1. docker
  2. Commit e3f3259e006e955d2a280d9f37451b5813657b4a
Browse code

Merge pull request #9271 from jfrazelle/iptables-errors

Typed errors for iptables chain raw command output. YAYYYYYY.

Alexander Morozov authored on 2014/11/21 12:03:38
Showing 2 changed files
daemon/networkdriver/bridge/driver.go
History View file @ e3f3259
... ... 
@@ -195,7 +195,7 @@ func setupIPTables(addr net.Addr, icc, ipmasq bool) error {
195 195 
 			if output, err := iptables.Raw(append([]string{"-I"}, natArgs...)...); err != nil {
196 196 
 				return fmt.Errorf("Unable to enable network bridge NAT: %s", err)
197 197 
 			} else if len(output) != 0 {
198 
-				return fmt.Errorf("Error iptables postrouting: %s", output)
198 
+				return &iptables.ChainError{Chain: "POSTROUTING", Output: output}
199 199 
 			}
200 200 
 		}
201 201 
 	}
... ... 
@@ -236,7 +236,7 @@ func setupIPTables(addr net.Addr, icc, ipmasq bool) error {
236 236 
 		if output, err := iptables.Raw(append([]string{"-I"}, outgoingArgs...)...); err != nil {
237 237 
 			return fmt.Errorf("Unable to allow outgoing packets: %s", err)
238 238 
 		} else if len(output) != 0 {
239 
-			return fmt.Errorf("Error iptables allow outgoing: %s", output)
239 
+			return &iptables.ChainError{Chain: "FORWARD outgoing", Output: output}
240 240 
 		}
241 241 
 	}
242 242
... ... 
@@ -247,7 +247,7 @@ func setupIPTables(addr net.Addr, icc, ipmasq bool) error {
247 247 
 		if output, err := iptables.Raw(append([]string{"-I"}, existingArgs...)...); err != nil {
248 248 
 			return fmt.Errorf("Unable to allow incoming packets: %s", err)
249 249 
 		} else if len(output) != 0 {
250 
-			return fmt.Errorf("Error iptables allow incoming: %s", output)
250 
+			return &iptables.ChainError{Chain: "FORWARD incoming", Output: output}
251 251 
 		}
252 252 
 	}
253 253 
 	return nil
pkg/iptables/iptables.go
History View file @ e3f3259
... ... 
@@ -20,9 +20,9 @@ const (
20 20 
 )
21 21
22 22 
 var (
23 
-	ErrIptablesNotFound = errors.New("Iptables not found")
24 23 
 	nat                 = []string{"-t", "nat"}
25 24 
 	supportsXlock       = false
25 
+	ErrIptablesNotFound = errors.New("Iptables not found")
26 26 
 )
27 27
28 28 
 type Chain struct {
... ... 
@@ -30,6 +30,15 @@ type Chain struct {
30 30 
 	Bridge string
31 31 
 }
32 32
33 
+type ChainError struct {
34 
+	Chain  string
35 
+	Output []byte
36 
+}
37 
+
38 
+func (e *ChainError) Error() string {
39 
+	return fmt.Sprintf("Error iptables %s: %s", e.Chain, string(e.Output))
40 
+}
41 
+
33 42 
 func init() {
34 43 
 	supportsXlock = exec.Command("iptables", "--wait", "-L", "-n").Run() == nil
35 44 
 }
... ... 
@@ -78,7 +87,7 @@ func (c *Chain) Forward(action Action, ip net.IP, port int, proto, dest_addr str
78 78 
 		"--to-destination", net.JoinHostPort(dest_addr, strconv.Itoa(dest_port))); err != nil {
79 79 
 		return err
80 80 
 	} else if len(output) != 0 {
81 
-		return fmt.Errorf("Error iptables forward: %s", output)
81 
+		return &ChainError{Chain: "FORWARD", Output: output}
82 82 
 	}
83 83
84 84 
 	fAction := action
... ... 
@@ -94,7 +103,7 @@ func (c *Chain) Forward(action Action, ip net.IP, port int, proto, dest_addr str
94 94 
 		"-j", "ACCEPT"); err != nil {
95 95 
 		return err
96 96 
 	} else if len(output) != 0 {
97 
-		return fmt.Errorf("Error iptables forward: %s", output)
97 
+		return &ChainError{Chain: "FORWARD", Output: output}
98 98 
 	}
99 99
100 100 
 	return nil
... ... 
@@ -108,7 +117,7 @@ func (c *Chain) Prerouting(action Action, args ...string) error {
108 108 
 	if output, err := Raw(append(a, "-j", c.Name)...); err != nil {
109 109 
 		return err
110 110 
 	} else if len(output) != 0 {
111 
-		return fmt.Errorf("Error iptables prerouting: %s", output)
111 
+		return &ChainError{Chain: "PREROUTING", Output: output}
112 112 
 	}
113 113 
 	return nil
114 114 
 }
... ... 
@@ -121,7 +130,7 @@ func (c *Chain) Output(action Action, args ...string) error {
121 121 
 	if output, err := Raw(append(a, "-j", c.Name)...); err != nil {
122 122 
 		return err
123 123 
 	} else if len(output) != 0 {
124 
-		return fmt.Errorf("Error iptables output: %s", output)
124 
+		return &ChainError{Chain: "OUTPUT", Output: output}
125 125 
 	}
126 126 
 	return nil
127 127 
 }