[lxc-devel] [lxd/master] lxd/firewall/nft: Enhance support detection

stgraber on Github lxc-bot at linuxcontainers.org
Fri May 29 19:30:02 UTC 2020


A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 354 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20200529/346c0ebf/attachment.bin>
-------------- next part --------------
From 2f468ffc6d136329e762f44b5f6753b28dd4f39c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber at ubuntu.com>
Date: Fri, 29 May 2020 15:29:05 -0400
Subject: [PATCH] lxd/firewall/nft: Enhance support detection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 lxd/firewall/drivers/drivers_nftables.go | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lxd/firewall/drivers/drivers_nftables.go b/lxd/firewall/drivers/drivers_nftables.go
index 5b99d3b292..80ce581a07 100644
--- a/lxd/firewall/drivers/drivers_nftables.go
+++ b/lxd/firewall/drivers/drivers_nftables.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"text/template"
 
+	"github.com/pborman/uuid"
 	"github.com/pkg/errors"
 
 	deviceConfig "github.com/lxc/lxd/lxd/device/config"
@@ -75,6 +76,19 @@ func (d Nftables) Compat() (bool, error) {
 		return false, fmt.Errorf("nft version %q is too low, need %q or above", nftVersion, nftablesMinVersion)
 	}
 
+	// Check that nftables works at all (some kernels let you list ruleset despite missing support).
+	testTable := fmt.Sprintf("lxd_test_%s", uuid.New())
+
+	_, err = shared.RunCommandCLocale("nft", "create", "table", testTable)
+	if err != nil {
+		return false, errors.Wrapf(err, "Failed to create a dummy table")
+	}
+
+	_, err = shared.RunCommandCLocale("nft", "delete", "table", testTable)
+	if err != nil {
+		return false, errors.Wrapf(err, "Failed to delete a dummy table")
+	}
+
 	// Check whether in use by parsing ruleset and looking for existing rules.
 	ruleset, err := d.nftParseRuleset()
 	if err != nil {


More information about the lxc-devel mailing list