admin/gluetun
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(firewall): improve error message when NET_ADMIN is missing

Browse Source
This commit is contained in:
Quentin McGaw
2022-03-09 11:16:10 +00:00
parent 006b218ade
commit 39a62f5db7
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
internal/firewall/iptables.go
View File

@@ -16,6 +16,7 @@ import (
var ( var (
ErrIPTablesNotSupported = errors.New("no iptables supported found") ErrIPTablesNotSupported = errors.New("no iptables supported found")
ErrNetAdminMissing = errors.New("NET_ADMIN capability is missing")
ErrIPTablesVersionTooShort = errors.New("iptables version string is too short") ErrIPTablesVersionTooShort = errors.New("iptables version string is too short")
ErrPolicyUnknown = errors.New("unknown policy") ErrPolicyUnknown = errors.New("unknown policy")
ErrNeedIP6Tables = errors.New("ip6tables is required, please upgrade your kernel to support it") ErrNeedIP6Tables = errors.New("ip6tables is required, please upgrade your kernel to support it")
@@ -24,17 +25,26 @@ var (
func findIptablesSupported(ctx context.Context, runner command.Runner) (iptablesPath string, err error) { func findIptablesSupported(ctx context.Context, runner command.Runner) (iptablesPath string, err error) {
binsToTry := []string{"iptables", "iptables-nft"} binsToTry := []string{"iptables", "iptables-nft"}
var errMessage string
for _, iptablesPath = range binsToTry { for _, iptablesPath = range binsToTry {
cmd := exec.CommandContext(ctx, iptablesPath, "-L") cmd := exec.CommandContext(ctx, iptablesPath, "-L")
_, err = runner.Run(cmd) errMessage, err = runner.Run(cmd)
if err == nil { if err == nil {
break break
} }
const permissionDeniedString = "Permission denied (you must be root)"
if strings.Contains(errMessage, permissionDeniedString) {
return "", fmt.Errorf("%w: %s (%s)", ErrNetAdminMissing, errMessage, err)
}
errMessage = fmt.Sprintf("%s (%s)", errMessage, err)
} }
if err != nil { if err != nil {
return "", fmt.Errorf("%w: from %s: last error is %s", return "", fmt.Errorf("%w: from %s: last error is: %s",
ErrIPTablesNotSupported, strings.Join(binsToTry, ", "), err) ErrIPTablesNotSupported, strings.Join(binsToTry, ", "),
errMessage)
} }
return iptablesPath, nil return iptablesPath, nil