{"record":{"id":"e53b8522ea2b3601","repo":"netbirdio/netbird","slug":"create-acl-manager-w","errorCode":null,"errorMessage":"create acl manager: %w","messagePattern":"create acl manager: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":67,"sourceCode":"func Create(wgIface iFaceMapper, mtu uint16) (*Manager, error) {\n\tiptablesClient, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"init iptables: %w\", err)\n\t}\n\n\tm := &Manager{\n\t\twgIface:    wgIface,\n\t\tipv4Client: iptablesClient,\n\t}\n\n\tm.router, err = newRouter(iptablesClient, wgIface, mtu)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create router: %w\", err)\n\t}\n\n\tm.aclMgr, err = newAclManager(iptablesClient, wgIface)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create acl manager: %w\", err)\n\t}\n\n\tif wgIface.Address().HasIPv6() {\n\t\tif err := m.createIPv6Components(wgIface, mtu); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"create IPv6 firewall: %w\", err)\n\t\t}\n\t}\n\n\treturn m, nil\n}\n\nfunc (m *Manager) createIPv6Components(wgIface iFaceMapper, mtu uint16) error {\n\tip6Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv6)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"init ip6tables: %w\", err)\n\t}\n\tm.ipv6Client = ip6Client\n","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L49-L85","documentation":"Wraps newAclManager during Manager creation. newAclManager in the current source is a pure struct initializer (maps, ipsetStore, v6 flag from the client's protocol) and always returns a nil error, so this wrap cannot fire on stock builds. Its real work, cleanChains and createDefaultChains, happens later in init() with its own wrapped errors.","triggerScenarios":"Unreachable in the present implementation (newAclManager returns nil error). Would only fire on forks/older trees where the constructor performed fallible setup such as chain creation.","commonSituations":"Encountering it indicates a modified build or version mismatch between compiled files; the analogous real failures at this stage come from iptables.NewWithProtocol (error 494) or later init() errors.","solutions":["Verify you are running an unmodified, consistently built binary (the wrap and the constructor must match).","If on a fork, move any fallible setup out of the constructor into init() where errors are meaningfully wrapped, or fix the underlying iptables/privilege cause.","Check root and iptables availability since those gate the surrounding creation steps."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// newAclManager is a pure initializer on stock builds; nothing to pre-validate.\n// For forks that add fallible constructor work, pre-check iptables availability:\nif _, err := exec.LookPath(\"iptables\"); err != nil {\n    return err\n}","typeGuard":null,"tryCatchPattern":"if _, err := iptablesMgr.Create(wgIface, mtu); err != nil {\n    if strings.Contains(err.Error(), \"create acl manager\") {\n        // stock code cannot produce this: suspect version skew or a fork\n        log.Errorf(\"unexpected acl manager construction failure: %v\", err)\n    }\n}","preventionTips":["Keep newAclManager allocation-only; put environment-touching work in init().","Rebuild fully from one commit so compiled constructor and wrap sites match.","If you maintain a fork, add a real error path with context instead of relying on the generic wrap."],"tags":["go","linux","iptables","firewall","startup","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}