container-test-run-user-firewall-nftables
checks.aarch64-linux.nixos-test-user-firewall-nftables
· build #682
· raw
1additionally exposed symbols:2 machine, router,3 start_all, machines, driver, Machine, wait_for_signal4Starting machine5Starting router6789<<< NixOS Stage 2 >>>1011booting system configuration /nix/store/ps42jk8nbbzhgnfyc44zrj5jh5gsm64h-nixos-system-machine-test12running activation script...13setting up /etc...142: host0@if3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100015 link/ether 0e:74:26:22:81:c2 brd ff:ff:ff:ff:ff:ff link-netnsid 016starting systemd...17systemd 260.2 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)18Detected virtualization systemd-nspawn.19Detected architecture arm64.20Detected first boot.21Initializing machine ID from container UUID.22Applying preset policy.23Populated /etc with preset unit settings.24Queued start job for default target Multi-User System.25262728<<< Welcome to NixOS test (aarch64) - console >>>29+ systemd-run /bin/sh -c '/nix/store/wjm08iz4sdw5qgmx58dimv8ch7gbyyaj-coreutils-9.11/bin/sleep 999999999 && echo cffd0ddb-27a0-4a92-89be-2899e19fc67f'30Running as unit: run-p225-i13574061.service; invocation ID: ce388d4bb5fe4825a62698e9eb81fb6f31To attach to container machine run on the same machine that runs the test:32 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*cffd0ddb-27a0-4a92-89be-2899e19fc67f') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 3334To inject external network and continue test, run:35sudo /nix/store/akbq19lqha5w5h9hcchn309znqm94pq0-python3-3.13.15/bin/python3.13 /nix/store/969lhd485dnkvwd40vh884qdqvdyca7y-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py cffd0ddb-27a0-4a92-89be-2899e19fc67f3637<<< NixOS Stage 2 >>>3839booting system configuration /nix/store/wfng7qhp11s8nc590xjl66i3kly05ikq-nixos-system-router-test40running activation script...41setting up /etc...422: host0@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100043 link/ether a6:24:31:fe:b9:6d brd ff:ff:ff:ff:ff:ff link-netnsid 044starting systemd...45systemd 260.2 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)46Detected virtualization systemd-nspawn.47Detected architecture arm64.48Detected first boot.49Initializing machine ID from container UUID.50Applying preset policy.51Populated /etc with preset unit settings.52Queued start job for default target Multi-User System.53545556<<< Welcome to NixOS test (aarch64) - console >>>57+ systemd-run /bin/sh -c '/nix/store/wjm08iz4sdw5qgmx58dimv8ch7gbyyaj-coreutils-9.11/bin/sleep 999999999 && echo a96fc8a2-6313-4974-a403-5617de410ba3'58Running as unit: run-p208-i13574194.service; invocation ID: a8d4f9508174400284b611692c18c07559To attach to container router run on the same machine that runs the test:60 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*a96fc8a2-6313-4974-a403-5617de410ba3') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 6162To inject external network and continue test, run:63sudo /nix/store/akbq19lqha5w5h9hcchn309znqm94pq0-python3-3.13.15/bin/python3.13 /nix/store/969lhd485dnkvwd40vh884qdqvdyca7y-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py a96fc8a2-6313-4974-a403-5617de410ba364+ systemctl --no-pager show multi-user.target65+ systemctl --no-pager show nginx.service66+ systemctl --no-pager show multi-user.target67+ systemctl --no-pager show nginx.service68+ ip -4 addr show eth169+ grep -oP '(?<=inet\s)\d+(\.\d+){3}'70+ grep -oP '(?<=inet6\s)[0-9a-f:]+'71+ ip -6 addr show eth172+ grep -v '^fe80'73+ head -174Router IPv4: 192.168.1.275Router IPv6: 2001:db8:1::276+ systemctl restart nftables77+ systemctl --no-pager show nftables.service78+ nft list table inet user-firewall79table inet user-firewall {80 chain output {81 type filter hook output priority filter; policy accept;82 oifname "lo" counter packets 0 bytes 0 accept comment "allow lo"83 oifname "tun*" counter packets 0 bytes 0 accept comment "allow tun*"84 oifname "tap*" counter packets 0 bytes 0 accept comment "allow tap*"85 oifname "wg*" counter packets 0 bytes 0 accept comment "allow wg*"86 oifname "tailscale*" counter packets 0 bytes 0 accept comment "allow tailscale*"87 oifname "zt*" counter packets 0 bytes 0 accept comment "allow zt*"88 oifname "vpn*" counter packets 0 bytes 0 accept comment "allow vpn*"89 oifname "ipsec*" counter packets 0 bytes 0 accept comment "allow ipsec*"90 oifname "nebula*" counter packets 0 bytes 0 accept comment "allow nebula*"91 oifname "tinc*" counter packets 0 bytes 0 accept comment "allow tinc*"92 oifname "edge*" counter packets 0 bytes 0 accept comment "allow edge*"93 oifname "hyprspace" counter packets 0 bytes 0 accept comment "allow hyprspace"94 oifname "ham0" counter packets 0 bytes 0 accept comment "allow ham0"95 oifname "easytier" counter packets 0 bytes 0 accept comment "allow easytier"96 oifname "mycelium" counter packets 0 bytes 0 accept comment "allow mycelium"97 meta skuid 1002 counter packets 0 bytes 0 reject comment "blocked user bob"98 }99}100machine: waiting for success: runuser -u alice -- curl -s http://127.0.0.1:8080101+ runuser -u alice -- curl -s http://127.0.0.1:8080102(finished: waiting for success: runuser -u alice -- curl -s http://127.0.0.1:8080, in 0.02 seconds)103+ runuser -u alice -- curl -s http://192.168.1.2104105106Traceback (most recent call last):107 File "/nix/store/969lhd485dnkvwd40vh884qdqvdyca7y-test-driver-0.0.1/bin/.nixos-test-driver-wrapped", line 9, in <module>108 sys.exit(main())109 ~~~~^^110 File "/nix/store/969lhd485dnkvwd40vh884qdqvdyca7y-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/__init__.py", line 764, in main111 driver.run_tests()112 ~~~~~~~~~~~~~~~~^^113 File "/nix/store/969lhd485dnkvwd40vh884qdqvdyca7y-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/__init__.py", line 700, in run_tests114 self.test_script()115 ~~~~~~~~~~~~~~~~^^116 File "/nix/store/969lhd485dnkvwd40vh884qdqvdyca7y-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/__init__.py", line 696, in test_script117 exec(self.testscript, self.test_symbols(), None) # noqa: S102118 ~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^119 File "<string>", line 22, in <module>120 File "/nix/store/969lhd485dnkvwd40vh884qdqvdyca7y-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/__init__.py", line 475, in succeed121 raise RuntimeError(msg)122RuntimeError: Failed to run command runuser -u alice -- curl -s http://192.168.1.2123Exit code: 7124Stdout: