{"record":{"id":"a4a26e96a32d8581","repo":"jdx/mise","slug":"firewall-backend-requires-command","errorCode":null,"errorMessage":"firewall backend '{}' requires command '{}'","messagePattern":"firewall backend '(.+?)' requires command '(.+?)'","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/firewall.rs","lineNumber":993,"sourceCode":"        }\n    }\n    for backend in [\n        FirewallBackend::Nftables,\n        FirewallBackend::Firewalld,\n        FirewallBackend::Ufw,\n    ] {\n        if backend_available(backend) {\n            return Ok(backend);\n        }\n    }\n    bail!(\"no supported firewall backend found (tried nft, firewall-cmd, and ufw)\")\n}\n\nfn ensure_backend_available(backend: FirewallBackend) -> Result<()> {\n    if backend_available(backend) {\n        Ok(())\n    } else {\n        bail!(\n            \"firewall backend '{}' requires command '{}'\",\n            backend.label(),\n            backend.program().unwrap_or_default()\n        )\n    }\n}\n\nfn backend_available(backend: FirewallBackend) -> bool {\n    backend.program().and_then(crate::file::which).is_some()\n}\n\nfn backend_active(backend: FirewallBackend) -> bool {\n    match backend {\n        FirewallBackend::Nftables => command_output(\"nft\", &[\"list\", \"table\", \"inet\", NFT_TABLE])\n            .is_ok_and(|output| output.status.success()),\n        FirewallBackend::Firewalld => {\n            command_output(\"firewall-cmd\", &[\"--state\"]).is_ok_and(|output| output.status.success())\n        }","sourceCodeStart":975,"sourceCodeEnd":1011,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/firewall.rs#L975-L1011","documentation":"This error fires when the selected firewall backend's underlying CLI program (nft, ufw, or firewall-cmd) is not found on the system. The library checks for the executable before attempting any firewall mutation and fails fast with the backend label and expected command name so the developer knows what to install. It is a preflight dependency check, not a command execution failure.","triggerScenarios":"Calling firewall apply/ensure_backend_available with a FirewallBackend whose program (per backend.program()) is absent from PATH, e.g. backend ufw on a host without the ufw binary installed.","commonSituations":"Running bootstrap on a minimal container or cloud image that ships no firewall CLI; selecting backend = \"firewalld\" on a Debian host where only ufw is installed; PATH is stripped in a systemd unit or cron context so the binary is not found.","solutions":["Install the CLI the backend requires (nft for nftables, ufw for ufw, firewall-cmd for firewalld).","Select a backend whose command is already installed in the request's backend field.","Verify PATH inside the execution context (systemd unit, container, cron) includes the directory containing the command.","Check backend_available / run `which nft` etc. before invoking the API to fail early in your own code."],"exampleFix":"// before\nlet request = FirewallRequest { backend: FirewallBackend::Firewalld, .. };\napply(&request, false, true)?; // fails: firewalld requires command 'firewall-cmd'\n// after\n// install firewalld (or switch backend)\nlet request = FirewallRequest { backend: FirewallBackend::Nftables, .. };\napply(&request, false, true)?;","handlingStrategy":"validation","validationCode":"fn backend_ready(backend: FirewallBackend) -> bool {\n    match backend.program() {\n        Some(program) => std::process::Command::new(program).arg(\"--version\").output().is_ok(),\n        None => false,\n    }\n}","typeGuard":null,"tryCatchPattern":"match ensure_backend_available(backend) {\n    Err(e) => eprintln!(\"install the backend CLI first: {e}\"),\n    Ok(()) => apply(&request, false, true)?,\n}","preventionTips":["Check backend_available before constructing requests","Pin backend selection to what the host image ships","Assert PATH contents in service/container contexts","Document required packages per backend in deployment docs"],"tags":["firewall","missing-dependency","cli"],"backgroundTag":"missing-dependency","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}