kubernetes: kube-proxy should log the payload when iptables-restore fails

I’d start with pkg/util/iptables/iptables.go - restoreInternal()

It’s worth thinking about the cleanest solution here, but maybe something like:

type ParseError interface {
    Line() Int
}

type parseError struct {
    cmd string
    line int
}

func (e parseError) Line() int {
    return line
}

func (e parseError) Error() string {
    return fmt.Sprintf("%s: parse error on line %d", e.cmd, e.line)
} 

When you get an error from exec, parse the error for line %d failed and if it matches, return a parseError. Then let the callers check for a ParseError by interface assertion, extract the Line(), extract their input’s data at -3 and +3 from that line and log it. E.g.

 Failed to execute iptables-restore: input error on line 1234:
    1231: ...
    1232: ...
    1233: ...
    1234: ...
    1235: ...
    1236: ...
    1237: ...

You’ll proably want a helper func to do that, which could live in that same iptables package. And a test.

You’ll proably want a helper func to do that, which could live in that same iptables package. And a test.

you may need to write a helper function to extract them from the logs. my 2 cents… here is my version for reference. you could add some tests, to cover the boundary conditions.

const delimiter = 0x0a

func extratLines(limit, lineNumber int, lines []byte) string {
	lineBytes := bytes.Split(lines, []byte{delimiter})

	count := len(lineBytes)
	var extractedLines bytes.Buffer

	// validate boundary limits
	start := max(lineNumber-limit, 0)
	end := min(lineNumber+limit, count-1)

	for i := start; i <= end; i++ {
		extractedLines.WriteString(string(lineBytes[i]) + "\n")
	}

	return extractedLines.String()
}

func max(a, b int) int {
	if a > b {
		return a
	}

	return b
}

func min(a, b int) int {
	if a < b {
		return a
	}

	return b
}

to play around 😃 https://go.dev/play/p/STFKNN-4awR

Hi @cyclinder, apologies I was busy with some other work. You must please continue.

at least I didn’t see any PR from @amustaque97 , in case of collision please sync between both to avoid duplicate efforts