GNU bug report logs - #32465
Add iptables service

Previous Next

Full log

View this message in rfc822 format

From: Arun Isaac <arunisaac <at> systemreboot.net>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 32465 <at> debbugs.gnu.org
Subject: [bug#32465] Add iptables service
Date: Tue, 18 Sep 2018 11:54:31 +0530

>> - Is the example I added for the iptables.rules sufficient? I couldn't
>>   find upstream documentation for the iptables.rules format. I suspect
>>   it doesn't exist. Do you know of any upstream documentation that can
>>   be referred to here?
>
> From a quick search it must be <https://netfilter.org/documentation/>,
> specifically <https://netfilter.org/documentation/HOWTO//packet-filtering-HOWTO.html>.

This is general documentation for netfilter, not specific documentation
about the iptables.rules format. For that, I don't think there is
upstream documentation.

https://unix.stackexchange.com/questions/400163/netfilter-iptables-restore-file-format-documentation/400203

>> +        (stop #~(lambda _
>> +                  (invoke #$iptables-restore #$%iptables-accept-all-rules)
>> +                  (invoke #$ip6tables-restore #$%iptables-accept-all-rules))))))))
>
> There’s a peculiarity of ‘stop’ which is that it must return #f on
> success.  So here, you just need to add a trailing #f after the second
> ‘invoke’ call.  If you do that, I suppose the test that stops the
> firewall will pass.

There was one problem with stop-service being an unbound variable. I
fixed that by adding (use-modules (gnu services herd)). But, now the
test just freezes up. I wonder if it is waiting for some timeout. Here
is the snippet for the test I am currently using. Also, returning #f
from stop didn't make a difference.

(test-assert "inetd echo service is accessible after iptables firewall is stopped"
  (begin
    (marionette-eval
     '(begin
        (use-modules (gnu services herd))
        (stop-service 'iptables))
     marionette)
    (wait-for-tcp-port inetd-echo-port marionette #:timeout 5)))

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.