GNU bug report logs - #78352
[PATCH] services: Modernize and test nftables service.

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: guix-patches; Reported by: Maxim Cournoyer <maxim.cournoyer@HIDDEN>; Keywords: patch; Done: Maxim Cournoyer <maxim.cournoyer@HIDDEN>; Maintainer for guix-patches is guix-patches@HIDDEN.
bug closed, send any further explanations to 78352 <at> debbugs.gnu.org and Maxim Cournoyer <maxim.cournoyer@HIDDEN> Request was from Maxim Cournoyer <maxim.cournoyer@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at 78352 <at> debbugs.gnu.org:


Received: (at 78352) by debbugs.gnu.org; 13 May 2025 13:05:53 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue May 13 09:05:53 2025
Received: from localhost ([127.0.0.1]:58629 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1uEpKT-00050P-A8
	for submit <at> debbugs.gnu.org; Tue, 13 May 2025 09:05:53 -0400
Received: from cotopaxi.ee.ethz.ch ([129.132.148.196]:51571)
 by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
 (Exim 4.84_2) (envelope-from <gabriel@HIDDEN>)
 id 1uEpKP-000504-L0
 for 78352 <at> debbugs.gnu.org; Tue, 13 May 2025 09:05:50 -0400
Received: from blackbox (212-51-128-25.fiber7.init7.net [212.51.128.25])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits)
 server-digest SHA256) (Client did not present a certificate)
 (Authenticated sender: gabriel)
 by cotopaxi.ee.ethz.ch (Postfix) with ESMTPSA id 4BD661FF54;
 Tue, 13 May 2025 15:05:38 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=erlikon.ch; s=20250312;
 t=1747141538;
 h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
 to:to:cc:mime-version:mime-version:content-type:content-type:
 content-transfer-encoding:content-transfer-encoding;
 bh=6m+4mueUCtTNTUwqZ4n+MnA7MCWiHWkbfUZHo7ic1Eg=;
 b=CRtswAmMRlfmV0vlCLiJqRPtgbXH0HJ3Xh1NtyVt/iYaGUFooBQEd3Fza+rWSVKdRO1fAW
 Ark6NtJn/DCL2F/H2Ahwlke/+1e7gt8c4rz7eoLiF1dbBbd74h/MbIKz5dXhdgu5AuTZTH
 wW70GOARpl2/WdZp45pfn5VIZK7TLYMPGwf32TEZiYlouySKH/7D8ydyr2Y6u9BY8Sc5Tv
 BcMsTfIhBp49ZBJuxOECG0saSwQAp7H9h4YRWpgKKfBsFXxvugp9xGvAVizzjBHpWBbwKb
 WXf8RmIq3PSIiAp3bst9BX9NVhGpXkP77mdaBKGygf/pz147YgE8FSXb7GTmLzzyAG8Ubu
 bd8oKplQMT/6nJPRWplqyVj2XSXukCJGUSLAOE/jGX3WCsoGzSpjKM0I0HmOomJ+CS3B8b
 qcjLsyAhq2vYK+AQC/q/kEHGFB+5ncCeneDEL67BPvWkalS6matd+ntrFRAzWe3Fj+ZnsP
 EkxyawgqzTpycGxiNYsDn1rq8+9l0TC7ajuZEYxXA+dpoPGmc2R15mHQvQl4+Mk9Fo5PJA
 PMpp+wfT9djB/kDKiC4EKp7YgjqGHl0eKAZL2IZiKAP+1CcCrPY/ka8NsC4p+V58wGDBQJ
 KG8BlLLMd+j5BdodLOtIHVQYpEMvLEA3wFp+jMq1kJDykk0zNt0V8=
Date: Tue, 13 May 2025 15:05:35 +0200
From: Gabriel Wicki <gabriel@HIDDEN>
To: maxim.cournoyer@HIDDEN, 78352 <at> debbugs.gnu.org
Subject: Patch broken
Message-ID: <xjikqyktsu2tbsfvjdepdjypq4ijx3oaoohvmaoubjtjczs5qn@h3nrwqbr74kw>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 78352
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Hi Maxim

After some pointer on our IRC i figured it only took a simple rebase to
re-trigger the build of this patch but i seem to be unable to apply it
locally, either.  My attempt fails the same way as QA:

> 128 git … apply -- /home/gabriel/g/my-patches/mcourn-nftables.patch                              
> error: patch fragment without header at line 21: @@ -2345,6 +2345,16 @@                          
> (define-configuration/no-serialization nftables-configuration 

Would you mind sending in an updated patch?

TIA
gabber




Information forwarded to guix-patches@HIDDEN:
bug#78352; Package guix-patches. Full text available.

Message received at 78352 <at> debbugs.gnu.org:


Received: (at 78352) by debbugs.gnu.org; 12 May 2025 19:35:18 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon May 12 15:35:18 2025
Received: from localhost ([127.0.0.1]:54942 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1uEYvl-0005LT-DO
	for submit <at> debbugs.gnu.org; Mon, 12 May 2025 15:35:18 -0400
Received: from cotopaxi.ee.ethz.ch ([129.132.148.196]:52329)
 by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
 (Exim 4.84_2) (envelope-from <gabriel@HIDDEN>)
 id 1uEYvb-0005Ej-HF
 for 78352 <at> debbugs.gnu.org; Mon, 12 May 2025 15:35:08 -0400
Received: from silvi (212-51-128-25.fiber7.init7.net [212.51.128.25])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits)
 server-digest SHA256) (Client did not present a certificate)
 (Authenticated sender: gabriel)
 by cotopaxi.ee.ethz.ch (Postfix) with ESMTPSA id 93A16200C9;
 Mon, 12 May 2025 21:35:00 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=erlikon.ch; s=20250312;
 t=1747078500;
 h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
 to:to:cc:cc:mime-version:mime-version:content-type:content-type:
 in-reply-to:in-reply-to:references:references;
 bh=s5BKSOMm2tb7ZYQWr2Vc4HBWljp8tfX4D7LZw3qi1Gg=;
 b=aYj8zNXW4GoiqC7GezF56kaxpKBC/S0sRdpxauy+YOTTIj5plRxi2qJRJmOmRbFVht6Gxc
 IvHb2DxKN6+QRTQHn6/oiEQiHjg0HLJj/nkbBZ9yQ1QAjYbDTITnk5DcWNfREOg+OpKmEM
 /2EZIJFra2KF0j6wJY8nbtL5IpbMo/M67YwqgAxOxWITqwhOKm+ngl433fAtSnFoY5rUY4
 4k2IyRU0JGr/KeZ3tzaGtqtBWxIIP8X0wZR9xdtNqvv0nwDGE+7itXDGXOmPdsRv9BAw3p
 hA8DdU8iIa+ARL0G9dEmaPR8T4mrV91xPLMe+SI16CBgZO+tcXt2QCIxL5Z7Nu/h67TPhL
 /d41k0X++s3RtQzqY11iXUg2bzSdcf0defez5gNy2j5TAs/baKC7ib9bPouK96zhsAPUYH
 CB6pbal00ghN7kt87Ie7n8xJy7Sxr71G1Rg3xHWlRaWPNdmsnsJoCqMpa6zQZsPAAnPDa3
 l53sVUm9dRA53GSfoKMmMqySi6B/xuSwCm6JEV1r0gdUPtmbrDJxKlKjXxwknG4myRn12s
 xCdW00gCPe1W1uCydpyOxq97UhDWWAgQF/70yBvvtkaGN+3I/RweqIoenY8Jcr2wy8k8nX
 IdFgr1huZqXA0+MMAyeQMjvCtAkM0DEQJNqlnYpXL2zQ6ADe81U3A=
Date: Mon, 12 May 2025 21:34:57 +0200
From: Gabriel Wicki <gabriel@HIDDEN>
To: Maxim Cournoyer <maxim.cournoyer@HIDDEN>
Subject: Re: [bug#78352] [PATCH] services: Modernize and test nftables service.
Message-ID: <qrfhs4nc7ur54l2cuxzgvjc5fhj6tsf3jb35ji4lyafjrvhko7@56zovoqrtakd>
References: <37e412829b5f21d5affc1c14876b98f9b3ec109b.1746887623.git.maxim.cournoyer@HIDDEN>
 <6jmho2zdwmv4a27b2o3ssl3d3t6cdc2fexdj72hvczkrvk77gl@vxx4m35nfhbm>
 <87r00ung3e.fsf@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <87r00ung3e.fsf@HIDDEN>
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 78352
Cc: Ludovic Court??s <ludo@HIDDEN>, 78352 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

for whatever reason QA uses the wrong commit as base:
f348d2be2e019fcda44af8ab81073e2f04697a38
vs.
e923c73403b6e0dc888c12c2eaaef450bcdbb632

no idea why that happens, though..




Information forwarded to guix-patches@HIDDEN:
bug#78352; Package guix-patches. Full text available.

Message received at 78352 <at> debbugs.gnu.org:


Received: (at 78352) by debbugs.gnu.org; 12 May 2025 12:55:46 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon May 12 08:55:46 2025
Received: from localhost ([127.0.0.1]:51356 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1uESh8-0003DW-GR
	for submit <at> debbugs.gnu.org; Mon, 12 May 2025 08:55:46 -0400
Received: from mail-pf1-x42f.google.com ([2607:f8b0:4864:20::42f]:52363)
 by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
 (Exim 4.84_2) (envelope-from <maxim.cournoyer@HIDDEN>)
 id 1uESh4-0003D9-T5
 for 78352 <at> debbugs.gnu.org; Mon, 12 May 2025 08:55:43 -0400
Received: by mail-pf1-x42f.google.com with SMTP id
 d2e1a72fcca58-74068f95d9fso3973909b3a.0
 for <78352 <at> debbugs.gnu.org>; Mon, 12 May 2025 05:55:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1747054537; x=1747659337; darn=debbugs.gnu.org;
 h=mime-version:user-agent:message-id:date:references:in-reply-to
 :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to;
 bh=rK4ButGcO1GIhntw1JEJ/Toc9uEmI2ffc5k9qPUhU10=;
 b=BaGNtilAcmqplFdATx/j1fQzgFSaLCqvHO90zYH/SC3cWa8ulsPtWWrmzmSan5xhmr
 Az78XHb1jCbAHaAEBQ82F4zSfe6DDCXDiK/ZusKf38juZRjORs1c/DXUVfO2RH/ulwfH
 6nScguSiu1iHmHxK7EYfyL8EzqyOHu308NWQksBpFsjm1u/msZBxs3waq4D4Wp5wSkE/
 hGkNeuLuPlaWw3RyrsF3rljHwA0mlixCTm4m0IevnzJQIVMJ5jGhHE+mZHEx8avYN+bn
 0S0n6rNVjxxVX0J0hyOnhhzWwI4UvAssfjmVArHq3WKOfN51nVRC3UtZ4sUVL6A1yex8
 scZA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1747054537; x=1747659337;
 h=mime-version:user-agent:message-id:date:references:in-reply-to
 :subject:cc:to:from:x-gm-message-state:from:to:cc:subject:date
 :message-id:reply-to;
 bh=rK4ButGcO1GIhntw1JEJ/Toc9uEmI2ffc5k9qPUhU10=;
 b=YZiiMLpFu5YGccCT+G904dKjO/3q8oc10g28/rtHImhsN8n/WSM9BT1DXwk2L0TZBo
 iQ4HuobGIXmIDM2k6yosFD3bLEXu+3Q5/JxcSxf0KKU5uH4C4ZZph7AzTr6+P3ZP8YiU
 S5EBVOpmuRiclyI5xsjtKsVGmbSGVaO7CjVUyQM/pgMvsSkWa/A0J1CoxtKK/XDz3Osu
 8jR2xWMgpRrjKtdvR/hAlQHAsqsxhA6iZxWyT0/Y5+f+SPNVN9kPX0j4v2jyaxhbZxu2
 VLPbh/gbAuE3ZqOvOCnFw76HW9kYvGifCiYT/F+oHzq31UmFQmVOlegC6duxHUBOvLLP
 qPUQ==
X-Gm-Message-State: AOJu0Yw5u3pLYI6ObZhTmvfV5ufln5qNnVQCU+oRtTshKRSu5JQwu7wx
 Ied2YYV42wbEmAvFPq0y3dF6TCBNTP7rdkcYPjDeauqaQkGRpB6E
X-Gm-Gg: ASbGncvXf9NLyE/Cab7E4VQYp5WAKr8eXRBT1QyH3q6gGodpf94LdABRBWEFdEfAnKn
 I3szoszVJ05GBM8qCDfzmewt+47LC18p+V5odvvKR61bNssuMZSy53Gad7lN+SDD63OZGOxSNap
 t/3CKA/gDiz9vzAEZs1gNsSxVOSfJQlkJ6cI2qKJQihsIESdnqfpjo28bRUoAmCZ1oGMutGWsTw
 ysme/65Gs5eUHOPDovmMTSwBH/EWvJLoNAL9L+mbHu83SSfe5rv02TkZO2l7QMBlmxbLDHILe+U
 mlkWy4mt1VX/y+7zdNhVqrlsE26nFcgvsPjUFgVZU/q0BXQvHvlCZaaflyM5
X-Google-Smtp-Source: AGHT+IFVMnlgW4Ek0hXGtVSChYbY2rqQx/gTgMM54kGoOdxEQpAZnWiPL87SxshD0daXuKGoGp6syw==
X-Received: by 2002:a17:90b:3f04:b0:308:539d:7577 with SMTP id
 98e67ed59e1d1-30c3b915960mr23344437a91.0.1747054536769; 
 Mon, 12 May 2025 05:55:36 -0700 (PDT)
Received: from terra ([2405:6586:be0:0:83c8:d31d:2cec:f542])
 by smtp.gmail.com with ESMTPSA id
 98e67ed59e1d1-30ad4d2f1e8sm8856703a91.11.2025.05.12.05.55.35
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Mon, 12 May 2025 05:55:36 -0700 (PDT)
From: Maxim Cournoyer <maxim.cournoyer@HIDDEN>
To: Gabriel Wicki <gabriel@HIDDEN>
Subject: Re: [bug#78352] [PATCH] services: Modernize and test nftables service.
In-Reply-To: <6jmho2zdwmv4a27b2o3ssl3d3t6cdc2fexdj72hvczkrvk77gl@vxx4m35nfhbm>
 (Gabriel Wicki's message of "Mon, 12 May 2025 13:59:51 +0200")
References: <37e412829b5f21d5affc1c14876b98f9b3ec109b.1746887623.git.maxim.cournoyer@HIDDEN>
 <6jmho2zdwmv4a27b2o3ssl3d3t6cdc2fexdj72hvczkrvk77gl@vxx4m35nfhbm>
Date: Mon, 12 May 2025 21:55:33 +0900
Message-ID: <87r00ung3e.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
Content-Type: text/plain
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 78352
Cc: Ludovic Court??s <ludo@HIDDEN>, 78352 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Hi Gabriel,

Gabriel Wicki <gabriel@HIDDEN> writes:

> Hello Maxim
>
> This is the first time I read code from / for gnu/tests but AFAICT this
> looks good.  Not sure what it takes for QA to apply your patch and
> assure the quality - maybe you do?

I'm not sure too.  I know that Bayfront is having disk space
issues at the moment, so that could be that.

-- 
Thanks,
Maxim




Information forwarded to guix-patches@HIDDEN:
bug#78352; Package guix-patches. Full text available.

Message received at 78352 <at> debbugs.gnu.org:


Received: (at 78352) by debbugs.gnu.org; 12 May 2025 12:00:15 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon May 12 08:00:15 2025
Received: from localhost ([127.0.0.1]:50970 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1uERpP-000074-5b
	for submit <at> debbugs.gnu.org; Mon, 12 May 2025 08:00:15 -0400
Received: from cotopaxi.ee.ethz.ch ([129.132.148.196]:43683)
 by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
 (Exim 4.84_2) (envelope-from <gabriel@HIDDEN>)
 id 1uERpL-0008Sm-FV
 for 78352 <at> debbugs.gnu.org; Mon, 12 May 2025 08:00:13 -0400
Received: from coney (mob-194-230-148-150.cgn.sunrise.net [194.230.148.150])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits)
 server-digest SHA256) (Client did not present a certificate)
 (Authenticated sender: gabriel)
 by cotopaxi.ee.ethz.ch (Postfix) with ESMTPSA id 5DF911FF2B;
 Mon, 12 May 2025 14:00:00 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=erlikon.ch; s=20250312;
 t=1747051200;
 h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
 to:to:cc:cc:mime-version:mime-version:content-type:content-type:
 in-reply-to:in-reply-to:references:references;
 bh=cf86xRR8Hr27hSFMrQBkMhlqHs0fCvva053awwnmde0=;
 b=kZsswmhjQIVpnsXj4VckGveeUR6YgAytCpmor03noXmYwjG5KYJXhHADSMRHshLX/itDvl
 TD9+d71nAZUiEWmS92I+Y2Ne5m3nDOcc4cftgmm34pQ4Bh/LX+1zMAERL0A4GLos8ULvef
 VY45kF7mmWc43ghW+tFUtPwDUbtcai8XXY/JyOynHQ/iOhQQp/LEiFa4IrdYk5CMmJ0lTE
 EhanpS4O4YTu1aEZgcO1zzmOf+TdtAk+F6LKC0/ML1tpwXemB7iGPN7Jq8ERQQQzaZSfvt
 BjfbMJX9Pz5K9k3mREDaXWWPkik7KvgixI3CebhfSp19w1lBPVs6vs7tMtKyfdC+ijUTz1
 XQPX09jvGmfRf34VNo2QXafYA7RwaG+iNOXu6riqi5RJQC3S6qQNq6T6baRnEQYAyWTQD/
 mWe6BWegVzqZRRREy8uVYZwF3WNsX+e6fWltX/FCGi5tgrSYofnkZwQM/AATfiSeHCqzeb
 37dCg98Mf19PqfdiWlO6eWdH7eDu7jaTl0nzL9r0Svv5vaj0yXEdetY0hQ+kmV9GO0fSNg
 pTSoqo0l/SLJvJ9OQAAy6rxqvgP5ezSzprQ8IACoJftPwXS/ErDPCnvqNJ2RPCBhV/E7NS
 mvNT8OILr12qO0/Fb2bIdXfGZY6RAghIrmmRF9BM6EO6rHeU3Tz/4=
Date: Mon, 12 May 2025 13:59:51 +0200
From: Gabriel Wicki <gabriel@HIDDEN>
To: Maxim Cournoyer <maxim.cournoyer@HIDDEN>
Subject: Re: [bug#78352] [PATCH] services: Modernize and test nftables service.
Message-ID: <6jmho2zdwmv4a27b2o3ssl3d3t6cdc2fexdj72hvczkrvk77gl@vxx4m35nfhbm>
References: <37e412829b5f21d5affc1c14876b98f9b3ec109b.1746887623.git.maxim.cournoyer@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <37e412829b5f21d5affc1c14876b98f9b3ec109b.1746887623.git.maxim.cournoyer@HIDDEN>
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 78352
Cc: Ludovic Court??s <ludo@HIDDEN>, 78352 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Hello Maxim

This is the first time I read code from / for gnu/tests but AFAICT this
looks good.  Not sure what it takes for QA to apply your patch and
assure the quality - maybe you do?

Thanks for your time and effort.
gabber




Information forwarded to guix-patches@HIDDEN:
bug#78352; Package guix-patches. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 10 May 2025 14:36:43 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat May 10 10:36:42 2025
Received: from localhost ([127.0.0.1]:47849 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1uDlJe-0004uj-7B
	for submit <at> debbugs.gnu.org; Sat, 10 May 2025 10:36:42 -0400
Received: from lists.gnu.org ([2001:470:142::17]:56342)
 by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.84_2) (envelope-from <maxim.cournoyer@HIDDEN>)
 id 1uDlJa-0004uQ-O0
 for submit <at> debbugs.gnu.org; Sat, 10 May 2025 10:36:36 -0400
Received: from eggs.gnu.org ([2001:470:142:3::10])
 by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <maxim.cournoyer@HIDDEN>)
 id 1uDlJO-0005rj-55
 for guix-patches@HIDDEN; Sat, 10 May 2025 10:36:23 -0400
Received: from mail-qt1-x82e.google.com ([2607:f8b0:4864:20::82e])
 by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
 (Exim 4.90_1) (envelope-from <maxim.cournoyer@HIDDEN>)
 id 1uDlJK-0004DT-PA
 for guix-patches@HIDDEN; Sat, 10 May 2025 10:36:21 -0400
Received: by mail-qt1-x82e.google.com with SMTP id
 d75a77b69052e-477282401b3so33626871cf.1
 for <guix-patches@HIDDEN>; Sat, 10 May 2025 07:36:17 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1746887776; x=1747492576; darn=gnu.org;
 h=content-transfer-encoding:mime-version:message-id:date:subject:cc
 :to:from:from:to:cc:subject:date:message-id:reply-to;
 bh=0r55fj6PeusgrC+2/tLd5ZXUK60gxS+VE5fmgWbv5F8=;
 b=MzyWLr8PXddP3gjTBd2Mgc5VfV5yEkhrgaA118mKlzqSVRbEsxPg56C03w1Dna8opl
 +3Dh1sNXtFpOSMnRPudLSiLGqzh1+DH9LVnLMEFg6LWFM8nvRBFLG7PVrC7dxf5rO16j
 Aqf0WNfV9LI5y4eSZPz0qH93mvV3S4HZKGsq8RoSQKBZyyJwwtoR4VPZM7C+9FXhQil2
 BHgdFOcb6HNJXJ1M15Fp92p6IuUcq20oe/r0mRz4jjJdufom1no/h3PPAeCiMwroSLZh
 Xb2jWl6ExT61HYp9re3W+vz5uF+3S65kOYiDBtMXp42iYTBq8ddcOXs+4SfexnIaE86A
 fIQQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1746887776; x=1747492576;
 h=content-transfer-encoding:mime-version:message-id:date:subject:cc
 :to:from:x-gm-message-state:from:to:cc:subject:date:message-id
 :reply-to;
 bh=0r55fj6PeusgrC+2/tLd5ZXUK60gxS+VE5fmgWbv5F8=;
 b=jgjunh5CDgQFJvHkwsQulyylExB53belOSq1Npw4tvnVyfgSwnOk74w0zXH8jNspxb
 Poudkfk7ox+ggyiDAeBjdCGow3UErJVF98WyVpiEKdj3mfpToSsVl9nirToAQhvs0nP4
 HLKeml+lSlOkyXguK2ptXU7RsEIlMuqS/PyhZYIzqhBljoqBQK6t/5Dg1IBGNZFvIRUQ
 RYJDyd3etY5oSQ993zpgUPmsU/18OBICq0acJXYAVuNd54nszXgi6A1bjVSCvZQH+csB
 rgJjMQhhpaXjFErpS81gEkSK3AEoSmgaakT+XnizoAMIB7VAxAmNDkhvpfJyeCl9+ErC
 O8Xw==
X-Gm-Message-State: AOJu0YysMcEzp9g4GGIewVsCLPOSui1iiyHC2XOZn8rlgPzGUEUD1OAL
 pHDN/PgMncMeqsZxvqUBnUUQpoOyaLhcCbj1TOiFH3YoING7bUnyoBt+HQ==
X-Gm-Gg: ASbGnctxbuzZ0cXWhHv46CzOEvuRiZgRSL/RWw9m1RwKaLfX+YCvlkPP/rlIPdw8JCw
 vWSjsckIoU5kHg3BZv+lYrujjNmYV/kRcB2EcSFBQeHWGyTyZhJK+Y2LVtEoJwIW9c9p8r/bYpF
 4uB1Duji+v0jZ5wfr2TxttvjYu2kjA5GEOJNnfJb5D+1UDeXz2MYiksbUOq+hx3IVOFXlNpkf2W
 lPMrL9/xPNn+Ff8lle9L/dGiFV2pPIf6zcWsoXnxWFCEnT9Dl4aRuQGSQFmHlWHIvDGZP91GgIW
 1W70DpCk6BwISK4cPy1DHgXflbKlgGGTLgDxQ+8GXS6HDYpSydHVhZpqplZPlbe9k+0DRA0=
X-Google-Smtp-Source: AGHT+IEpSM/h7TPpeTHz6ReJ82XaPVslABaZaymf6YzHMaElvwu0mBB8fgH+Dh09pSmxMxEKJVAYUA==
X-Received: by 2002:a05:6a00:1a8f:b0:736:4644:86ee with SMTP id
 d2e1a72fcca58-7423be70255mr9585047b3a.14.1746887765596; 
 Sat, 10 May 2025 07:36:05 -0700 (PDT)
Received: from localhost.localdomain ([2405:6586:be0:0:83c8:d31d:2cec:f542])
 by smtp.gmail.com with ESMTPSA id
 d2e1a72fcca58-74237a38bf3sm3377932b3a.133.2025.05.10.07.36.03
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Sat, 10 May 2025 07:36:04 -0700 (PDT)
From: Maxim Cournoyer <maxim.cournoyer@HIDDEN>
To: guix-patches@HIDDEN
Subject: [PATCH] services: Modernize and test nftables service.
Date: Sat, 10 May 2025 23:33:44 +0900
Message-ID: <37e412829b5f21d5affc1c14876b98f9b3ec109b.1746887623.git.maxim.cournoyer@HIDDEN>
X-Mailer: git-send-email 2.49.0
MIME-Version: 1.0
X-Debbugs-Cc: Gabriel Wicki <gabriel@HIDDEN>, Ludovic Courtès <ludo@HIDDEN>, Maxim Cournoyer <maxim.cournoyer@HIDDEN>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Received-SPF: pass client-ip=2607:f8b0:4864:20::82e;
 envelope-from=maxim.cournoyer@HIDDEN; helo=mail-qt1-x82e.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,
 RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: submit
Cc: Maxim Cournoyer <maxim.cournoyer@HIDDEN>
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -0.0 (/)

* doc/guix.texi (Networking Services) <nftables>: Update doc.
* gnu/services/networking.scm (list-of-debug-levels?):
(debug-level?, maybe-list-of-debug-levels?):
(nftables-configuration): Rewrite using `define-configuration'.
[debug-levels]: New field.
(nftables-shepherd-service): Honor it.
* gnu/tests/networking.scm (%inetd-echo-port): Extract to top level.
(run-iptables-test): Adjust accordingly.
(make-nftables-os): New procedure.
(%default-nftables-ruleset-for-tests): New variable.
(%nftables-os): Likewise.
(%test-nftables): New test.

Change-Id: I2889603342ff6d2be6261c3de6e4fddd9a9bbe2d
---

I investigated to also have a validated ruleset file done in a
computed-file:

modified   gnu/services/networking.scm
@@ -2345,6 +2345,16 @@ (define-configuration/no-serialization nftables-configuration
 ruleset rejects all incoming connections except those to TCP port 22, with
 connections from the loopback interface are allowed."))
 
+(define (validated-ruleset nft ruleset)
+  "Check the nftables RULESET.  Return a build error in case RULESET is not
+valid, else a computed-file object of the validated RULESET."
+  (computed-file "nftables.conf"
+                 (with-imported-modules '((guix build utils))
+                   #~(begin
+                       (use-modules (guix build utils))
+                       (invoke #+nft "--check" "--file" #$ruleset)
+                       (copy-file #$ruleset #$output)))))
+
 (define (nftables-shepherd-service config)
   (match-record config <nftables-configuration>
                 (package debug-levels ruleset)
@@ -2359,8 +2369,8 @@ (define (nftables-shepherd-service config)
                                  (list (format #f "--debug=~{~a~^,~}"
                                                debug-levels))
                                  #~())
-                          "--file" #$ruleset)))
+                          "--file" #+(validated-ruleset nft ruleset))))
        (stop #~(lambda _
                  (invoke #$nft "flush" "ruleset")))))))

but 'nft' is not happy to run in the Guix build
environment:

  building /gnu/store/g4czvsmaccx181h395hp4992i0y3rqqx-nftables.conf.drv...
  netlink: Error: cache initialization failed: Operation not permitted

 doc/guix.texi               |  40 +++++++++----
 gnu/services/networking.scm |  49 +++++++++++-----
 gnu/tests/networking.scm    | 113 ++++++++++++++++++++++++++++++++++--
 3 files changed, 172 insertions(+), 30 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 889eab2ab35..2f0cd117a03 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -22606,32 +22606,48 @@ Networking Services
 @end deftp
 
 @cindex nftables
+@cindex firewall, nftables
 @defvar nftables-service-type
-This is the service type to set up a nftables configuration.  nftables is a
-netfilter project that aims to replace the existing iptables, ip6tables,
+This is the service type to set up a nftables configuration.  nftables
+is a netfilter project that aims to replace the iptables, ip6tables,
 arptables and ebtables framework.  It provides a new packet filtering
-framework, a new user-space utility @command{nft}, and a compatibility layer
-for iptables.  This service comes with a default ruleset
-@code{%default-nftables-ruleset} that rejecting all incoming connections
-except those to the ssh port 22.  To use it, simply write:
+framework, a new user-space utility @command{nft}, and a compatibility
+layer for iptables.  This service comes with a default ruleset,
+@code{%default-nftables-ruleset}, that rejects all incoming connections
+except those to the SSH port 22 (TCP).  To use it, simply write:
 
 @lisp
 (service nftables-service-type)
 @end lisp
 @end defvar
 
+@c %start of fragment
+
 @deftp {Data Type} nftables-configuration
-The data type representing the configuration of nftables.
+Available @code{nftables-configuration} fields are:
 
 @table @asis
-@item @code{package} (default: @code{nftables})
-The nftables package that provides @command{nft}.
-@item @code{ruleset} (default: @code{%default-nftables-ruleset})
-The nftables ruleset to use.  This may be any ``file-like'' object
-(@pxref{G-Expressions, file-like objects}).
+@item @code{package} (default: @code{nftables}) (type: file-like)
+The @code{nftables} package to use.
+
+@item @code{debug-levels} (type: maybe-list-of-debug-levels)
+A list of debug levels, for enabling debugging output.  Valid debug
+level values are the @samp{scanner}, @samp{parser}, @samp{eval},
+@samp{netlink}, @samp{mnl}, @samp{proto-ctx}, @samp{segtree} or
+@samp{all} symbols.
+
+@item @code{ruleset} (type: file-like)
+A file-like object containing the complete nftables ruleset.  The
+default ruleset rejects all incoming connections except those to TCP
+port 22, with connections from the loopback interface are allowed.
+
 @end table
+
 @end deftp
 
+
+@c %end of fragment
+
 @cindex NTP (Network Time Protocol), service
 @cindex ntpd, service for the Network Time Protocol daemon
 @cindex real time clock
diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 67653e2cbf5..8b7bf668927 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -10,7 +10,7 @@
 ;;; Copyright © 2018 Chris Marusich <cmmarusich@HIDDEN>
 ;;; Copyright © 2018 Arun Isaac <arunisaac@HIDDEN>
 ;;; Copyright © 2019 Florian Pelz <pelzflorian@HIDDEN>
-;;; Copyright © 2019, 2021, 2024 Maxim Cournoyer <maxim.cournoyer@HIDDEN>
+;;; Copyright © 2019, 2021, 2024, 2025 Maxim Cournoyer <maxim.cournoyer@HIDDEN>
 ;;; Copyright © 2019 Sou Bunnbu <iyzsong@HIDDEN>
 ;;; Copyright © 2019 Alex Griffin <a@HIDDEN>
 ;;; Copyright © 2020 Brice Waegeneire <brice@HIDDEN>
@@ -80,6 +80,7 @@ (define-module (gnu services networking)
   #:use-module (srfi srfi-9)
   #:use-module (srfi srfi-26)
   #:use-module (srfi srfi-43)
+  #:use-module (ice-9 format)
   #:use-module (ice-9 match)
   #:use-module (ice-9 string-fun)
   #:use-module (json)
@@ -258,6 +259,7 @@ (define-module (gnu services networking)
             nftables-configuration
             nftables-configuration?
             nftables-configuration-package
+            nftables-configuration-debug-levels
             nftables-configuration-ruleset
             %default-nftables-ruleset
 
@@ -2279,12 +2281,12 @@ (define iptables-service-type
                              (compose list iptables-shepherd-service))))))
 
 ;;;
-;;; nftables
+;;; nftables.
 ;;;
 
 (define %default-nftables-ruleset
-  (plain-file "nftables.conf"
-              "# A simple and safe firewall
+  (plain-file "nftables.conf" "\
+# A simple and safe firewall
 table inet filter {
   chain input {
     type filter hook input priority 0; policy drop;
@@ -2320,25 +2322,44 @@ (define %default-nftables-ruleset
 }
 "))
 
-(define-record-type* <nftables-configuration>
-  nftables-configuration
-  make-nftables-configuration
-  nftables-configuration?
-  (package nftables-configuration-package
-           (default nftables))
-  (ruleset nftables-configuration-ruleset ; file-like object
-           (default %default-nftables-ruleset)))
+(define (debug-level? x)
+  (member x '(scanner parser eval netlink mnl proto-ctx segtree all)))
+
+(define list-of-debug-levels?
+  (list-of debug-level?))
+
+(define-maybe/no-serialization list-of-debug-levels)
+
+(define-configuration/no-serialization nftables-configuration
+  (package
+    (file-like nftables)
+    "The @code{nftables} package to use.")
+  (debug-levels
+   maybe-list-of-debug-levels
+   "A list of debug levels, for enabling debugging output.  Valid debug level values
+are the @samp{scanner}, @samp{parser}, @samp{eval}, @samp{netlink},
+@samp{mnl}, @samp{proto-ctx}, @samp{segtree} or @samp{all} symbols.")
+  (ruleset
+   (file-like %default-nftables-ruleset)
+   "A file-like object containing the complete nftables ruleset.  The default
+ruleset rejects all incoming connections except those to TCP port 22, with
+connections from the loopback interface are allowed."))
 
 (define (nftables-shepherd-service config)
   (match-record config <nftables-configuration>
-    (package ruleset)
+                (package debug-levels ruleset)
     (let ((nft (file-append package "/sbin/nft")))
       (shepherd-service
        (documentation "Packet filtering and classification")
        (actions (list (shepherd-configuration-action ruleset)))
        (provision '(nftables))
        (start #~(lambda _
-                  (invoke #$nft "--file" #$ruleset)))
+                  (invoke #$nft
+                          #$@(if (maybe-value-set? debug-levels)
+                                 (list (format #f "--debug=~{~a~^,~}"
+                                               debug-levels))
+                                 #~())
+                          "--file" #$ruleset)))
        (stop #~(lambda _
                  (invoke #$nft "flush" "ruleset")))))))
 
diff --git a/gnu/tests/networking.scm b/gnu/tests/networking.scm
index 7d54ebba50e..d3966d5f0da 100644
--- a/gnu/tests/networking.scm
+++ b/gnu/tests/networking.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2018 Arun Isaac <arunisaac@HIDDEN>
 ;;; Copyright © 2021 Maxime Devos <maximedevos@HIDDEN>
 ;;; Copyright © 2021, 2023-2024 Ludovic Courtès <ludo@HIDDEN>
+;;; Copyright © 2025 Maxim Cournoyer <maxim.cournoyer@HIDDEN>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -28,6 +29,7 @@ (define-module (gnu tests networking)
   #:use-module (gnu services)
   #:use-module (gnu services base)
   #:use-module (gnu services networking)
+  #:use-module (gnu services ssh)
   #:use-module (guix gexp)
   #:use-module (guix store)
   #:use-module (guix monads)
@@ -48,6 +50,7 @@ (define-module (gnu tests networking)
             %test-dhcpcd
             %test-tor
             %test-iptables
+            %test-nftables
             %test-ipfs))
 
 
@@ -870,6 +873,8 @@ (define %test-tor
    (description "Test a running Tor daemon configuration.")
    (value (run-tor-test))))
 
+(define %inetd-echo-port 7)
+
 (define* (run-iptables-test)
   "Run tests of 'iptables-service-type'."
   (define iptables-rules
@@ -890,8 +895,6 @@ (define* (run-iptables-test)
 COMMIT
 ")
 
-  (define inetd-echo-port 7)
-
   (define os
     (marionette-operating-system
      (simple-operating-system
@@ -967,7 +970,8 @@ (define* (run-iptables-test)
 
           (test-error "iptables firewall blocks access to inetd echo service"
                       'misc-error
-                      (wait-for-tcp-port inetd-echo-port marionette #:timeout 5))
+                      (wait-for-tcp-port #$%inetd-echo-port marionette
+                                         #:timeout 5))
 
           ;; TODO: This test freezes up at the login prompt without any
           ;; relevant messages on the console. Perhaps it is waiting for some
@@ -979,7 +983,7 @@ (define* (run-iptables-test)
           ;;         (use-modules (gnu services herd))
           ;;         (stop-service 'iptables))
           ;;      marionette)
-          ;;     (wait-for-tcp-port inetd-echo-port marionette #:timeout 5)))
+          ;;     (wait-for-tcp-port #$%inetd-echo-port marionette #:timeout 5)))
 
           (test-end))))
 
@@ -991,6 +995,107 @@ (define %test-iptables
    (description "Test a running iptables daemon.")
    (value (run-iptables-test))))
 
+
+;;;
+;;; nftables.
+;;;
+
+(define (make-nftables-os ruleset)
+  (simple-operating-system
+   (service dhcp-client-service-type)
+   (service inetd-service-type
+            (inetd-configuration
+             (entries (list
+                       (inetd-entry
+                        (name "echo")
+                        (socket-type 'stream)
+                        (protocol "tcp")
+                        (wait? #f)
+                        (user "root"))))))
+   (service openssh-service-type)
+   (service nftables-service-type
+            (nftables-configuration
+             (debug-levels '(all))
+             (ruleset ruleset)))))
+
+(define %default-nftables-ruleset-for-tests
+  ;; This is like the %default-nftables-ruleset, but without allowing any
+  ;; connections from the loopback interface.
+  (plain-file "nftables.conf" "\
+table inet filter {
+  chain input {
+    type filter hook input priority 0; policy drop;
+
+    # early drop of invalid connections
+    ct state invalid drop
+
+    # allow established/related connections
+    ct state { established, related } accept
+
+    # allow from loopback
+    # iif lo accept   # COMMENTED OUT FOR TESTS
+    # drop connections to lo not coming from lo
+    iif != lo ip daddr 127.0.0.1/8 drop
+    iif != lo ip6 daddr ::1/128 drop
+
+    # allow icmp
+    ip protocol icmp accept
+    ip6 nexthdr icmpv6 accept
+
+    # allow ssh
+    tcp dport ssh accept
+
+    # reject everything else
+    reject with icmpx type port-unreachable
+  }
+  chain forward {
+    type filter hook forward priority 0; policy drop;
+  }
+  chain output {
+    type filter hook output priority 0; policy accept;
+  }
+}"))
+
+(define %nftables-os
+  (make-nftables-os %default-nftables-ruleset-for-tests))
+
+(define (run-nftables-test)
+  (define os
+    (marionette-operating-system
+     %nftables-os
+     #:imported-modules '((gnu services herd))
+     #:requirements '(inetd nftables ssh)))
+
+  (define test
+    (with-imported-modules '((gnu build marionette))
+      #~(begin
+          (use-modules (gnu build marionette)
+                       (srfi srfi-64))
+          (define marionette
+            (make-marionette (list #$(virtual-machine os))))
+
+          (test-runner-current (system-test-runner #$output))
+          (test-begin "nftables")
+
+          (test-error "nftables blocks access to inetd echo service"
+                      'misc-error
+                      (wait-for-tcp-port #$%inetd-echo-port marionette
+                                         #:timeout 5))
+
+          (test-assert "nftables allows access to SSH TCP port 22"
+            (wait-for-tcp-port 22 marionette))
+
+          (test-end))))
+
+  (gexp->derivation "nftables-test" test))
+
+(define %test-nftables
+  (system-test
+   (name "nftables")
+   (description "Tests that an error is raised when attempting build an OS
+with an invalid nftables ruleset file.")
+   (value (run-nftables-test))))
+
 
 ;;;
 ;;; IPFS service

base-commit: f348d2be2e019fcda44af8ab81073e2f04697a38
-- 
2.49.0





Acknowledgement sent to Maxim Cournoyer <maxim.cournoyer@HIDDEN>:
New bug report received and forwarded. Copy sent to gabriel@HIDDEN, ludo@HIDDEN, maxim.cournoyer@HIDDEN, guix-patches@HIDDEN. Full text available.
Report forwarded to gabriel@HIDDEN, ludo@HIDDEN, maxim.cournoyer@HIDDEN, guix-patches@HIDDEN:
bug#78352; Package guix-patches. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Mon, 26 May 2025 13:30:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.