( ls ) == 2 { line := ls [ 1 ] logrus . Debugf ( " " , line , cid ) _ , err4 := osutils . ExecShellf ( " " , chain , line ) if err4 != nil { return nil , fmt . Errorf ( " " , line , cid , err4 ) } ocids = append ( ocids , cid ) logrus . Infof ( " " , cid ) } } else { logrus . Debugf ( " " , cid ) } } } return ocids , nil }
returns list of detected orphan rules container ids in iptables
returns list of detected orphan rules container ids in iptables
//invert rules order so that we can remove rules without changing the line numbers //IPTABLES RULES