containernetworking / plugins

52%

master: 55%

LAST BUILD ON BRANCH portmap-autodetect

branch: portmap-autodetect

CHANGE BRANCH

x

Reset

• portmap-autodetect
• CNV-75526
• add-aks-integration
• bridge-error
• bridge-mac-pinning
• bridge-port-isolation
• bugfix/wrong_startrange
• bump-go-1.26.4
• bump-go-version
• bump-go-version-2
• bump-golang-ci
• bump-libcni
• codeql
• comment-fix
• contact-info
• coryright-attribution
• deletevlaniface
• dependabot/docker/dot-github/actions/retest-action/alpine-3.18
• dependabot/docker/dot-github/actions/retest-action/alpine-3.19
• dependabot/docker/dot-github/actions/retest-action/alpine-3.20
• dependabot/docker/dot-github/actions/retest-action/alpine-3.21
• dependabot/docker/dot-github/actions/retest-action/alpine-3.22
• dependabot/docker/dot-github/actions/retest-action/alpine-3.23
• dependabot/github_actions/actions/checkout-4
• dependabot/github_actions/actions/checkout-5
• dependabot/github_actions/actions/checkout-6
• dependabot/github_actions/actions/checkout-7
• dependabot/github_actions/actions/setup-go-5
• dependabot/github_actions/actions/setup-go-6
• dependabot/github_actions/actions/setup-go-7
• dependabot/github_actions/golangci/golangci-lint-action-4
• dependabot/github_actions/golangci/golangci-lint-action-5
• dependabot/github_actions/golangci/golangci-lint-action-6
• dependabot/github_actions/golangci/golangci-lint-action-9
• dependabot/go_modules/github.com/Microsoft/hcsshim-0.10.0
• dependabot/go_modules/github.com/Microsoft/hcsshim-0.11.0
• dependabot/go_modules/github.com/Microsoft/hcsshim-0.11.1
• dependabot/go_modules/github.com/Microsoft/hcsshim-0.9.10
• dependabot/go_modules/github.com/Microsoft/hcsshim-0.9.7
• dependabot/go_modules/github.com/Microsoft/hcsshim-0.9.9
• dependabot/go_modules/github.com/containerd/containerd-1.6.26
• dependabot/go_modules/github.com/coreos/go-iptables-0.7.0
• dependabot/go_modules/github.com/networkplumbing/go-nft-0.3.0
• dependabot/go_modules/github.com/networkplumbing/go-nft-0.4.0
• dependabot/go_modules/github.com/onsi/ginkgo/v2-2.11.0
• dependabot/go_modules/github.com/onsi/ginkgo/v2-2.12.0
• dependabot/go_modules/github.com/onsi/ginkgo/v2-2.12.1
• dependabot/go_modules/github.com/onsi/ginkgo/v2-2.13.0
• dependabot/go_modules/github.com/onsi/ginkgo/v2-2.13.1
• dependabot/go_modules/github.com/onsi/ginkgo/v2-2.8.3
• dependabot/go_modules/github.com/onsi/ginkgo/v2-2.8.4
• dependabot/go_modules/github.com/onsi/ginkgo/v2-2.9.0
• dependabot/go_modules/github.com/onsi/ginkgo/v2-2.9.1
• dependabot/go_modules/github.com/onsi/ginkgo/v2-2.9.4
• dependabot/go_modules/github.com/onsi/ginkgo/v2-2.9.7
• dependabot/go_modules/github.com/onsi/gomega-1.25.0
• dependabot/go_modules/github.com/onsi/gomega-1.26.0
• dependabot/go_modules/github.com/onsi/gomega-1.27.1
• dependabot/go_modules/github.com/onsi/gomega-1.27.10
• dependabot/go_modules/github.com/onsi/gomega-1.27.2
• dependabot/go_modules/github.com/onsi/gomega-1.27.3
• dependabot/go_modules/github.com/onsi/gomega-1.27.8
• dependabot/go_modules/github.com/onsi/gomega-1.27.9
• dependabot/go_modules/github.com/onsi/gomega-1.28.0
• dependabot/go_modules/github.com/onsi/gomega-1.30.0
• dependabot/go_modules/github.com/opencontainers/selinux-1.11.0
• dependabot/go_modules/golang-09a819dc01
• dependabot/go_modules/golang-0ff27c0dc8
• dependabot/go_modules/golang-103bedb26b
• dependabot/go_modules/golang-1eaf3aa819
• dependabot/go_modules/golang-28bf83e400
• dependabot/go_modules/golang-29835453c6
• dependabot/go_modules/golang-2cb2537523
• dependabot/go_modules/golang-2d6cee5bad
• dependabot/go_modules/golang-2f005b8ca9
• dependabot/go_modules/golang-383d838611
• dependabot/go_modules/golang-439c5fc513
• dependabot/go_modules/golang-4dd97b104e
• dependabot/go_modules/golang-51f3cddb77
• dependabot/go_modules/golang-5c8df2ff5e
• dependabot/go_modules/golang-61257cff18
• dependabot/go_modules/golang-6263b2479d
• dependabot/go_modules/golang-6a70725da1
• dependabot/go_modules/golang-7e0ee1aacf
• dependabot/go_modules/golang-82cdb19fbc
• dependabot/go_modules/golang-82e3264b6f
• dependabot/go_modules/golang-8bfbea899d
• dependabot/go_modules/golang-8c40cefe07
• dependabot/go_modules/golang-8f3a99df9e
• dependabot/go_modules/golang-98d539f651
• dependabot/go_modules/golang-9b7ee4a467
• dependabot/go_modules/golang-9fbc68838b
• dependabot/go_modules/golang-a01909eac1
• dependabot/go_modules/golang-a90ed34d00
• dependabot/go_modules/golang-ac7443b549
• dependabot/go_modules/golang-b1fd1a5525
• dependabot/go_modules/golang-b711640f48
• dependabot/go_modules/golang-c05031af0a
• dependabot/go_modules/golang-c722575f0f
• dependabot/go_modules/golang-cbe0ec1090
• dependabot/go_modules/golang-db9f2d353e
• dependabot/go_modules/golang-e423e5d544
• dependabot/go_modules/golang-e5a06e9046
• dependabot/go_modules/golang-efff583b38
• dependabot/go_modules/golang-f04424bbb8
• dependabot/go_modules/golang-f1c86e0e78
• dependabot/go_modules/golang-f6d18035b1
• dependabot/go_modules/golang-fb115483cc
• dependabot/go_modules/golang-fd31490dbe
• dependabot/go_modules/golang.org/x/net-0.17.0
• dependabot/go_modules/golang.org/x/net-0.23.0
• dependabot/go_modules/golang.org/x/net-0.36.0
• dependabot/go_modules/golang.org/x/net-0.38.0
• dependabot/go_modules/golang.org/x/net-0.55.0
• dependabot/go_modules/golang.org/x/sys-0.10.0
• dependabot/go_modules/golang.org/x/sys-0.11.0
• dependabot/go_modules/golang.org/x/sys-0.13.0
• dependabot/go_modules/golang.org/x/sys-0.4.0
• dependabot/go_modules/golang.org/x/sys-0.5.0
• dependabot/go_modules/golang.org/x/sys-0.7.0
• dependabot/go_modules/golang.org/x/sys-0.8.0
• dependabot/go_modules/golang.org/x/sys-0.9.0
• dependabot/go_modules/google.golang.org/grpc-1.56.3
• dependabot/go_modules/google.golang.org/grpc-1.79.3
• dependabot/go_modules/google.golang.org/grpc-1.82.1
• dependabot/go_modules/google.golang.org/protobuf-1.33.0
• dhcp-daemon-terminate-iface-nonexist
• enable-vlan-uplink-interface
• feature/go_version_bump
• feature/group-fwd-mask
• feature/modernize_forvar
• feature/modernize_update
• fix
• fix-bw-nil
• fix-dhcp-release-issue-1278
• fix-firewall-ci
• fix-integ-tests
• fix-long-hostvethname
• fix-portmap_nftables
• fix-unshare
• fix-windows-ginko
• fix/dhcp-suppress-gateway
• fix/portmap
• fix/portmap-del-flush-conntrack
• fix/vrf-del-idempotent
• fix/vrf-ipv6-ecmp-default-route
• fix_bridge_test_linux7
• fix_dhcp_ipam_release
• fixdad
• fixglobalroutes
• fixvlantrunk
• fixvrfglobalroutes
• go-1.25
• go-mod-separate
• go-mod-verify
• go-version
• go1.24
• host-device
• host-device-l3-info
• increatetimeoutvrf
• ingress-same-bridge-isolate
• jell/per_if_sysctl
• jell/vlan-1
• jell/vlan-2
• keeponaddripv6
• macvlan/stop-setting-proxy-arp
• main
• master
• multiple_routes_same_prefix1
• new-maintainers
• oif_rule
• patch-1
• pin-actions-to-sha
• portmap-last-write-wins
• refs/tags/v0.9.0
• refs/tags/v0.9.1
• refs/tags/v1.0.0
• refs/tags/v1.0.0-rc1
• refs/tags/v1.0.1
• refs/tags/v1.1.0
• refs/tags/v1.1.1
• refs/tags/v1.2.0
• refs/tags/v1.4.0
• refs/tags/v1.4.1
• refs/tags/v1.5.0
• refs/tags/v1.5.1
• release-1.1
• remove-bryan
• remove-release-sh2
• retry
• revert_c1069bd
• scorecard
• setpreservedefaultvlanfalse
• test-ipam-ecmp1
• v0.8.2
• v0.8.3
• v0.8.4
• v0.8.5
• v0.8.6
• v0.8.7
• wip-remove-dup
• xuxiaowei/loong64
• zerofix

Build # 29903823545

Build Type

Pull #1281

github

Committed by thomasferrandiz

Commit Message

fix: fall back to binary presence when netfilter capability checks both fail

SupportsNFTables() runs `nft --check` via exec, which requires
CAP_NET_ADMIN even for a dry run. On systems where iptables is absent
but that capability is unavailable at detection time, both
SupportsIPTables() and SupportsNFTables() return false, causing
ensureBackend() and SetupIPMasqForNetworks() to unconditionally default
to iptables — which then also fails.

Add IPTablesBinaryAvailable() and NFTablesBinaryAvailable() (LookPath
only, no kernel access required) as a second detection tier. When both
full checks fail, binary presence breaks the tie: if the iptables binary
is absent but nft is present, select the nftables backend.

Signed-off-by: Thomas Ferrandiz <thomas.ferrandiz@suse.com>

Pull Request Pull Request #1281: fix: fall back to binary presence when netfilter capability checks both fails

Coverage Stats

12 of 31 new or added lines in 3 files covered. (38.71%)

5014 of 9551 relevant lines covered (52.5%)

27.78 hits per line