cilium / cilium / 42713

39%

push

travis-ci-com

iptables: fix typo in addProxyRule condition

In d812b925de ("iptables: don't ignore errors") we introduced a typo in
the logic used to select old proxy rules in addProxyRules:

    -               if strings.Contains(rule, "-A CILIUM_PRE_mangle ") && strings.Contains(rule, "cilium: TPROXY to host "+name) && !strings.Contains(rule, portMatch) {
    +               if strings.Contains(rule, "-A CILIUM_PRE_mangle ") && !strings.Contains(rule, "cilium: TPROXY to host "+name) && strings.Contains(rule, portMatch) {

Then later on, in c61038bff4 ("iptables: invert conditions to simplify logic"),
assuming the condition was correct, we just inverted it:

    -               if strings.Contains(rule, "-A CILIUM_PRE_mangle ") && !strings.Contains(rule, "cilium: TPROXY to host "+name) && strings.Contains(rule, portMatch) {
    +               if !strings.Contains(rule, "-A CILIUM_PRE_mangle ") || strings.Contains(rule, "cilium: TPROXY to host "+name) || !strings.Contains(rule, portMatch) {

The correct condition to use should be the initial one, inverted:

    if !strings.Contains(rule, "-A CILIUM_PRE_mangle ") || !strings.Contains(rule, "cilium: TPROXY to host "+name) || strings.Contains(rule, portMatch) {

Fixes: #19693
Signed-off-by: Gilberto Bertin <jibi@cilium.io>

1 of 1 new or added line in 1 file covered. (100.0%)

37746 of 95607 relevant lines covered (39.48%)

4921.61 hits per line