package "iptables" has been replaced by "iptables-nft" on EL9

[kjetilho]

There are some pointers given by dnf about "iptables", but these confuse Puppet into aborting with the error message:

Error: /Stage[main]/Firewall::Linux/Package[iptables]: Could not evaluate: no implicit conversion of Array into Hash

Fedora had a similar patch in commit 486e4b5 which I think fixed the bug https://tickets.puppetlabs.com/browse/MODULES-11147 but the same issue rared its head here on AlmaLinux 9.0.

The RPM for iptables-legacy states:

This package contains the legacy tools which are obsoleted by
nft-variants in iptables-nft package for backwards compatibility reasons.
If you need to set up firewalls and/or IP masquerading, you should not install
this package but either nftables or iptables-nft instead.

[puppet-community-rangefinder]

firewall::params is a class

that may have no external impact to Forge modules.

This module is declared in 106 of 580 indexed public Puppetfiles.

---

These results were generated with Rangefinder, a tool that helps predict the downstream impact of breaking changes to elements used in Puppet modules. You can run this on the command line to get a full report.

Exact matches are those that we can positively identify via namespace and the declaring modules' metadata. Non-namespaced items, such as Puppet 3.x functions, will always be reported as near matches only.

[puppet-community-rangefinder]

firewall::params is a class

that may have no external impact to Forge modules.

This module is declared in 106 of 580 indexed public Puppetfiles.

---

These results were generated with Rangefinder, a tool that helps predict the downstream impact of breaking changes to elements used in Puppet modules. You can run this on the command line to get a full report.

Exact matches are those that we can positively identify via namespace and the declaring modules' metadata. Non-namespaced items, such as Puppet 3.x functions, will always be reported as near matches only.

[kjetilho]

Thanks for triggering the jobs. Now, this is interesting, the tests fail on EL9 in the nflog-range test

From my test server:

[root@test-alma9 ~]# iptables -A BLOCKOUT -j NFLOG --nflog-range 16 
warn: --nflog-range has never worked and is no longer supported, please use --nflog-size insted

However, the module does not currently support --nflog-size. I feel a fix for this is off-topic for my patch?

[jordanbreen28]

Hi @kjetilho
Thanks for taking a further look into the test failures!
We are aware that this module has began to fail on el9 and are actively looking into this.
If you feel you may have a suitable fix please do feel free to open a seperate PR. :-)
We appreciate all your work with this!

[kjetilho]

EL6 and EL7 do not support --nflog-size:

       --nflog-range size
              The number of bytes to be copied to userspace (only applicable for nfnetlink_log). nfnetlink_log instances may specify their own range, this  option
              overrides it.

[puppet-community-rangefinder]

firewall::params is a class

that may have no external impact to Forge modules.

This module is declared in 106 of 580 indexed public Puppetfiles.

---

These results were generated with Rangefinder, a tool that helps predict the downstream impact of breaking changes to elements used in Puppet modules. You can run this on the command line to get a full report.

Exact matches are those that we can positively identify via namespace and the declaring modules' metadata. Non-namespaced items, such as Puppet 3.x functions, will always be reported as near matches only.

[kjetilho]

(There must be a keyboard shortcut to close issues inardvertantly?)

I opened PR #1096 for this issue so we can apply the PR's cleanly.

[jordanbreen28]

Hi @kjetilho - could you rebase with the current main so the tests rekick & pass, so I can approve :)

[jordanbreen28]

Closing & Re-opening to rekick tests

[puppet-community-rangefinder]

firewall::params is a class

that may have no external impact to Forge modules.

This module is declared in 106 of 580 indexed public Puppetfiles.

---

These results were generated with Rangefinder, a tool that helps predict the downstream impact of breaking changes to elements used in Puppet modules. You can run this on the command line to get a full report.

Exact matches are those that we can positively identify via namespace and the declaring modules' metadata. Non-namespaced items, such as Puppet 3.x functions, will always be reported as near matches only.

[jordanbreen28]

Approved - thanks again for your hard work @kjetilho. :-)