You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It seems like in the function runWithOutput the iptables path is erroneously prepended to the list of args, resulting in some methods failing unexpectedly, as in the example below. I've only tested Exists so far. The solution is to simply remove the prepended iptables path, everything seems to work correctly this way.
Using go-iptables:
cmd /usr/sbin/iptables [/usr/sbin/iptables -t filter -C INPUT -m set --match-set some-unexisting-set src -j DROP --wait]
running [/usr/sbin/iptables -t filter -C INPUT -m set --match-set some-unexisting-set src -j DROP --wait]: exit status 2: iptables v1.8.4 (legacy): Couldn't load match ` set --match-set':No such file or directory
Try `iptables -h' or 'iptables --help' for more information.Using exec.Command without repetition:running [/usr/sbin/iptables /usr/sbin/iptables -t filter -C INPUT -m set --match-set some-unexisting-set src -j DROP --wait]: exit status 2: iptables v1.8.4 (legacy): Set some-unexisting-set doesn't exist.Try `iptables -h' or 'iptables --help' for more information.
Please note "Couldn't load match ` set --match-set':No such file or directory" vs "Set some-unexisting-set doesn't exist." in the error.
The text was updated successfully, but these errors were encountered:
gianni4sec
changed the title
Bug: prepending iptables path to list of args in runCommandWithOutput makes some commands fail unexpectedly
[BUG] Prepending iptables path to list of args in runWithOutput makes some commands fail unexpectedly
Jul 27, 2023
gianni4sec
changed the title
[BUG] Prepending iptables path to list of args in runWithOutput makes some commands fail unexpectedly
[BUG] Prepending iptables path to list of args in runWithOutput makes some methods fail unexpectedly
Jul 27, 2023
Argument 0 to any Unix process is the name of the program being executed, but the kernel does not handle that automatically. So it's correct and conventional that we're specifying the program name twice: once as the file to be executed, and once as its argument 0.
The actual problem is that in the good case, you're specifying -mset--match-set as three different arguments, but in the bad case you're incorrectly specifying -m set --match-set as a single argument. This is indicated in the error message you received. (You're also doing the same with -j DROP.)
Description of the issue
It seems like in the function
runWithOutput
the iptables path is erroneously prepended to the list of args, resulting in some methods failing unexpectedly, as in the example below. I've only testedExists
so far. The solution is to simply remove the prepended iptables path, everything seems to work correctly this way.go-iptables/iptables/iptables.go
Lines 521 to 522 in fa6abe8
Then further down in the same function:
go-iptables/iptables/iptables.go
Lines 544 to 549 in fa6abe8
How to reproduce
Example:
Output:
Please note "Couldn't load match ` set --match-set':No such file or directory" vs "Set some-unexisting-set doesn't exist." in the error.
The text was updated successfully, but these errors were encountered: