From 92c5e25557b610dd02b1ba6871b42809d2c3d440 Mon Sep 17 00:00:00 2001 From: Debian Date: Thu, 4 Jun 2026 22:17:34 +0200 Subject: [PATCH] =?UTF-8?q?test(firewall):=20nft=20-c-Check=20via=20sudo?= =?UTF-8?q?=20lauff=C3=A4hig=20machen=20(netlink=20braucht=20root)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit nft -c liest den Kernel-Ruleset-Cache via netlink → root nötig. Test nutzt nun sudo -n (sonst skip). Verifiziert: gerendertes Dual-Stack-Ruleset (v4+v6-Regeln, v6-DNAT [..]:port, v6-SNAT/Masquerade, icmpv6) ist mit nft v1.1.3 syntaktisch gültig. Co-Authored-By: Claude Opus 4.8 (1M context) --- internal/firewall/firewall_ipv6_test.go | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/internal/firewall/firewall_ipv6_test.go b/internal/firewall/firewall_ipv6_test.go index dc5141f..37e9f0d 100644 --- a/internal/firewall/firewall_ipv6_test.go +++ b/internal/firewall/firewall_ipv6_test.go @@ -163,8 +163,21 @@ func TestTemplate_nftSyntax(t *testing.T) { t.Fatal(err) } f.Close() - cmd := exec.Command(nft, "-c", "-f", f.Name()) - if combined, err := cmd.CombinedOutput(); err != nil { + // `nft -c` liest die Kernel-Ruleset-Cache via netlink → braucht root. + // Als nicht-root via sudo -n versuchen; klappt das nicht, skip statt fail + // (auf den Nodes rendert/prüft edgeguard ohnehin als root). + var cmd *exec.Cmd + if os.Geteuid() == 0 { + cmd = exec.Command(nft, "-c", "-f", f.Name()) + } else { + cmd = exec.Command("sudo", "-n", nft, "-c", "-f", f.Name()) + } + combined, err := cmd.CombinedOutput() + if err != nil { + msg := string(combined) + if strings.Contains(msg, "Operation not permitted") || strings.Contains(msg, "a password is required") || strings.Contains(msg, "may not run sudo") { + t.Skipf("nft -c needs root (no usable sudo): %s", strings.TrimSpace(msg)) + } t.Fatalf("nft -c -f rejected the generated ruleset: %v\n%s\n----\n%s", err, combined, out) } }