Maxim Cournoyer <maxim.cournoyer@HIDDEN>
to control <at> debbugs.gnu.org
.
Full text available.Received: (at 78352) by debbugs.gnu.org; 13 May 2025 13:05:53 +0000 From debbugs-submit-bounces <at> debbugs.gnu.org Tue May 13 09:05:53 2025 Received: from localhost ([127.0.0.1]:58629 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>) id 1uEpKT-00050P-A8 for submit <at> debbugs.gnu.org; Tue, 13 May 2025 09:05:53 -0400 Received: from cotopaxi.ee.ethz.ch ([129.132.148.196]:51571) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from <gabriel@HIDDEN>) id 1uEpKP-000504-L0 for 78352 <at> debbugs.gnu.org; Tue, 13 May 2025 09:05:50 -0400 Received: from blackbox (212-51-128-25.fiber7.init7.net [212.51.128.25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: gabriel) by cotopaxi.ee.ethz.ch (Postfix) with ESMTPSA id 4BD661FF54; Tue, 13 May 2025 15:05:38 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=erlikon.ch; s=20250312; t=1747141538; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6m+4mueUCtTNTUwqZ4n+MnA7MCWiHWkbfUZHo7ic1Eg=; b=CRtswAmMRlfmV0vlCLiJqRPtgbXH0HJ3Xh1NtyVt/iYaGUFooBQEd3Fza+rWSVKdRO1fAW Ark6NtJn/DCL2F/H2Ahwlke/+1e7gt8c4rz7eoLiF1dbBbd74h/MbIKz5dXhdgu5AuTZTH wW70GOARpl2/WdZp45pfn5VIZK7TLYMPGwf32TEZiYlouySKH/7D8ydyr2Y6u9BY8Sc5Tv BcMsTfIhBp49ZBJuxOECG0saSwQAp7H9h4YRWpgKKfBsFXxvugp9xGvAVizzjBHpWBbwKb WXf8RmIq3PSIiAp3bst9BX9NVhGpXkP77mdaBKGygf/pz147YgE8FSXb7GTmLzzyAG8Ubu bd8oKplQMT/6nJPRWplqyVj2XSXukCJGUSLAOE/jGX3WCsoGzSpjKM0I0HmOomJ+CS3B8b qcjLsyAhq2vYK+AQC/q/kEHGFB+5ncCeneDEL67BPvWkalS6matd+ntrFRAzWe3Fj+ZnsP EkxyawgqzTpycGxiNYsDn1rq8+9l0TC7ajuZEYxXA+dpoPGmc2R15mHQvQl4+Mk9Fo5PJA PMpp+wfT9djB/kDKiC4EKp7YgjqGHl0eKAZL2IZiKAP+1CcCrPY/ka8NsC4p+V58wGDBQJ KG8BlLLMd+j5BdodLOtIHVQYpEMvLEA3wFp+jMq1kJDykk0zNt0V8= Date: Tue, 13 May 2025 15:05:35 +0200 From: Gabriel Wicki <gabriel@HIDDEN> To: maxim.cournoyer@HIDDEN, 78352 <at> debbugs.gnu.org Subject: Patch broken Message-ID: <xjikqyktsu2tbsfvjdepdjypq4ijx3oaoohvmaoubjtjczs5qn@h3nrwqbr74kw> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 78352 X-BeenThere: debbugs-submit <at> debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: <debbugs-submit.debbugs.gnu.org> List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe> List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/> List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org> List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help> List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe> Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org> X-Spam-Score: -1.0 (-) Hi Maxim After some pointer on our IRC i figured it only took a simple rebase to re-trigger the build of this patch but i seem to be unable to apply it locally, either. My attempt fails the same way as QA: > 128 git … apply -- /home/gabriel/g/my-patches/mcourn-nftables.patch > error: patch fragment without header at line 21: @@ -2345,6 +2345,16 @@ > (define-configuration/no-serialization nftables-configuration Would you mind sending in an updated patch? TIA gabber
guix-patches@HIDDEN
:bug#78352
; Package guix-patches
.
Full text available.Received: (at 78352) by debbugs.gnu.org; 12 May 2025 19:35:18 +0000 From debbugs-submit-bounces <at> debbugs.gnu.org Mon May 12 15:35:18 2025 Received: from localhost ([127.0.0.1]:54942 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>) id 1uEYvl-0005LT-DO for submit <at> debbugs.gnu.org; Mon, 12 May 2025 15:35:18 -0400 Received: from cotopaxi.ee.ethz.ch ([129.132.148.196]:52329) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from <gabriel@HIDDEN>) id 1uEYvb-0005Ej-HF for 78352 <at> debbugs.gnu.org; Mon, 12 May 2025 15:35:08 -0400 Received: from silvi (212-51-128-25.fiber7.init7.net [212.51.128.25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: gabriel) by cotopaxi.ee.ethz.ch (Postfix) with ESMTPSA id 93A16200C9; Mon, 12 May 2025 21:35:00 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=erlikon.ch; s=20250312; t=1747078500; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=s5BKSOMm2tb7ZYQWr2Vc4HBWljp8tfX4D7LZw3qi1Gg=; b=aYj8zNXW4GoiqC7GezF56kaxpKBC/S0sRdpxauy+YOTTIj5plRxi2qJRJmOmRbFVht6Gxc IvHb2DxKN6+QRTQHn6/oiEQiHjg0HLJj/nkbBZ9yQ1QAjYbDTITnk5DcWNfREOg+OpKmEM /2EZIJFra2KF0j6wJY8nbtL5IpbMo/M67YwqgAxOxWITqwhOKm+ngl433fAtSnFoY5rUY4 4k2IyRU0JGr/KeZ3tzaGtqtBWxIIP8X0wZR9xdtNqvv0nwDGE+7itXDGXOmPdsRv9BAw3p hA8DdU8iIa+ARL0G9dEmaPR8T4mrV91xPLMe+SI16CBgZO+tcXt2QCIxL5Z7Nu/h67TPhL /d41k0X++s3RtQzqY11iXUg2bzSdcf0defez5gNy2j5TAs/baKC7ib9bPouK96zhsAPUYH CB6pbal00ghN7kt87Ie7n8xJy7Sxr71G1Rg3xHWlRaWPNdmsnsJoCqMpa6zQZsPAAnPDa3 l53sVUm9dRA53GSfoKMmMqySi6B/xuSwCm6JEV1r0gdUPtmbrDJxKlKjXxwknG4myRn12s xCdW00gCPe1W1uCydpyOxq97UhDWWAgQF/70yBvvtkaGN+3I/RweqIoenY8Jcr2wy8k8nX IdFgr1huZqXA0+MMAyeQMjvCtAkM0DEQJNqlnYpXL2zQ6ADe81U3A= Date: Mon, 12 May 2025 21:34:57 +0200 From: Gabriel Wicki <gabriel@HIDDEN> To: Maxim Cournoyer <maxim.cournoyer@HIDDEN> Subject: Re: [bug#78352] [PATCH] services: Modernize and test nftables service. Message-ID: <qrfhs4nc7ur54l2cuxzgvjc5fhj6tsf3jb35ji4lyafjrvhko7@56zovoqrtakd> References: <37e412829b5f21d5affc1c14876b98f9b3ec109b.1746887623.git.maxim.cournoyer@HIDDEN> <6jmho2zdwmv4a27b2o3ssl3d3t6cdc2fexdj72hvczkrvk77gl@vxx4m35nfhbm> <87r00ung3e.fsf@HIDDEN> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87r00ung3e.fsf@HIDDEN> X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 78352 Cc: Ludovic Court??s <ludo@HIDDEN>, 78352 <at> debbugs.gnu.org X-BeenThere: debbugs-submit <at> debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: <debbugs-submit.debbugs.gnu.org> List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe> List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/> List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org> List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help> List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe> Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org> X-Spam-Score: -1.0 (-) for whatever reason QA uses the wrong commit as base: f348d2be2e019fcda44af8ab81073e2f04697a38 vs. e923c73403b6e0dc888c12c2eaaef450bcdbb632 no idea why that happens, though..
guix-patches@HIDDEN
:bug#78352
; Package guix-patches
.
Full text available.Received: (at 78352) by debbugs.gnu.org; 12 May 2025 12:55:46 +0000 From debbugs-submit-bounces <at> debbugs.gnu.org Mon May 12 08:55:46 2025 Received: from localhost ([127.0.0.1]:51356 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>) id 1uESh8-0003DW-GR for submit <at> debbugs.gnu.org; Mon, 12 May 2025 08:55:46 -0400 Received: from mail-pf1-x42f.google.com ([2607:f8b0:4864:20::42f]:52363) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from <maxim.cournoyer@HIDDEN>) id 1uESh4-0003D9-T5 for 78352 <at> debbugs.gnu.org; Mon, 12 May 2025 08:55:43 -0400 Received: by mail-pf1-x42f.google.com with SMTP id d2e1a72fcca58-74068f95d9fso3973909b3a.0 for <78352 <at> debbugs.gnu.org>; Mon, 12 May 2025 05:55:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1747054537; x=1747659337; darn=debbugs.gnu.org; h=mime-version:user-agent:message-id:date:references:in-reply-to :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to; bh=rK4ButGcO1GIhntw1JEJ/Toc9uEmI2ffc5k9qPUhU10=; b=BaGNtilAcmqplFdATx/j1fQzgFSaLCqvHO90zYH/SC3cWa8ulsPtWWrmzmSan5xhmr Az78XHb1jCbAHaAEBQ82F4zSfe6DDCXDiK/ZusKf38juZRjORs1c/DXUVfO2RH/ulwfH 6nScguSiu1iHmHxK7EYfyL8EzqyOHu308NWQksBpFsjm1u/msZBxs3waq4D4Wp5wSkE/ hGkNeuLuPlaWw3RyrsF3rljHwA0mlixCTm4m0IevnzJQIVMJ5jGhHE+mZHEx8avYN+bn 0S0n6rNVjxxVX0J0hyOnhhzWwI4UvAssfjmVArHq3WKOfN51nVRC3UtZ4sUVL6A1yex8 scZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1747054537; x=1747659337; h=mime-version:user-agent:message-id:date:references:in-reply-to :subject:cc:to:from:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=rK4ButGcO1GIhntw1JEJ/Toc9uEmI2ffc5k9qPUhU10=; b=YZiiMLpFu5YGccCT+G904dKjO/3q8oc10g28/rtHImhsN8n/WSM9BT1DXwk2L0TZBo iQ4HuobGIXmIDM2k6yosFD3bLEXu+3Q5/JxcSxf0KKU5uH4C4ZZph7AzTr6+P3ZP8YiU S5EBVOpmuRiclyI5xsjtKsVGmbSGVaO7CjVUyQM/pgMvsSkWa/A0J1CoxtKK/XDz3Osu 8jR2xWMgpRrjKtdvR/hAlQHAsqsxhA6iZxWyT0/Y5+f+SPNVN9kPX0j4v2jyaxhbZxu2 VLPbh/gbAuE3ZqOvOCnFw76HW9kYvGifCiYT/F+oHzq31UmFQmVOlegC6duxHUBOvLLP qPUQ== X-Gm-Message-State: AOJu0Yw5u3pLYI6ObZhTmvfV5ufln5qNnVQCU+oRtTshKRSu5JQwu7wx Ied2YYV42wbEmAvFPq0y3dF6TCBNTP7rdkcYPjDeauqaQkGRpB6E X-Gm-Gg: ASbGncvXf9NLyE/Cab7E4VQYp5WAKr8eXRBT1QyH3q6gGodpf94LdABRBWEFdEfAnKn I3szoszVJ05GBM8qCDfzmewt+47LC18p+V5odvvKR61bNssuMZSy53Gad7lN+SDD63OZGOxSNap t/3CKA/gDiz9vzAEZs1gNsSxVOSfJQlkJ6cI2qKJQihsIESdnqfpjo28bRUoAmCZ1oGMutGWsTw ysme/65Gs5eUHOPDovmMTSwBH/EWvJLoNAL9L+mbHu83SSfe5rv02TkZO2l7QMBlmxbLDHILe+U mlkWy4mt1VX/y+7zdNhVqrlsE26nFcgvsPjUFgVZU/q0BXQvHvlCZaaflyM5 X-Google-Smtp-Source: AGHT+IFVMnlgW4Ek0hXGtVSChYbY2rqQx/gTgMM54kGoOdxEQpAZnWiPL87SxshD0daXuKGoGp6syw== X-Received: by 2002:a17:90b:3f04:b0:308:539d:7577 with SMTP id 98e67ed59e1d1-30c3b915960mr23344437a91.0.1747054536769; Mon, 12 May 2025 05:55:36 -0700 (PDT) Received: from terra ([2405:6586:be0:0:83c8:d31d:2cec:f542]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-30ad4d2f1e8sm8856703a91.11.2025.05.12.05.55.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 May 2025 05:55:36 -0700 (PDT) From: Maxim Cournoyer <maxim.cournoyer@HIDDEN> To: Gabriel Wicki <gabriel@HIDDEN> Subject: Re: [bug#78352] [PATCH] services: Modernize and test nftables service. In-Reply-To: <6jmho2zdwmv4a27b2o3ssl3d3t6cdc2fexdj72hvczkrvk77gl@vxx4m35nfhbm> (Gabriel Wicki's message of "Mon, 12 May 2025 13:59:51 +0200") References: <37e412829b5f21d5affc1c14876b98f9b3ec109b.1746887623.git.maxim.cournoyer@HIDDEN> <6jmho2zdwmv4a27b2o3ssl3d3t6cdc2fexdj72hvczkrvk77gl@vxx4m35nfhbm> Date: Mon, 12 May 2025 21:55:33 +0900 Message-ID: <87r00ung3e.fsf@HIDDEN> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 78352 Cc: Ludovic Court??s <ludo@HIDDEN>, 78352 <at> debbugs.gnu.org X-BeenThere: debbugs-submit <at> debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: <debbugs-submit.debbugs.gnu.org> List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe> List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/> List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org> List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help> List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe> Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org> X-Spam-Score: -1.0 (-) Hi Gabriel, Gabriel Wicki <gabriel@HIDDEN> writes: > Hello Maxim > > This is the first time I read code from / for gnu/tests but AFAICT this > looks good. Not sure what it takes for QA to apply your patch and > assure the quality - maybe you do? I'm not sure too. I know that Bayfront is having disk space issues at the moment, so that could be that. -- Thanks, Maxim
guix-patches@HIDDEN
:bug#78352
; Package guix-patches
.
Full text available.Received: (at 78352) by debbugs.gnu.org; 12 May 2025 12:00:15 +0000 From debbugs-submit-bounces <at> debbugs.gnu.org Mon May 12 08:00:15 2025 Received: from localhost ([127.0.0.1]:50970 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>) id 1uERpP-000074-5b for submit <at> debbugs.gnu.org; Mon, 12 May 2025 08:00:15 -0400 Received: from cotopaxi.ee.ethz.ch ([129.132.148.196]:43683) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from <gabriel@HIDDEN>) id 1uERpL-0008Sm-FV for 78352 <at> debbugs.gnu.org; Mon, 12 May 2025 08:00:13 -0400 Received: from coney (mob-194-230-148-150.cgn.sunrise.net [194.230.148.150]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: gabriel) by cotopaxi.ee.ethz.ch (Postfix) with ESMTPSA id 5DF911FF2B; Mon, 12 May 2025 14:00:00 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=erlikon.ch; s=20250312; t=1747051200; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=cf86xRR8Hr27hSFMrQBkMhlqHs0fCvva053awwnmde0=; b=kZsswmhjQIVpnsXj4VckGveeUR6YgAytCpmor03noXmYwjG5KYJXhHADSMRHshLX/itDvl TD9+d71nAZUiEWmS92I+Y2Ne5m3nDOcc4cftgmm34pQ4Bh/LX+1zMAERL0A4GLos8ULvef VY45kF7mmWc43ghW+tFUtPwDUbtcai8XXY/JyOynHQ/iOhQQp/LEiFa4IrdYk5CMmJ0lTE EhanpS4O4YTu1aEZgcO1zzmOf+TdtAk+F6LKC0/ML1tpwXemB7iGPN7Jq8ERQQQzaZSfvt BjfbMJX9Pz5K9k3mREDaXWWPkik7KvgixI3CebhfSp19w1lBPVs6vs7tMtKyfdC+ijUTz1 XQPX09jvGmfRf34VNo2QXafYA7RwaG+iNOXu6riqi5RJQC3S6qQNq6T6baRnEQYAyWTQD/ mWe6BWegVzqZRRREy8uVYZwF3WNsX+e6fWltX/FCGi5tgrSYofnkZwQM/AATfiSeHCqzeb 37dCg98Mf19PqfdiWlO6eWdH7eDu7jaTl0nzL9r0Svv5vaj0yXEdetY0hQ+kmV9GO0fSNg pTSoqo0l/SLJvJ9OQAAy6rxqvgP5ezSzprQ8IACoJftPwXS/ErDPCnvqNJ2RPCBhV/E7NS mvNT8OILr12qO0/Fb2bIdXfGZY6RAghIrmmRF9BM6EO6rHeU3Tz/4= Date: Mon, 12 May 2025 13:59:51 +0200 From: Gabriel Wicki <gabriel@HIDDEN> To: Maxim Cournoyer <maxim.cournoyer@HIDDEN> Subject: Re: [bug#78352] [PATCH] services: Modernize and test nftables service. Message-ID: <6jmho2zdwmv4a27b2o3ssl3d3t6cdc2fexdj72hvczkrvk77gl@vxx4m35nfhbm> References: <37e412829b5f21d5affc1c14876b98f9b3ec109b.1746887623.git.maxim.cournoyer@HIDDEN> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <37e412829b5f21d5affc1c14876b98f9b3ec109b.1746887623.git.maxim.cournoyer@HIDDEN> X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 78352 Cc: Ludovic Court??s <ludo@HIDDEN>, 78352 <at> debbugs.gnu.org X-BeenThere: debbugs-submit <at> debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: <debbugs-submit.debbugs.gnu.org> List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe> List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/> List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org> List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help> List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe> Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org> X-Spam-Score: -1.0 (-) Hello Maxim This is the first time I read code from / for gnu/tests but AFAICT this looks good. Not sure what it takes for QA to apply your patch and assure the quality - maybe you do? Thanks for your time and effort. gabber
guix-patches@HIDDEN
:bug#78352
; Package guix-patches
.
Full text available.Received: (at submit) by debbugs.gnu.org; 10 May 2025 14:36:43 +0000 From debbugs-submit-bounces <at> debbugs.gnu.org Sat May 10 10:36:42 2025 Received: from localhost ([127.0.0.1]:47849 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>) id 1uDlJe-0004uj-7B for submit <at> debbugs.gnu.org; Sat, 10 May 2025 10:36:42 -0400 Received: from lists.gnu.org ([2001:470:142::17]:56342) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from <maxim.cournoyer@HIDDEN>) id 1uDlJa-0004uQ-O0 for submit <at> debbugs.gnu.org; Sat, 10 May 2025 10:36:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from <maxim.cournoyer@HIDDEN>) id 1uDlJO-0005rj-55 for guix-patches@HIDDEN; Sat, 10 May 2025 10:36:23 -0400 Received: from mail-qt1-x82e.google.com ([2607:f8b0:4864:20::82e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from <maxim.cournoyer@HIDDEN>) id 1uDlJK-0004DT-PA for guix-patches@HIDDEN; Sat, 10 May 2025 10:36:21 -0400 Received: by mail-qt1-x82e.google.com with SMTP id d75a77b69052e-477282401b3so33626871cf.1 for <guix-patches@HIDDEN>; Sat, 10 May 2025 07:36:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1746887776; x=1747492576; darn=gnu.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=0r55fj6PeusgrC+2/tLd5ZXUK60gxS+VE5fmgWbv5F8=; b=MzyWLr8PXddP3gjTBd2Mgc5VfV5yEkhrgaA118mKlzqSVRbEsxPg56C03w1Dna8opl +3Dh1sNXtFpOSMnRPudLSiLGqzh1+DH9LVnLMEFg6LWFM8nvRBFLG7PVrC7dxf5rO16j Aqf0WNfV9LI5y4eSZPz0qH93mvV3S4HZKGsq8RoSQKBZyyJwwtoR4VPZM7C+9FXhQil2 BHgdFOcb6HNJXJ1M15Fp92p6IuUcq20oe/r0mRz4jjJdufom1no/h3PPAeCiMwroSLZh Xb2jWl6ExT61HYp9re3W+vz5uF+3S65kOYiDBtMXp42iYTBq8ddcOXs+4SfexnIaE86A fIQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1746887776; x=1747492576; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=0r55fj6PeusgrC+2/tLd5ZXUK60gxS+VE5fmgWbv5F8=; b=jgjunh5CDgQFJvHkwsQulyylExB53belOSq1Npw4tvnVyfgSwnOk74w0zXH8jNspxb Poudkfk7ox+ggyiDAeBjdCGow3UErJVF98WyVpiEKdj3mfpToSsVl9nirToAQhvs0nP4 HLKeml+lSlOkyXguK2ptXU7RsEIlMuqS/PyhZYIzqhBljoqBQK6t/5Dg1IBGNZFvIRUQ RYJDyd3etY5oSQ993zpgUPmsU/18OBICq0acJXYAVuNd54nszXgi6A1bjVSCvZQH+csB rgJjMQhhpaXjFErpS81gEkSK3AEoSmgaakT+XnizoAMIB7VAxAmNDkhvpfJyeCl9+ErC O8Xw== X-Gm-Message-State: AOJu0YysMcEzp9g4GGIewVsCLPOSui1iiyHC2XOZn8rlgPzGUEUD1OAL pHDN/PgMncMeqsZxvqUBnUUQpoOyaLhcCbj1TOiFH3YoING7bUnyoBt+HQ== X-Gm-Gg: ASbGnctxbuzZ0cXWhHv46CzOEvuRiZgRSL/RWw9m1RwKaLfX+YCvlkPP/rlIPdw8JCw vWSjsckIoU5kHg3BZv+lYrujjNmYV/kRcB2EcSFBQeHWGyTyZhJK+Y2LVtEoJwIW9c9p8r/bYpF 4uB1Duji+v0jZ5wfr2TxttvjYu2kjA5GEOJNnfJb5D+1UDeXz2MYiksbUOq+hx3IVOFXlNpkf2W lPMrL9/xPNn+Ff8lle9L/dGiFV2pPIf6zcWsoXnxWFCEnT9Dl4aRuQGSQFmHlWHIvDGZP91GgIW 1W70DpCk6BwISK4cPy1DHgXflbKlgGGTLgDxQ+8GXS6HDYpSydHVhZpqplZPlbe9k+0DRA0= X-Google-Smtp-Source: AGHT+IEpSM/h7TPpeTHz6ReJ82XaPVslABaZaymf6YzHMaElvwu0mBB8fgH+Dh09pSmxMxEKJVAYUA== X-Received: by 2002:a05:6a00:1a8f:b0:736:4644:86ee with SMTP id d2e1a72fcca58-7423be70255mr9585047b3a.14.1746887765596; Sat, 10 May 2025 07:36:05 -0700 (PDT) Received: from localhost.localdomain ([2405:6586:be0:0:83c8:d31d:2cec:f542]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-74237a38bf3sm3377932b3a.133.2025.05.10.07.36.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 May 2025 07:36:04 -0700 (PDT) From: Maxim Cournoyer <maxim.cournoyer@HIDDEN> To: guix-patches@HIDDEN Subject: [PATCH] services: Modernize and test nftables service. Date: Sat, 10 May 2025 23:33:44 +0900 Message-ID: <37e412829b5f21d5affc1c14876b98f9b3ec109b.1746887623.git.maxim.cournoyer@HIDDEN> X-Mailer: git-send-email 2.49.0 MIME-Version: 1.0 X-Debbugs-Cc: Gabriel Wicki <gabriel@HIDDEN>, Ludovic Courtès <ludo@HIDDEN>, Maxim Cournoyer <maxim.cournoyer@HIDDEN> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=2607:f8b0:4864:20::82e; envelope-from=maxim.cournoyer@HIDDEN; helo=mail-qt1-x82e.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Spam-Score: 1.0 (+) X-Debbugs-Envelope-To: submit Cc: Maxim Cournoyer <maxim.cournoyer@HIDDEN> X-BeenThere: debbugs-submit <at> debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: <debbugs-submit.debbugs.gnu.org> List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe> List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/> List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org> List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help> List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe> Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org> X-Spam-Score: -0.0 (/) * doc/guix.texi (Networking Services) <nftables>: Update doc. * gnu/services/networking.scm (list-of-debug-levels?): (debug-level?, maybe-list-of-debug-levels?): (nftables-configuration): Rewrite using `define-configuration'. [debug-levels]: New field. (nftables-shepherd-service): Honor it. * gnu/tests/networking.scm (%inetd-echo-port): Extract to top level. (run-iptables-test): Adjust accordingly. (make-nftables-os): New procedure. (%default-nftables-ruleset-for-tests): New variable. (%nftables-os): Likewise. (%test-nftables): New test. Change-Id: I2889603342ff6d2be6261c3de6e4fddd9a9bbe2d --- I investigated to also have a validated ruleset file done in a computed-file: modified gnu/services/networking.scm @@ -2345,6 +2345,16 @@ (define-configuration/no-serialization nftables-configuration ruleset rejects all incoming connections except those to TCP port 22, with connections from the loopback interface are allowed.")) +(define (validated-ruleset nft ruleset) + "Check the nftables RULESET. Return a build error in case RULESET is not +valid, else a computed-file object of the validated RULESET." + (computed-file "nftables.conf" + (with-imported-modules '((guix build utils)) + #~(begin + (use-modules (guix build utils)) + (invoke #+nft "--check" "--file" #$ruleset) + (copy-file #$ruleset #$output))))) + (define (nftables-shepherd-service config) (match-record config <nftables-configuration> (package debug-levels ruleset) @@ -2359,8 +2369,8 @@ (define (nftables-shepherd-service config) (list (format #f "--debug=~{~a~^,~}" debug-levels)) #~()) - "--file" #$ruleset))) + "--file" #+(validated-ruleset nft ruleset)))) (stop #~(lambda _ (invoke #$nft "flush" "ruleset"))))))) but 'nft' is not happy to run in the Guix build environment: building /gnu/store/g4czvsmaccx181h395hp4992i0y3rqqx-nftables.conf.drv... netlink: Error: cache initialization failed: Operation not permitted doc/guix.texi | 40 +++++++++---- gnu/services/networking.scm | 49 +++++++++++----- gnu/tests/networking.scm | 113 ++++++++++++++++++++++++++++++++++-- 3 files changed, 172 insertions(+), 30 deletions(-) diff --git a/doc/guix.texi b/doc/guix.texi index 889eab2ab35..2f0cd117a03 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -22606,32 +22606,48 @@ Networking Services @end deftp @cindex nftables +@cindex firewall, nftables @defvar nftables-service-type -This is the service type to set up a nftables configuration. nftables is a -netfilter project that aims to replace the existing iptables, ip6tables, +This is the service type to set up a nftables configuration. nftables +is a netfilter project that aims to replace the iptables, ip6tables, arptables and ebtables framework. It provides a new packet filtering -framework, a new user-space utility @command{nft}, and a compatibility layer -for iptables. This service comes with a default ruleset -@code{%default-nftables-ruleset} that rejecting all incoming connections -except those to the ssh port 22. To use it, simply write: +framework, a new user-space utility @command{nft}, and a compatibility +layer for iptables. This service comes with a default ruleset, +@code{%default-nftables-ruleset}, that rejects all incoming connections +except those to the SSH port 22 (TCP). To use it, simply write: @lisp (service nftables-service-type) @end lisp @end defvar +@c %start of fragment + @deftp {Data Type} nftables-configuration -The data type representing the configuration of nftables. +Available @code{nftables-configuration} fields are: @table @asis -@item @code{package} (default: @code{nftables}) -The nftables package that provides @command{nft}. -@item @code{ruleset} (default: @code{%default-nftables-ruleset}) -The nftables ruleset to use. This may be any ``file-like'' object -(@pxref{G-Expressions, file-like objects}). +@item @code{package} (default: @code{nftables}) (type: file-like) +The @code{nftables} package to use. + +@item @code{debug-levels} (type: maybe-list-of-debug-levels) +A list of debug levels, for enabling debugging output. Valid debug +level values are the @samp{scanner}, @samp{parser}, @samp{eval}, +@samp{netlink}, @samp{mnl}, @samp{proto-ctx}, @samp{segtree} or +@samp{all} symbols. + +@item @code{ruleset} (type: file-like) +A file-like object containing the complete nftables ruleset. The +default ruleset rejects all incoming connections except those to TCP +port 22, with connections from the loopback interface are allowed. + @end table + @end deftp + +@c %end of fragment + @cindex NTP (Network Time Protocol), service @cindex ntpd, service for the Network Time Protocol daemon @cindex real time clock diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm index 67653e2cbf5..8b7bf668927 100644 --- a/gnu/services/networking.scm +++ b/gnu/services/networking.scm @@ -10,7 +10,7 @@ ;;; Copyright © 2018 Chris Marusich <cmmarusich@HIDDEN> ;;; Copyright © 2018 Arun Isaac <arunisaac@HIDDEN> ;;; Copyright © 2019 Florian Pelz <pelzflorian@HIDDEN> -;;; Copyright © 2019, 2021, 2024 Maxim Cournoyer <maxim.cournoyer@HIDDEN> +;;; Copyright © 2019, 2021, 2024, 2025 Maxim Cournoyer <maxim.cournoyer@HIDDEN> ;;; Copyright © 2019 Sou Bunnbu <iyzsong@HIDDEN> ;;; Copyright © 2019 Alex Griffin <a@HIDDEN> ;;; Copyright © 2020 Brice Waegeneire <brice@HIDDEN> @@ -80,6 +80,7 @@ (define-module (gnu services networking) #:use-module (srfi srfi-9) #:use-module (srfi srfi-26) #:use-module (srfi srfi-43) + #:use-module (ice-9 format) #:use-module (ice-9 match) #:use-module (ice-9 string-fun) #:use-module (json) @@ -258,6 +259,7 @@ (define-module (gnu services networking) nftables-configuration nftables-configuration? nftables-configuration-package + nftables-configuration-debug-levels nftables-configuration-ruleset %default-nftables-ruleset @@ -2279,12 +2281,12 @@ (define iptables-service-type (compose list iptables-shepherd-service)))))) ;;; -;;; nftables +;;; nftables. ;;; (define %default-nftables-ruleset - (plain-file "nftables.conf" - "# A simple and safe firewall + (plain-file "nftables.conf" "\ +# A simple and safe firewall table inet filter { chain input { type filter hook input priority 0; policy drop; @@ -2320,25 +2322,44 @@ (define %default-nftables-ruleset } ")) -(define-record-type* <nftables-configuration> - nftables-configuration - make-nftables-configuration - nftables-configuration? - (package nftables-configuration-package - (default nftables)) - (ruleset nftables-configuration-ruleset ; file-like object - (default %default-nftables-ruleset))) +(define (debug-level? x) + (member x '(scanner parser eval netlink mnl proto-ctx segtree all))) + +(define list-of-debug-levels? + (list-of debug-level?)) + +(define-maybe/no-serialization list-of-debug-levels) + +(define-configuration/no-serialization nftables-configuration + (package + (file-like nftables) + "The @code{nftables} package to use.") + (debug-levels + maybe-list-of-debug-levels + "A list of debug levels, for enabling debugging output. Valid debug level values +are the @samp{scanner}, @samp{parser}, @samp{eval}, @samp{netlink}, +@samp{mnl}, @samp{proto-ctx}, @samp{segtree} or @samp{all} symbols.") + (ruleset + (file-like %default-nftables-ruleset) + "A file-like object containing the complete nftables ruleset. The default +ruleset rejects all incoming connections except those to TCP port 22, with +connections from the loopback interface are allowed.")) (define (nftables-shepherd-service config) (match-record config <nftables-configuration> - (package ruleset) + (package debug-levels ruleset) (let ((nft (file-append package "/sbin/nft"))) (shepherd-service (documentation "Packet filtering and classification") (actions (list (shepherd-configuration-action ruleset))) (provision '(nftables)) (start #~(lambda _ - (invoke #$nft "--file" #$ruleset))) + (invoke #$nft + #$@(if (maybe-value-set? debug-levels) + (list (format #f "--debug=~{~a~^,~}" + debug-levels)) + #~()) + "--file" #$ruleset))) (stop #~(lambda _ (invoke #$nft "flush" "ruleset"))))))) diff --git a/gnu/tests/networking.scm b/gnu/tests/networking.scm index 7d54ebba50e..d3966d5f0da 100644 --- a/gnu/tests/networking.scm +++ b/gnu/tests/networking.scm @@ -5,6 +5,7 @@ ;;; Copyright © 2018 Arun Isaac <arunisaac@HIDDEN> ;;; Copyright © 2021 Maxime Devos <maximedevos@HIDDEN> ;;; Copyright © 2021, 2023-2024 Ludovic Courtès <ludo@HIDDEN> +;;; Copyright © 2025 Maxim Cournoyer <maxim.cournoyer@HIDDEN> ;;; ;;; This file is part of GNU Guix. ;;; @@ -28,6 +29,7 @@ (define-module (gnu tests networking) #:use-module (gnu services) #:use-module (gnu services base) #:use-module (gnu services networking) + #:use-module (gnu services ssh) #:use-module (guix gexp) #:use-module (guix store) #:use-module (guix monads) @@ -48,6 +50,7 @@ (define-module (gnu tests networking) %test-dhcpcd %test-tor %test-iptables + %test-nftables %test-ipfs)) @@ -870,6 +873,8 @@ (define %test-tor (description "Test a running Tor daemon configuration.") (value (run-tor-test)))) +(define %inetd-echo-port 7) + (define* (run-iptables-test) "Run tests of 'iptables-service-type'." (define iptables-rules @@ -890,8 +895,6 @@ (define* (run-iptables-test) COMMIT ") - (define inetd-echo-port 7) - (define os (marionette-operating-system (simple-operating-system @@ -967,7 +970,8 @@ (define* (run-iptables-test) (test-error "iptables firewall blocks access to inetd echo service" 'misc-error - (wait-for-tcp-port inetd-echo-port marionette #:timeout 5)) + (wait-for-tcp-port #$%inetd-echo-port marionette + #:timeout 5)) ;; TODO: This test freezes up at the login prompt without any ;; relevant messages on the console. Perhaps it is waiting for some @@ -979,7 +983,7 @@ (define* (run-iptables-test) ;; (use-modules (gnu services herd)) ;; (stop-service 'iptables)) ;; marionette) - ;; (wait-for-tcp-port inetd-echo-port marionette #:timeout 5))) + ;; (wait-for-tcp-port #$%inetd-echo-port marionette #:timeout 5))) (test-end)))) @@ -991,6 +995,107 @@ (define %test-iptables (description "Test a running iptables daemon.") (value (run-iptables-test)))) + +;;; +;;; nftables. +;;; + +(define (make-nftables-os ruleset) + (simple-operating-system + (service dhcp-client-service-type) + (service inetd-service-type + (inetd-configuration + (entries (list + (inetd-entry + (name "echo") + (socket-type 'stream) + (protocol "tcp") + (wait? #f) + (user "root")))))) + (service openssh-service-type) + (service nftables-service-type + (nftables-configuration + (debug-levels '(all)) + (ruleset ruleset))))) + +(define %default-nftables-ruleset-for-tests + ;; This is like the %default-nftables-ruleset, but without allowing any + ;; connections from the loopback interface. + (plain-file "nftables.conf" "\ +table inet filter { + chain input { + type filter hook input priority 0; policy drop; + + # early drop of invalid connections + ct state invalid drop + + # allow established/related connections + ct state { established, related } accept + + # allow from loopback + # iif lo accept # COMMENTED OUT FOR TESTS + # drop connections to lo not coming from lo + iif != lo ip daddr 127.0.0.1/8 drop + iif != lo ip6 daddr ::1/128 drop + + # allow icmp + ip protocol icmp accept + ip6 nexthdr icmpv6 accept + + # allow ssh + tcp dport ssh accept + + # reject everything else + reject with icmpx type port-unreachable + } + chain forward { + type filter hook forward priority 0; policy drop; + } + chain output { + type filter hook output priority 0; policy accept; + } +}")) + +(define %nftables-os + (make-nftables-os %default-nftables-ruleset-for-tests)) + +(define (run-nftables-test) + (define os + (marionette-operating-system + %nftables-os + #:imported-modules '((gnu services herd)) + #:requirements '(inetd nftables ssh))) + + (define test + (with-imported-modules '((gnu build marionette)) + #~(begin + (use-modules (gnu build marionette) + (srfi srfi-64)) + (define marionette + (make-marionette (list #$(virtual-machine os)))) + + (test-runner-current (system-test-runner #$output)) + (test-begin "nftables") + + (test-error "nftables blocks access to inetd echo service" + 'misc-error + (wait-for-tcp-port #$%inetd-echo-port marionette + #:timeout 5)) + + (test-assert "nftables allows access to SSH TCP port 22" + (wait-for-tcp-port 22 marionette)) + + (test-end)))) + + (gexp->derivation "nftables-test" test)) + +(define %test-nftables + (system-test + (name "nftables") + (description "Tests that an error is raised when attempting build an OS +with an invalid nftables ruleset file.") + (value (run-nftables-test)))) + ;;; ;;; IPFS service base-commit: f348d2be2e019fcda44af8ab81073e2f04697a38 -- 2.49.0
Maxim Cournoyer <maxim.cournoyer@HIDDEN>
:gabriel@HIDDEN, ludo@HIDDEN, maxim.cournoyer@HIDDEN, guix-patches@HIDDEN
.
Full text available.gabriel@HIDDEN, ludo@HIDDEN, maxim.cournoyer@HIDDEN, guix-patches@HIDDEN
:bug#78352
; Package guix-patches
.
Full text available.
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997 nCipher Corporation Ltd,
1994-97 Ian Jackson.