From patchwork Sat May 10 14:33:44 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Maxim Cournoyer X-Patchwork-Id: 42506 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 63F8727BC4A; Sat, 10 May 2025 15:37:37 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FROM,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,RCVD_IN_VALIDITY_CERTIFIED, RCVD_IN_VALIDITY_RPBL,RCVD_IN_VALIDITY_SAFE,SPF_HELO_PASS, URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.6 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 8F3F527BC49 for ; Sat, 10 May 2025 15:37:33 +0100 (BST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uDlK6-0006Fu-Hi; Sat, 10 May 2025 10:37:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uDlK4-0006Av-4n for guix-patches@gnu.org; Sat, 10 May 2025 10:37:04 -0400 Received: from debbugs.gnu.org ([2001:470:142:5::43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1uDlK3-0004Ip-0i; Sat, 10 May 2025 10:37:03 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debbugs.gnu.org; s=debbugs-gnu-org; h=MIME-Version:Date:From:To:Subject; bh=0r55fj6PeusgrC+2/tLd5ZXUK60gxS+VE5fmgWbv5F8=; b=ROvMOihx7uTnjerLs3C4BhbSGd/3v2mOCAyqfF32O17zOZrytb/zI7tqsGJGbqGVvBMMSCUjbe2CXbJlB8N7tSyDtZ1go59EqlxVnQ2maX/2Hb9MX4A2skilM3KCHuuvheFR0huZXePQrzk+47r11HBgSc2U0+RyGAyBR59ZT+0zdAR44XfA2IIjaACAhOKt4XVe8R3O5yHPSF/59z/zS4Z7x9eyYFYH1p9QXJNEOFRGXFe8ULDOdrtRKl+chJMFucnCA4jTzJkZ+un6QvyIvyvY5ywlA28d/aiq3W6ghQXS/PQI7gOvVWS3QyevfaUAYpMsvWZxhfqczMIfI2SvWw==; Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1uDlK2-0004vz-2h; Sat, 10 May 2025 10:37:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#78352] [PATCH] services: Modernize and test nftables service. Resent-From: Maxim Cournoyer Original-Sender: "Debbugs-submit" Resent-CC: gabriel@erlikon.ch, ludo@gnu.org, maxim.cournoyer@gmail.com, guix-patches@gnu.org Resent-Date: Sat, 10 May 2025 14:37:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 78352 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 78352@debbugs.gnu.org Cc: Maxim Cournoyer , Gabriel Wicki , Ludovic =?utf-8?q?Court=C3=A8s?= , Maxim Cournoyer X-Debbugs-Original-To: guix-patches@gnu.org X-Debbugs-Original-Xcc: Gabriel Wicki , Ludovic =?utf-8?q?Court=C3=A8s?= , Maxim Cournoyer Received: via spool by submit@debbugs.gnu.org id=B.174688780318920 (code B ref -1); Sat, 10 May 2025 14:37:01 +0000 Received: (at submit) by debbugs.gnu.org; 10 May 2025 14:36:43 +0000 Received: from localhost ([127.0.0.1]:47849 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1uDlJe-0004uj-7B for submit@debbugs.gnu.org; Sat, 10 May 2025 10:36:42 -0400 Received: from lists.gnu.org ([2001:470:142::17]:56342) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1uDlJa-0004uQ-O0 for submit@debbugs.gnu.org; Sat, 10 May 2025 10:36:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uDlJO-0005rj-55 for guix-patches@gnu.org; Sat, 10 May 2025 10:36:23 -0400 Received: from mail-qt1-x82e.google.com ([2607:f8b0:4864:20::82e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1uDlJK-0004DT-PA for guix-patches@gnu.org; Sat, 10 May 2025 10:36:21 -0400 Received: by mail-qt1-x82e.google.com with SMTP id d75a77b69052e-477282401b3so33626871cf.1 for ; Sat, 10 May 2025 07:36:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1746887776; x=1747492576; darn=gnu.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=0r55fj6PeusgrC+2/tLd5ZXUK60gxS+VE5fmgWbv5F8=; b=MzyWLr8PXddP3gjTBd2Mgc5VfV5yEkhrgaA118mKlzqSVRbEsxPg56C03w1Dna8opl +3Dh1sNXtFpOSMnRPudLSiLGqzh1+DH9LVnLMEFg6LWFM8nvRBFLG7PVrC7dxf5rO16j Aqf0WNfV9LI5y4eSZPz0qH93mvV3S4HZKGsq8RoSQKBZyyJwwtoR4VPZM7C+9FXhQil2 BHgdFOcb6HNJXJ1M15Fp92p6IuUcq20oe/r0mRz4jjJdufom1no/h3PPAeCiMwroSLZh Xb2jWl6ExT61HYp9re3W+vz5uF+3S65kOYiDBtMXp42iYTBq8ddcOXs+4SfexnIaE86A fIQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1746887776; x=1747492576; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=0r55fj6PeusgrC+2/tLd5ZXUK60gxS+VE5fmgWbv5F8=; b=jgjunh5CDgQFJvHkwsQulyylExB53belOSq1Npw4tvnVyfgSwnOk74w0zXH8jNspxb Poudkfk7ox+ggyiDAeBjdCGow3UErJVF98WyVpiEKdj3mfpToSsVl9nirToAQhvs0nP4 HLKeml+lSlOkyXguK2ptXU7RsEIlMuqS/PyhZYIzqhBljoqBQK6t/5Dg1IBGNZFvIRUQ RYJDyd3etY5oSQ993zpgUPmsU/18OBICq0acJXYAVuNd54nszXgi6A1bjVSCvZQH+csB rgJjMQhhpaXjFErpS81gEkSK3AEoSmgaakT+XnizoAMIB7VAxAmNDkhvpfJyeCl9+ErC O8Xw== X-Gm-Message-State: AOJu0YysMcEzp9g4GGIewVsCLPOSui1iiyHC2XOZn8rlgPzGUEUD1OAL pHDN/PgMncMeqsZxvqUBnUUQpoOyaLhcCbj1TOiFH3YoING7bUnyoBt+HQ== X-Gm-Gg: ASbGnctxbuzZ0cXWhHv46CzOEvuRiZgRSL/RWw9m1RwKaLfX+YCvlkPP/rlIPdw8JCw vWSjsckIoU5kHg3BZv+lYrujjNmYV/kRcB2EcSFBQeHWGyTyZhJK+Y2LVtEoJwIW9c9p8r/bYpF 4uB1Duji+v0jZ5wfr2TxttvjYu2kjA5GEOJNnfJb5D+1UDeXz2MYiksbUOq+hx3IVOFXlNpkf2W lPMrL9/xPNn+Ff8lle9L/dGiFV2pPIf6zcWsoXnxWFCEnT9Dl4aRuQGSQFmHlWHIvDGZP91GgIW 1W70DpCk6BwISK4cPy1DHgXflbKlgGGTLgDxQ+8GXS6HDYpSydHVhZpqplZPlbe9k+0DRA0= X-Google-Smtp-Source: AGHT+IEpSM/h7TPpeTHz6ReJ82XaPVslABaZaymf6YzHMaElvwu0mBB8fgH+Dh09pSmxMxEKJVAYUA== X-Received: by 2002:a05:6a00:1a8f:b0:736:4644:86ee with SMTP id d2e1a72fcca58-7423be70255mr9585047b3a.14.1746887765596; Sat, 10 May 2025 07:36:05 -0700 (PDT) Received: from localhost.localdomain ([2405:6586:be0:0:83c8:d31d:2cec:f542]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-74237a38bf3sm3377932b3a.133.2025.05.10.07.36.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 May 2025 07:36:04 -0700 (PDT) From: Maxim Cournoyer Date: Sat, 10 May 2025 23:33:44 +0900 Message-ID: <37e412829b5f21d5affc1c14876b98f9b3ec109b.1746887623.git.maxim.cournoyer@gmail.com> X-Mailer: git-send-email 2.49.0 MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::82e; envelope-from=maxim.cournoyer@gmail.com; helo=mail-qt1-x82e.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org X-getmail-retrieved-from-mailbox: Patches * doc/guix.texi (Networking Services) : Update doc. * gnu/services/networking.scm (list-of-debug-levels?): (debug-level?, maybe-list-of-debug-levels?): (nftables-configuration): Rewrite using `define-configuration'. [debug-levels]: New field. (nftables-shepherd-service): Honor it. * gnu/tests/networking.scm (%inetd-echo-port): Extract to top level. (run-iptables-test): Adjust accordingly. (make-nftables-os): New procedure. (%default-nftables-ruleset-for-tests): New variable. (%nftables-os): Likewise. (%test-nftables): New test. Change-Id: I2889603342ff6d2be6261c3de6e4fddd9a9bbe2d --- I investigated to also have a validated ruleset file done in a computed-file: modified gnu/services/networking.scm @@ -2345,6 +2345,16 @@ (define-configuration/no-serialization nftables-configuration ruleset rejects all incoming connections except those to TCP port 22, with connections from the loopback interface are allowed.")) +(define (validated-ruleset nft ruleset) + "Check the nftables RULESET. Return a build error in case RULESET is not +valid, else a computed-file object of the validated RULESET." + (computed-file "nftables.conf" + (with-imported-modules '((guix build utils)) + #~(begin + (use-modules (guix build utils)) + (invoke #+nft "--check" "--file" #$ruleset) + (copy-file #$ruleset #$output))))) + (define (nftables-shepherd-service config) (match-record config (package debug-levels ruleset) @@ -2359,8 +2369,8 @@ (define (nftables-shepherd-service config) (list (format #f "--debug=~{~a~^,~}" debug-levels)) #~()) - "--file" #$ruleset))) + "--file" #+(validated-ruleset nft ruleset)))) (stop #~(lambda _ (invoke #$nft "flush" "ruleset"))))))) but 'nft' is not happy to run in the Guix build environment: building /gnu/store/g4czvsmaccx181h395hp4992i0y3rqqx-nftables.conf.drv... netlink: Error: cache initialization failed: Operation not permitted doc/guix.texi | 40 +++++++++---- gnu/services/networking.scm | 49 +++++++++++----- gnu/tests/networking.scm | 113 ++++++++++++++++++++++++++++++++++-- 3 files changed, 172 insertions(+), 30 deletions(-) base-commit: f348d2be2e019fcda44af8ab81073e2f04697a38 diff --git a/doc/guix.texi b/doc/guix.texi index 889eab2ab35..2f0cd117a03 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -22606,32 +22606,48 @@ Networking Services @end deftp @cindex nftables +@cindex firewall, nftables @defvar nftables-service-type -This is the service type to set up a nftables configuration. nftables is a -netfilter project that aims to replace the existing iptables, ip6tables, +This is the service type to set up a nftables configuration. nftables +is a netfilter project that aims to replace the iptables, ip6tables, arptables and ebtables framework. It provides a new packet filtering -framework, a new user-space utility @command{nft}, and a compatibility layer -for iptables. This service comes with a default ruleset -@code{%default-nftables-ruleset} that rejecting all incoming connections -except those to the ssh port 22. To use it, simply write: +framework, a new user-space utility @command{nft}, and a compatibility +layer for iptables. This service comes with a default ruleset, +@code{%default-nftables-ruleset}, that rejects all incoming connections +except those to the SSH port 22 (TCP). To use it, simply write: @lisp (service nftables-service-type) @end lisp @end defvar +@c %start of fragment + @deftp {Data Type} nftables-configuration -The data type representing the configuration of nftables. +Available @code{nftables-configuration} fields are: @table @asis -@item @code{package} (default: @code{nftables}) -The nftables package that provides @command{nft}. -@item @code{ruleset} (default: @code{%default-nftables-ruleset}) -The nftables ruleset to use. This may be any ``file-like'' object -(@pxref{G-Expressions, file-like objects}). +@item @code{package} (default: @code{nftables}) (type: file-like) +The @code{nftables} package to use. + +@item @code{debug-levels} (type: maybe-list-of-debug-levels) +A list of debug levels, for enabling debugging output. Valid debug +level values are the @samp{scanner}, @samp{parser}, @samp{eval}, +@samp{netlink}, @samp{mnl}, @samp{proto-ctx}, @samp{segtree} or +@samp{all} symbols. + +@item @code{ruleset} (type: file-like) +A file-like object containing the complete nftables ruleset. The +default ruleset rejects all incoming connections except those to TCP +port 22, with connections from the loopback interface are allowed. + @end table + @end deftp + +@c %end of fragment + @cindex NTP (Network Time Protocol), service @cindex ntpd, service for the Network Time Protocol daemon @cindex real time clock diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm index 67653e2cbf5..8b7bf668927 100644 --- a/gnu/services/networking.scm +++ b/gnu/services/networking.scm @@ -10,7 +10,7 @@ ;;; Copyright © 2018 Chris Marusich ;;; Copyright © 2018 Arun Isaac ;;; Copyright © 2019 Florian Pelz -;;; Copyright © 2019, 2021, 2024 Maxim Cournoyer +;;; Copyright © 2019, 2021, 2024, 2025 Maxim Cournoyer ;;; Copyright © 2019 Sou Bunnbu ;;; Copyright © 2019 Alex Griffin ;;; Copyright © 2020 Brice Waegeneire @@ -80,6 +80,7 @@ (define-module (gnu services networking) #:use-module (srfi srfi-9) #:use-module (srfi srfi-26) #:use-module (srfi srfi-43) + #:use-module (ice-9 format) #:use-module (ice-9 match) #:use-module (ice-9 string-fun) #:use-module (json) @@ -258,6 +259,7 @@ (define-module (gnu services networking) nftables-configuration nftables-configuration? nftables-configuration-package + nftables-configuration-debug-levels nftables-configuration-ruleset %default-nftables-ruleset @@ -2279,12 +2281,12 @@ (define iptables-service-type (compose list iptables-shepherd-service)))))) ;;; -;;; nftables +;;; nftables. ;;; (define %default-nftables-ruleset - (plain-file "nftables.conf" - "# A simple and safe firewall + (plain-file "nftables.conf" "\ +# A simple and safe firewall table inet filter { chain input { type filter hook input priority 0; policy drop; @@ -2320,25 +2322,44 @@ (define %default-nftables-ruleset } ")) -(define-record-type* - nftables-configuration - make-nftables-configuration - nftables-configuration? - (package nftables-configuration-package - (default nftables)) - (ruleset nftables-configuration-ruleset ; file-like object - (default %default-nftables-ruleset))) +(define (debug-level? x) + (member x '(scanner parser eval netlink mnl proto-ctx segtree all))) + +(define list-of-debug-levels? + (list-of debug-level?)) + +(define-maybe/no-serialization list-of-debug-levels) + +(define-configuration/no-serialization nftables-configuration + (package + (file-like nftables) + "The @code{nftables} package to use.") + (debug-levels + maybe-list-of-debug-levels + "A list of debug levels, for enabling debugging output. Valid debug level values +are the @samp{scanner}, @samp{parser}, @samp{eval}, @samp{netlink}, +@samp{mnl}, @samp{proto-ctx}, @samp{segtree} or @samp{all} symbols.") + (ruleset + (file-like %default-nftables-ruleset) + "A file-like object containing the complete nftables ruleset. The default +ruleset rejects all incoming connections except those to TCP port 22, with +connections from the loopback interface are allowed.")) (define (nftables-shepherd-service config) (match-record config - (package ruleset) + (package debug-levels ruleset) (let ((nft (file-append package "/sbin/nft"))) (shepherd-service (documentation "Packet filtering and classification") (actions (list (shepherd-configuration-action ruleset))) (provision '(nftables)) (start #~(lambda _ - (invoke #$nft "--file" #$ruleset))) + (invoke #$nft + #$@(if (maybe-value-set? debug-levels) + (list (format #f "--debug=~{~a~^,~}" + debug-levels)) + #~()) + "--file" #$ruleset))) (stop #~(lambda _ (invoke #$nft "flush" "ruleset"))))))) diff --git a/gnu/tests/networking.scm b/gnu/tests/networking.scm index 7d54ebba50e..d3966d5f0da 100644 --- a/gnu/tests/networking.scm +++ b/gnu/tests/networking.scm @@ -5,6 +5,7 @@ ;;; Copyright © 2018 Arun Isaac ;;; Copyright © 2021 Maxime Devos ;;; Copyright © 2021, 2023-2024 Ludovic Courtès +;;; Copyright © 2025 Maxim Cournoyer ;;; ;;; This file is part of GNU Guix. ;;; @@ -28,6 +29,7 @@ (define-module (gnu tests networking) #:use-module (gnu services) #:use-module (gnu services base) #:use-module (gnu services networking) + #:use-module (gnu services ssh) #:use-module (guix gexp) #:use-module (guix store) #:use-module (guix monads) @@ -48,6 +50,7 @@ (define-module (gnu tests networking) %test-dhcpcd %test-tor %test-iptables + %test-nftables %test-ipfs)) @@ -870,6 +873,8 @@ (define %test-tor (description "Test a running Tor daemon configuration.") (value (run-tor-test)))) +(define %inetd-echo-port 7) + (define* (run-iptables-test) "Run tests of 'iptables-service-type'." (define iptables-rules @@ -890,8 +895,6 @@ (define* (run-iptables-test) COMMIT ") - (define inetd-echo-port 7) - (define os (marionette-operating-system (simple-operating-system @@ -967,7 +970,8 @@ (define* (run-iptables-test) (test-error "iptables firewall blocks access to inetd echo service" 'misc-error - (wait-for-tcp-port inetd-echo-port marionette #:timeout 5)) + (wait-for-tcp-port #$%inetd-echo-port marionette + #:timeout 5)) ;; TODO: This test freezes up at the login prompt without any ;; relevant messages on the console. Perhaps it is waiting for some @@ -979,7 +983,7 @@ (define* (run-iptables-test) ;; (use-modules (gnu services herd)) ;; (stop-service 'iptables)) ;; marionette) - ;; (wait-for-tcp-port inetd-echo-port marionette #:timeout 5))) + ;; (wait-for-tcp-port #$%inetd-echo-port marionette #:timeout 5))) (test-end)))) @@ -991,6 +995,107 @@ (define %test-iptables (description "Test a running iptables daemon.") (value (run-iptables-test)))) + +;;; +;;; nftables. +;;; + +(define (make-nftables-os ruleset) + (simple-operating-system + (service dhcp-client-service-type) + (service inetd-service-type + (inetd-configuration + (entries (list + (inetd-entry + (name "echo") + (socket-type 'stream) + (protocol "tcp") + (wait? #f) + (user "root")))))) + (service openssh-service-type) + (service nftables-service-type + (nftables-configuration + (debug-levels '(all)) + (ruleset ruleset))))) + +(define %default-nftables-ruleset-for-tests + ;; This is like the %default-nftables-ruleset, but without allowing any + ;; connections from the loopback interface. + (plain-file "nftables.conf" "\ +table inet filter { + chain input { + type filter hook input priority 0; policy drop; + + # early drop of invalid connections + ct state invalid drop + + # allow established/related connections + ct state { established, related } accept + + # allow from loopback + # iif lo accept # COMMENTED OUT FOR TESTS + # drop connections to lo not coming from lo + iif != lo ip daddr 127.0.0.1/8 drop + iif != lo ip6 daddr ::1/128 drop + + # allow icmp + ip protocol icmp accept + ip6 nexthdr icmpv6 accept + + # allow ssh + tcp dport ssh accept + + # reject everything else + reject with icmpx type port-unreachable + } + chain forward { + type filter hook forward priority 0; policy drop; + } + chain output { + type filter hook output priority 0; policy accept; + } +}")) + +(define %nftables-os + (make-nftables-os %default-nftables-ruleset-for-tests)) + +(define (run-nftables-test) + (define os + (marionette-operating-system + %nftables-os + #:imported-modules '((gnu services herd)) + #:requirements '(inetd nftables ssh))) + + (define test + (with-imported-modules '((gnu build marionette)) + #~(begin + (use-modules (gnu build marionette) + (srfi srfi-64)) + (define marionette + (make-marionette (list #$(virtual-machine os)))) + + (test-runner-current (system-test-runner #$output)) + (test-begin "nftables") + + (test-error "nftables blocks access to inetd echo service" + 'misc-error + (wait-for-tcp-port #$%inetd-echo-port marionette + #:timeout 5)) + + (test-assert "nftables allows access to SSH TCP port 22" + (wait-for-tcp-port 22 marionette)) + + (test-end)))) + + (gexp->derivation "nftables-test" test)) + +(define %test-nftables + (system-test + (name "nftables") + (description "Tests that an error is raised when attempting build an OS +with an invalid nftables ruleset file.") + (value (run-nftables-test)))) + ;;; ;;; IPFS service