containernetworking / plugins / 29903823545

52%

master: 55%

Pull #1281

github

fix: fall back to binary presence when netfilter capability checks both fail

SupportsNFTables() runs `nft --check` via exec, which requires
CAP_NET_ADMIN even for a dry run. On systems where iptables is absent
but that capability is unavailable at detection time, both
SupportsIPTables() and SupportsNFTables() return false, causing
ensureBackend() and SetupIPMasqForNetworks() to unconditionally default
to iptables — which then also fails.

Add IPTablesBinaryAvailable() and NFTablesBinaryAvailable() (LookPath
only, no kernel access required) as a second detection tier. When both
full checks fail, binary presence breaks the tie: if the iptables binary
is absent but nft is present, select the nftables backend.

Signed-off-by: Thomas Ferrandiz <thomas.ferrandiz@suse.com>

12 of 31 new or added lines in 3 files covered. (38.71%)

5014 of 9551 relevant lines covered (52.5%)

27.78 hits per line