Ben Leggett <******@****.***> 1707525115 -0500

		}

		for _, cmd := range optionalDeleteCmds {
			err := cfg.ext.Run(iptablesconstants.IPTables, &iptVer, nil, cmd...)
			if err != nil {
				log.Debugf("ignoring error deleting optional iptables rule: %v", err)
			}
		}
	}
	return errors.Join(delErrs...)
}

// Setup iptables rules for in-pod mode. Ideally this should be an idempotent function.

)

const (
	anonymousName = "_anonymous_match_nothing_"
)

// Matches the policy name in RBAC filter config with format like ns[default]-policy[some-policy]-rule[1].
var re = regexp.MustCompile(`ns\[(.+)\]-policy\[(.+)\]-rule\[(.+)\]`)

type filterChain struct {
	rbacHTTP []*rbachttp.RBAC
	rbacTCP  []*rbactcp.RBAC
}

type parsedListener struct {
	filterChains []*filterChain
}

		"Error [B1] (SoapBubble) Explosion accident: the bubble is too big\n" +
			"Warning [C1] (GrandCastle) Collapse danger: the castle is too old",
	))
}

func TestFormatter_PrintLogWithColor(t *testing.T) {
	g := NewWithT(t)

	firstMsg := diag.NewMessage(
		diag.NewMessageType(diag.Error, "B1", "Explosion accident: %v"),
		diag.MockResource("SoapBubble"),
		"the bubble is too big",
	)
	secondMsg := diag.NewMessage(

	if err != nil {
		return err
	}
	if includeConfigType {
		_, _ = fmt.Fprintln(w, "NAME\tSERVICE FQDN\tPORT\tSUBSET\tDIRECTION\tTYPE\tDESTINATION RULE")
	} else {
		_, _ = fmt.Fprintln(w, "SERVICE FQDN\tPORT\tSUBSET\tDIRECTION\tTYPE\tDESTINATION RULE")
	}
	for _, c := range clusters {
		if filter.Verify(c) {
			if len(strings.Split(c.Name, "|")) > 3 {
				direction, subset, fqdn, port := model.ParseSubsetKey(c.Name)

		inpodMarkRule.Mask = InpodTProxyMask
		inpodMarkRule.Priority = 32764
		rules = append(rules, inpodMarkRule)
	}

	for _, rule := range rules {
		log.Debugf("Iterating netlink rule : %+v", rule)
		if err := f(rule); err != nil {
			return fmt.Errorf("failed to configure netlink rule: %w", err)
		}
	}

	return nil
}

func AddLoopbackRoutes(cfg *Config) error {

	// However, this requires elevated privileges we want to avoid
	if uid, f := c.repairedPods[key]; f {
		if uid == pod.UID {
			log.Debugf("Skipping pod, already repaired")
		} else {
			// This is unexpected, bubble up to an error. Might be missing event, or invalid assumption in our code.
			// Either way, we will skip.
			log.Errorf("Skipping pod, already repaired with an unexpected UID %v vs %v", uid, pod.UID)
		}
		return nil
	}

			if err != nil {
				log.Fatalf("Cannot read generated IPTables rule file: %v", err)
			}
			generatedRules := getRules(generated)

			refreshGoldens(t, tt.golden, generatedRules)

			// Compare generated iptables rule with golden files.
			golden, err := os.ReadFile(tt.golden)
			if err != nil {
				log.Fatalf("Cannot read golden rule file: %v", err)
			}
			goldenRules := getRules(golden)

}

// TODO this should actually create v6 and v6 subsets of type `hash:ip`, add them both to a
// superset of type `list:set` - we can then query the superset directly in iptables (with the same rule),
// and iptables will be smart enough to pick the correct underlying set (v4 or v6, based on context),
// reducing the # of rules we need.
//

	ss := re.FindStringSubmatch(path)
	if ss == nil {
		return "", "", fmt.Errorf("not a DR path: %s", path)
	}
	return ss[3], ss[2], nil
}

// getIstioDestinationRulePathForSvc returns something like "/apis/networking/v1alpha3/namespaces/default/destination-rule/reviews"