Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nixos/firewall: deduplicate installed firewall rules #58167

Closed
wants to merge 1 commit into from
Closed

nixos/firewall: deduplicate installed firewall rules #58167

wants to merge 1 commit into from

Conversation

andir
Copy link
Member

@andir andir commented Mar 23, 2019

Motivation for this change

When there are multiple statements adding an overlapping set of rules
(e.g. opening a TCP port) there will no longer be multiple rules for
those. It could easily happen that you'd end up with multiple allow
statements for the very same port due to the way your custom
modules/files are structured.

cc @tilpner since he pointed me towards this problem on IRC.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@andir andir requested a review from infinisil as a code owner March 23, 2019 08:33
@andir
nixos/firewall: deduplicate installed firewall rules
faf4c1f 
When there are multiple statements adding an overlapping set of rules
(e.g. opening a TCP port) there will no longer be multiple rules for
those. It could easily happen that you'd end up with multiple allow
statements for the very same port due to the way your custom
modules/files are structured.
@infinisil
Copy link
Member

Looks good to me after conflict is resolved and the test run by @GrahamcOfBorg

@andir
Copy link
Member Author

andir commented Mar 29, 2019

It seems like this is obsolete since 18bc820 landed...

@andir andir closed this Mar 30, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tilpner tilpner tilpner left review comments

@infinisil infinisil infinisil left review comments

Assignees
No one assigned
Labels
6.topic: nixos 8.has: module (update) 10.rebuild-darwin: 0 10.rebuild-linux: 1-10
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@andir @infinisil @tilpner @GrahamcOfBorg