{"record":{"id":"3fabc4b0a46c6c5c","repo":"OpenNHP/opennhp","slug":"s-3fabc4","errorCode":null,"errorMessage":"%s","messagePattern":"%s","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/utils/iptables.go","lineNumber":473,"sourceCode":"\t}\n\treturn name\n}\n\nfunc (ipset *IPSet) Run(ctx context.Context, args ...string) (string, error) {\n\tc := make(chan string)\n\tdefer close(c)\n\tvar stderr bytes.Buffer\n\tvar stdout bytes.Buffer\n\n\tcmd := exec.CommandContext(ctx, ipset.Binary, args...)\n\tcmd.Stderr = &stderr\n\tcmd.Stdout = &stdout\n\terr := cmd.Run()\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tif stderr.String() != \"\" {\n\t\treturn \"\", fmt.Errorf(\"%s\", stderr.String())\n\t}\n\treturn stdout.String(), nil\n}\n","sourceCodeStart":455,"sourceCodeEnd":477,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/utils/iptables.go#L455-L477","documentation":"The Run helper in nhp/utils/iptables.go executes an iptables command via os/exec and treats any non-empty stderr as a command failure, wrapping stderr verbatim ('%s'). So this error message carries the raw iptables stderr output, e.g. permission denied, chain not found, or bad rule syntax. Callers (Add) get it whenever the iptables binary exits 0 but wrote to stderr, or fails with stderr content.","triggerScenarios":"iptables not installed (command lookup failure surfaces separately); running without root (stderr: 'Permission denied (you must be root)'); referencing a missing chain; malformed rule arguments; iptables binary present but exiting with stderr diagnostics.","commonSituations":"Deploying nhp-ac in an unprivileged container without NET_ADMIN capability; missing iptables binaries on minimal images (need iptables-legacy vs nft); rule strings built from bad config values.","solutions":["Run the process as root or grant NET_ADMIN capability (docker --cap-add=NET_ADMIN)","Verify iptables/nft iptables is installed and the correct backend (iptables-legacy vs iptables-nft)","Inspect the returned stderr text — it is the literal iptables diagnostic — and fix the rule arguments","Pre-validate rule parameters (IPs/ports) before invoking"],"exampleFix":"// before\nout, err := Run(\"iptables\", \"-A\", chain, \"-p\", proto, \"-s\", badIP, \"-j\", \"DROP\")\n// after\nif net.ParseIP(badIP) == nil { return fmt.Errorf(\"invalid rule ip %q\", badIP) }\nout, err := Run(\"iptables\", \"-A\", chain, \"-p\", proto, \"-s\", badIP, \"-j\", \"DROP\")","handlingStrategy":"try-catch","validationCode":"if _, err := exec.LookPath(\"iptables\"); err != nil { return fmt.Errorf(\"iptables not installed\") }","typeGuard":null,"tryCatchPattern":"out, err := iptables.Run(args...); if err != nil { log.Error(\"iptables failed: %s\", err.Error()) /* stderr text embedded */; return err }","preventionTips":["Run daemons needing iptables as root or with NET_ADMIN capability","Verify iptables backend (legacy vs nft) on the target image","Log the returned error verbatim — it contains iptables' own stderr","Validate rule IPs/ports before building commands"],"tags":["iptables","exec","firewall","linux"],"backgroundTag":"iptables-command-failed","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}