Unverified Commit 0d13ad08 authored by K900's avatar K900 Committed by GitHub
Browse files

Merge pull request #219455 from K900/remove-conntrack-helpers 

nixos/firewall: handle conntrack helper autodetection being removed in 6.0
parents 2eeefe41 84f3520c

nixos/doc/manual/release-notes/rl-2305.section.md

+2 −0
Original line number Diff line number Diff line
@@ -142,6 +142,8 @@ In addition to numerous new and upgraded packages, this release has the followin 


- [services.xserver.videoDrivers](options.html#opt-services.xserver.videoDrivers) now defaults to the `modesetting` driver over device-specific ones. The `radeon`, `amdgpu` and `nouveau` drivers are still available, but effectively unmaintained and not recommended for use.



- conntrack helper autodetection has been removed from kernels 6.0 and up upstream, and an assertion was added to ensure things don't silently stop working. Migrate your configuration to assign helpers explicitly or use an older LTS kernel branch as a temporary workaround.



## Other Notable Changes {#sec-release-23.05-notable-changes}



<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/services/networking/firewall.nix

+4 −0
Original line number Diff line number Diff line
@@ -269,6 +269,10 @@ in 
        assertion = cfg.filterForward -> config.networking.nftables.enable;

        message = "filterForward only works with the nftables based firewall";

      }

      {

        assertion = cfg.autoLoadConntrackHelpers -> lib.versionOlder config.boot.kernelPackages.kernel.version "6";

        message = "conntrack helper autoloading has been removed from kernel 6.0 and newer";

      }

    ];



    networking.firewall.trustedInterfaces = [ "lo" ];

nixos/tests/all-tests.nix

+0 −2
Original line number Diff line number Diff line
@@ -433,10 +433,8 @@ in { 
  nagios = handleTest ./nagios.nix {};

  nar-serve = handleTest ./nar-serve.nix {};

  nat.firewall = handleTest ./nat.nix { withFirewall = true; };

  nat.firewall-conntrack = handleTest ./nat.nix { withFirewall = true; withConntrackHelpers = true; };

  nat.standalone = handleTest ./nat.nix { withFirewall = false; };

  nat.nftables.firewall = handleTest ./nat.nix { withFirewall = true; nftables = true; };

  nat.nftables.firewall-conntrack = handleTest ./nat.nix { withFirewall = true; withConntrackHelpers = true; nftables = true; };

  nat.nftables.standalone = handleTest ./nat.nix { withFirewall = false; nftables = true; };

  nats = handleTest ./nats.nix {};

  navidrome = handleTest ./navidrome.nix {};

nixos/tests/nat.nix

+3 −12
Original line number Diff line number Diff line
@@ -3,7 +3,7 @@ 
# client on the inside network, a server on the outside network, and a

# router connected to both that performs Network Address Translation

# for the client.

import ./make-test-python.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false, nftables ? false, ... }:

import ./make-test-python.nix ({ pkgs, lib, withFirewall, nftables ? false, ... }:

  let

    unit = if nftables then "nftables" else (if withFirewall then "firewall" else "nat");
@@ -16,16 +16,11 @@ import ./make-test-python.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? 
          networking.nat.internalIPs = [ "192.168.1.0/24" ];

          networking.nat.externalInterface = "eth1";

        }

        (lib.optionalAttrs withConntrackHelpers {

          networking.firewall.connectionTrackingModules = [ "ftp" ];

          networking.firewall.autoLoadConntrackHelpers = true;

        })

      ];

  in

  {

    name = "nat" + (lib.optionalString nftables "Nftables")

                 + (if withFirewall then "WithFirewall" else "Standalone")

                 + (lib.optionalString withConntrackHelpers "withConntrackHelpers");

                 + (if withFirewall then "WithFirewall" else "Standalone");

    meta = with pkgs.lib.maintainers; {

      maintainers = [ eelco rob ];

    };
@@ -39,10 +34,6 @@ import ./make-test-python.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? 
                (pkgs.lib.head nodes.router.config.networking.interfaces.eth2.ipv4.addresses).address;

              networking.nftables.enable = nftables;

            }

            (lib.optionalAttrs withConntrackHelpers {

              networking.firewall.connectionTrackingModules = [ "ftp" ];

              networking.firewall.autoLoadConntrackHelpers = true;

            })

          ];



        router =
@@ -95,7 +86,7 @@ import ./make-test-python.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? 
        client.succeed("curl -v ftp://server/foo.txt >&2")



        # Test whether active FTP works.

        client.${if withConntrackHelpers then "succeed" else "fail"}("curl -v -P - ftp://server/foo.txt >&2")

        client.fail("curl -v -P - ftp://server/foo.txt >&2")



        # Test ICMP.

        client.succeed("ping -c 1 router >&2")