turnkey-init-fence: skip a REDIRECT rule when its nat table is unavailable #3

Merged

marcos-mendez merged 6 commits from fix/fence-without-nat into master

2026-09-26 06:19:02 -03:00

marcos-mendez commented

2026-09-26 05:55:47 -03:00

(Migrated from github.com)

Diagnosis: the script assumed both nat tables exist; modprobe is a stub inside a container, so the table is whatever the host loaded.

Fix: check each family's nat table first; when one cannot be used, warn and skip that family's redirect, keep the other family's rules and still serve on the fence ports. The firewall and server functions moved into lib/init-fence.sh (fence_htdocs and fence_nat_available extracted); the script is the start, stop, stop-post and reload dispatcher. INITHOOKS_PATH, INITFENCE_DEFAULT, PIDFILE and LOGFILE can point at scratch files. The package installs lib/.

Tests: 27 bats with iptables, ip6tables, pgrep and the mini server stubbed: every library function and the script end to end (both nat tables, only IPv4, neither, packaged htdocs fallback, failed server, stop, stop-post, reload, unknown command, DEBUG). tests/coverage.sh under kcov: bin/turnkey-init-fence 28/28, lib/init-fence.sh 63/64 (98.44 percent; the missing line is the first line of a multi-line command kcov attributes to a later line). The last commit restores write permission on the scratch htdocs in teardown so bats can clean up as a regular user, which the CI runner is. Checked in a TKLDev 19.0 LXC container with the IPv6 nat table unavailable: before exit 3, after exit 0 with 4 IPv4 redirects and the fence on 60443.

Serves BRIEF section 4 (first boot in an LXC container) and section 5.3.

Problem: in an LXC container whose host has not loaded ip6table_nat, 'ip6tables -t nat -A PREROUTING' fails ("can't initialize ip6tables table nat") and, as the script runs with -e, the fence exits 3 right after the first IPv4 rule: the unit fails, the mini server never starts and 29tagid then fails reloading it. Diagnosis: the script assumed both nat tables exist; modprobe is a stub inside a container, so the table is whatever the host loaded. Fix: check each family's nat table first; when one cannot be used, warn and skip that family's redirect, keep the other family's rules and still serve on the fence ports. The firewall and server functions moved into lib/init-fence.sh (fence_htdocs and fence_nat_available extracted); the script is the start, stop, stop-post and reload dispatcher. INITHOOKS_PATH, INITFENCE_DEFAULT, PIDFILE and LOGFILE can point at scratch files. The package installs lib/. Tests: 27 bats with iptables, ip6tables, pgrep and the mini server stubbed: every library function and the script end to end (both nat tables, only IPv4, neither, packaged htdocs fallback, failed server, stop, stop-post, reload, unknown command, DEBUG). tests/coverage.sh under kcov: bin/turnkey-init-fence 28/28, lib/init-fence.sh 63/64 (98.44 percent; the missing line is the first line of a multi-line command kcov attributes to a later line). The last commit restores write permission on the scratch htdocs in teardown so bats can clean up as a regular user, which the CI runner is. Checked in a TKLDev 19.0 LXC container with the IPv6 nat table unavailable: before exit 3, after exit 0 with 4 IPv4 redirects and the fence on 60443. Serves BRIEF section 4 (first boot in an LXC container) and section 5.3.