qubes-firewall: Move dynamic forward rules to a dedicated chain

[3hhh]

Users can jump to this chain to implement their custom configurations.

Closes: QubesOS/qubes-issues#9340

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 70.57%. Comparing base (47ae4a3) to head (7447fa2).
Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #510   +/-   ##
=======================================
  Coverage   70.57%   70.57%           
=======================================
  Files           3        3           
  Lines         469      469           
=======================================
  Hits          331      331           
  Misses        138      138           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[qubesos-bot]

OpenQA test summary

Complete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2024071804-4.3&flavor=pull-requests

Test run included the following:

• qubes-dom0-update: prevent concurrent execution qubes-core-admin-linux#161 (QubesOS/qubes-core-admin-linux@18fd950)
• Remove deprecated pkg-resources, replace with packaging qubes-core-admin-linux#152 (QubesOS/qubes-core-admin-linux@38cab01)
• Qubes outline logo for Plymouth shutdown splash qubes-artwork#40 (QubesOS/qubes-artwork@67fc3ef)
• tests: increase memory size for webcam viewing VM qubes-video-companion#28 (QubesOS/qubes-video-companion@624ebce)
• api/admin: gracefully handle device listing during qubesd shutdown qubes-core-admin#609 (QubesOS/qubes-core-admin@1734b65)
• qubes-firewall: Move dynamic forward rules to a dedicated chain #510 (7447fa2)
• Minimize package manager calls qubes-mgmt-salt-dom0-virtual-machines#64 (QubesOS/qubes-mgmt-salt-dom0-virtual-machines@f13b9f6)
• Limit initramfs size to fix booting with limited memory size #457 (c083076)
• Support additional policy directories qubes-core-qrexec#134 (QubesOS/qubes-core-qrexec@966e383)
• tests/integ/audio.py: add test for audio-intput in QubesDB qubes-core-admin#608 (QubesOS/qubes-core-admin@d80114a)
• Avoid reusing disposable VM names for some predefined time qubes-core-admin#603 (QubesOS/qubes-core-admin@dc4b63c)
• Use QubesDB for knowing if mic is allowed or not qubes-gui-daemon#145 (QubesOS/qubes-gui-daemon@844ce83)

New failures, excluding unstable

Compared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2024070519-4.3&flavor=update

• system_tests_extra

  • TC_00_QVCTest_whonix-workstation-17: test_010_screenshare (failure)
    self.assertNotEqual(vm.run('test -e /dev/vid... AssertionError: 0 == 0

• system_tests_audio

  • TC_20_AudioVM_PipeWire_debian-12-xfce: test_260_audio_mic_enabled_switch_audiovm (failure)
    AssertionError: too short audio, expected 10s, got 0.00013605442176...

  • TC_20_AudioVM_PipeWire_whonix-workstation-17: test_260_audio_mic_enabled_switch_audiovm (failure)
    AssertionError: too short audio, expected 10s, got 0.00013605442176...

Failed tests

5 failures

• system_tests_extra

  • [unstable] TC_00_QVCTest_debian-12-xfce: test_020_webcam (failure)
    AssertionError: 'qubes-video-companion webcam' exited early (0): b'...

  • TC_00_QVCTest_whonix-workstation-17: test_010_screenshare (failure)
    self.assertNotEqual(vm.run('test -e /dev/vid... AssertionError: 0 == 0

• system_tests_network_updates

  • [unstable] VmUpdates_debian-12-xfce: test_020_updates_available_notification (error)
    subprocess.CalledProcessError: Command '/usr/lib/qubes/upgrades-sta...

• system_tests_audio

  • TC_20_AudioVM_PipeWire_debian-12-xfce: test_260_audio_mic_enabled_switch_audiovm (failure)
    AssertionError: too short audio, expected 10s, got 0.00013605442176...

  • TC_20_AudioVM_PipeWire_whonix-workstation-17: test_260_audio_mic_enabled_switch_audiovm (failure)
    AssertionError: too short audio, expected 10s, got 0.00013605442176...

Fixed failures

Compared to: https://openqa.qubes-os.org/tests/105374#dependencies

9 fixed

• system_tests_pvgrub_salt_storage

  • TC_41_HVMGrub_fedora-40-xfce: test_000_standalone_vm (error)
    qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...

  • TC_41_HVMGrub_fedora-40-xfce: test_010_template_based_vm (error)
    qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...

• system_tests_splitgpg

  • TC_10_Thunderbird_debian-12-xfce: test_010_send_receive_inline_signed_only (failure)
    dogtail.tree.SearchError: descendent of [application | Thunderbird]...

  • TC_10_Thunderbird_whonix-workstation-17: test_020_send_receive_inline_with_attachment (failure)
    dogtail.tree.SearchError: descendent of [application | Thunderbird]...

• system_tests_extra

  • TC_00_QVCTest_fedora-40-xfce: test_020_webcam (failure + cleanup)
    AssertionError: 'qubes-video-companion webcam' exited early (0): b'...

  • TC_00_QVCTest_whonix-gateway-17: test_020_webcam (failure + cleanup)
    AssertionError: 'qubes-video-companion webcam' exited early (0): b'...

  • TC_00_QVCTest_whonix-workstation-17: test_020_webcam (failure + cleanup)
    AssertionError: 'qubes-video-companion webcam' exited early (0): b'...

• system_tests_usbproxy

  • TC_20_USBProxy_core3_fedora-40-xfce: test_070_attach_not_installed_front (error)
    qubesusbproxy.core3ext.QubesUSBException: Device attach failed: 202...

• system_tests_network_updates

  • TC_11_QvmTemplateMgmtVM_debian-12-xfce: test_000_template_list (failure)
    AssertionError: libvirt event impl drain timeout

Unstable tests

• system_tests_update

  update2/Failed (1/5 times with errors)

  • job 103358 # Test died: command 'script -c 'qubes-vm-update --max-concurrency=...

• system_tests_suspend

  suspend/ (1/5 times with errors)

  • job 103660 None
  suspend/Failed (1/5 times with errors)

  • job 103660 # Test died: no candidate needle with tag(s) 'xscreensaver-prompt' ...
  suspend/wait_serial (1/5 times with errors)

  • job 103660 # wait_serial expected: qr/2E8vz-\d+-/...

• system_tests_basic_vm_qrexec_gui

  TC_20_AudioVM_Pulse_whonix-workstation-17/test_220_audio_play_pulseaudio (1/5 times with errors)

  • job 103642 AssertionError: too short audio, expected 10s, got 8.64043083900226...
  TC_20_AudioVM_Pulse_whonix-workstation-17/test_221_audio_rec_muted_pulseaudio (1/5 times with errors)

  • job 103642 Cannot process volume group qubes_dom0...
  TC_20_AudioVM_Pulse_whonix-workstation-17/test_223_audio_play_hvm (1/5 times with errors)

  • job 102413 AssertionError: only silence detected, no useful audio data

• system_tests_pvgrub_salt_storage

  TC_41_HVMGrub_debian-12-xfce/test_000_standalone_vm (1/5 times with errors)

  • job 102428 qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...
  TC_41_HVMGrub_debian-12-xfce/test_010_template_based_vm (1/5 times with errors)

  • job 102428 qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...

• system_tests_splitgpg

  TC_10_Thunderbird_debian-12-xfce/test_010_send_receive_inline_signed_only (1/5 times with errors)

  • job 105472 dogtail.tree.SearchError: descendent of [application | Thunderbird]...

• system_tests_extra

  TC_00_QVCTest_debian-12-xfce/test_020_webcam (2/5 times with errors)

  • job 102420 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
  • job 104728 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
  TC_00_QVCTest_fedora-40-xfce/test_020_webcam (2/5 times with errors)

  • job 105464 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
  • job 105868 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
  TC_00_QVCTest_whonix-gateway-17/test_020_webcam (4/5 times with errors)

  • job 102420 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
  • job 103649 self.assertNotEqual(vm.run('test -e /dev/vid... AssertionError: 0 == 0
  • job 105464 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
  • job 105868 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
  TC_00_QVCTest_whonix-workstation-17/test_020_webcam (4/5 times with errors)

  • job 102420 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
  • job 103649 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
  • job 105464 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
  • job 105868 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...

• system_tests_usbproxy

  TC_20_USBProxy_core3_fedora-40-xfce/test_070_attach_not_installed_front (1/5 times with errors)

  • job 105442 qubesusbproxy.core3ext.QubesUSBException: Device attach failed: 202...

• system_tests_network_updates

  TC_11_QvmTemplateMgmtVM_debian-12-xfce/test_000_template_list (1/5 times with errors)

  • job 105469 AssertionError: libvirt event impl drain timeout
  TC_10_QvmTemplate_whonix-gateway-17/test_010_template_install (2/5 times with errors)

  • job 103656 AssertionError: libvirt event impl drain timeout
  • job 105873 AssertionError: libvirt event impl drain timeout
  VmUpdates_debian-12-xfce/test_020_updates_available_notification (1/5 times with errors)

  • job 104735 subprocess.CalledProcessError: Command '/usr/lib/qubes/upgrades-sta...
  VmUpdates_debian-12-xfce/test_110_update_via_proxy_qubes_vm_update (1/5 times with errors)

  • job 104735 AssertionError: 1 not found in [0] : dpkg -l test-pkg | grep 1.1: b''
  VmUpdates_fedora-40-xfce/test_110_update_via_proxy_qubes_vm_update (1/5 times with errors)

  • job 104735 AssertionError: 1 not found in [0, 100] : rpm -q test-pkg | grep 1....
  VmUpdates_debian-12-xfce/test_111_update_via_proxy_qubes_vm_update_cli (1/5 times with errors)

  • job 104735 AssertionError: 1 not found in [0] : dpkg -l test-pkg | grep 1.1: b''
  VmUpdates_fedora-40-xfce/test_111_update_via_proxy_qubes_vm_update_cli (1/5 times with errors)

  • job 104735 AssertionError: 1 not found in [0, 100] : rpm -q test-pkg | grep 1....
  VmUpdates_debian-12-xfce/test_130_no_network_qubes_vm_update (1/5 times with errors)

  • job 104735 AssertionError: qubes-vm-update return unexpected code: 0 in (1, 2, 5)
  VmUpdates_fedora-40-xfce/test_130_no_network_qubes_vm_update (1/5 times with errors)

  • job 104735 AssertionError: qubes-vm-update return unexpected code: 0 in (1, 2, 5)
  VmUpdates_debian-12-xfce/test_131_no_network_qubes_vm_update_cli (1/5 times with errors)

  • job 104735 AssertionError: qubes-vm-update return unexpected code: 0 in (1, 2, 5)
  VmUpdates_fedora-40-xfce/test_131_no_network_qubes_vm_update_cli (1/5 times with errors)

  • job 104735 AssertionError: qubes-vm-update return unexpected code: 0 in (1, 2, 5)

• system_tests_dispvm

  TC_20_DispVM_fedora-40-xfce/test_100_open_in_dispvm (1/5 times with errors)

  • job 102419 AssertionError: './open-file test.txt' failed with ./open-file test...

• system_tests_update@hw1

  update2/Failed (1/5 times with errors)

  • job 103358 # Test died: command 'script -c 'qubes-vm-update --max-concurrency=...

• system_tests_basic_vm_qrexec_gui_zfs

  TC_20_AudioVM_Pulse_debian-12-xfce-pool/test_223_audio_play_hvm (1/5 times with errors)

  • job 103646 AssertionError: only silence detected, no useful audio data

• system_tests_update@hw7

  update2/Failed (1/5 times with errors)

  • job 103358 # Test died: command 'script -c 'qubes-vm-update --max-concurrency=...

• system_tests_basic_vm_qrexec_gui_xfs

  TC_20_AudioVM_PipeWire_debian-12-xfce-pool/test_226_audio_playback_pipewire (1/5 times with errors)

  • job 102416 AssertionError: too short audio, expected 10s, got 8.31034013605442...
  TC_20_AudioVM_PipeWire_debian-12-xfce-pool/test_228_audio_rec_unmuted_pipewire (1/5 times with errors)

  • job 102416 AssertionError: too short audio, expected 10s, got 8.89784580498866...
  TC_20_AudioVM_PipeWire_fedora-40-xfce-pool/test_228_audio_rec_unmuted_pipewire (1/5 times with errors)

  • job 102416 AssertionError: too short audio, expected 10s, got 9.45630385487528...
  TC_20_AudioVM_PipeWire_debian-12-xfce-pool/test_250_audio_playback_audiovm_pipewire (1/5 times with errors)

  • job 102416 AssertionError: too short audio, expected 10s, got 7.48553287981859...
  TC_20_AudioVM_PipeWire_debian-12-xfce-pool/test_251_audio_playback_audiovm_pipewire_late_start (1/5 times with errors)

  • job 102416 AssertionError: too short audio, expected 10s, got 9.19612244897959...
  TC_20_AudioVM_Pulse_whonix-workstation-17-pool/test_252_audio_playback_audiovm_switch_hvm (1/5 times with errors)

  • job 102416 AssertionError: too short audio, expected 10s, got 6.77941043083900...

• system_tests_basic_vm_qrexec_gui@hw1

  TC_20_AudioVM_Pulse_whonix-workstation-17/test_220_audio_play_pulseaudio (1/5 times with errors)

  • job 103642 AssertionError: too short audio, expected 10s, got 8.64043083900226...
  TC_20_AudioVM_Pulse_whonix-workstation-17/test_221_audio_rec_muted_pulseaudio (1/5 times with errors)

  • job 103642 Cannot process volume group qubes_dom0...
  TC_20_AudioVM_Pulse_whonix-workstation-17/test_223_audio_play_hvm (1/5 times with errors)

  • job 102413 AssertionError: only silence detected, no useful audio data

• system_tests_suspend@hw1

  suspend/ (1/5 times with errors)

  • job 103660 None
  suspend/Failed (1/5 times with errors)

  • job 103660 # Test died: no candidate needle with tag(s) 'xscreensaver-prompt' ...
  suspend/wait_serial (1/5 times with errors)

  • job 103660 # wait_serial expected: qr/2E8vz-\d+-/...

• system_tests_basic_vm_qrexec_gui_ext4

  TC_20_AudioVM_Pulse_debian-12-xfce-pool/test_223_audio_play_hvm (1/5 times with errors)

  • job 102415 AssertionError: only silence detected, no useful audio data