From 8f68ca8bdc6c6abc8c149a9d3d967714cea2b464 Mon Sep 17 00:00:00 2001 From: Alessandro Boch Date: Mon, 10 Oct 2016 11:56:03 -0700 Subject: [PATCH] Run API check to assert xfrm modules - When docker is run inside a container, the infrastructure needed by modprobe is not always available, causing the xfrm module load to fail even when these modules are already loaded or builtin in the kernel. - In case of probe failure, before declaring the failure, run an API check by attempting the creation of a NETLINK_XFRM socket. Signed-off-by: Alessandro Boch --- ns/init_linux.go | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/ns/init_linux.go b/ns/init_linux.go index 78529c7fbe..dd31f3e7e7 100644 --- a/ns/init_linux.go +++ b/ns/init_linux.go @@ -69,8 +69,10 @@ func NlHandle() *netlink.Handle { func getSupportedNlFamilies() []int { fams := []int{syscall.NETLINK_ROUTE} if err := loadXfrmModules(); err != nil { - log.Warnf("Could not load necessary modules for IPSEC rules: %v", err) - return fams + if checkXfrmSocket() != nil { + log.Warnf("Could not load necessary modules for IPSEC rules: %v", err) + return fams + } } return append(fams, syscall.NETLINK_XFRM) } @@ -84,3 +86,13 @@ func loadXfrmModules() error { } return nil } + +// API check on required xfrm modules (xfrm_user, xfrm_algo) +func checkXfrmSocket() error { + fd, err := syscall.Socket(syscall.AF_NETLINK, syscall.SOCK_RAW, syscall.NETLINK_XFRM) + if err != nil { + return err + } + syscall.Close(fd) + return nil +}