Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate nftables rule files in CI and fix IPv6 #114

Merged
merged 4 commits into from
Dec 11, 2024
Merged

Conversation

mwindower
Copy link
Contributor

@mwindower mwindower commented Nov 12, 2024

Description

This checks our nftables rule test fixtures against nft -c -f in the CI.
Thereby some minor issues withe the IPv6 use case were seen and fixed.

@mwindower mwindower requested a review from a team as a code owner November 12, 2024 08:36
@majst01
Copy link
Contributor

majst01 commented Nov 12, 2024

Validation failed, but ci passed ?

/testdata/nftrules_ipv6:15:46-54: Error: conflicting protocols specified: ip vs. ip6
        ip saddr 10.0.0.0/8 tcp dport domain ip6 daddr 2a02:c00:20::1 accept comment "dnat to dns proxy"
                                             ^^^^^^^^^
/testdata/nftrules_ipv6:16:46-54: Error: conflicting protocols specified: ip vs. ip6
        ip saddr 10.0.0.0/8 udp dport domain ip6 daddr 2a02:c00:20::1 accept comment "dnat to dns proxy"
                                             ^^^^^^^^^
/testdata/nftrules_ipv6:68:19-36: Error: datatype mismatch, expected IPv6 address, expression has type IPv4 address
        ip6 daddr @proxy_dns_servers iifname "vlan3981" tcp dport domain dnat ip6 to 2a02:c00:20::1 comment "dnat to dns proxy"
        ~~~~~~~~~ ^^^^^^^^^^^^^^^^^^
/testdata/nftrules_ipv6:69:19-36: Error: datatype mismatch, expected IPv6 address, expression has type IPv4 address
        ip6 daddr @proxy_dns_servers iifname "vlan3981" udp dport domain dnat ip6 to 2a02:c00:20::1 comment "dnat to dns proxy"
        ~~~~~~~~~ ^^^^^^^^^^^^^^^^^^
/testdata/nftrules_ipv6:70:19-36: Error: datatype mismatch, expected IPv6 address, expression has type IPv4 address
        ip6 daddr @proxy_dns_servers iifname "vlan3982" tcp dport domain dnat ip6 to 2a02:c00:20::1 comment "dnat to dns proxy"
        ~~~~~~~~~ ^^^^^^^^^^^^^^^^^^
/testdata/nftrules_ipv6:71:19-36: Error: datatype mismatch, expected IPv6 address, expression has type IPv4 address
        ip6 daddr @proxy_dns_servers iifname "vlan3982" udp dport domain dnat ip6 to 2a02:c00:20::1 comment "dnat to dns proxy"
        ~~~~~~~~~ ^^^^^^^^^^^^^^^^^^
Testing nft rules on ubuntu:24.04 with input /testdata/nftrules_ipv6: ❌
nft input /testdata/nftrules_ipv6 on ubuntu:24.04 produces an invalid configura

@majst01
Copy link
Contributor

majst01 commented Nov 12, 2024

These errors are my fault

@mwindower
Copy link
Contributor Author

I'll come up with a fix :-)

@mwindower mwindower changed the title Validate nftables rule files in CI Validate nftables rule files in CI and fix IPv6 Nov 12, 2024
@majst01 majst01 merged commit 9b2aa2c into master Dec 11, 2024
1 check passed
@majst01 majst01 deleted the nftables-tests branch December 11, 2024 13:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants