Bionic dep8 tests are failing

[Andreas Hasenack]

[ Impact ]

This bug does not affect users directly, but it's a problem everytime iptables is SRUed to Bionic. We could hint the DEP8 tests, in which case they would all be ignored (uncluding the ones that actually work), or fix it. By itself, fixing DEP8 is not worth an SRU, but since we are fixing a segfault (in #1992454), we can ship the DEP8 fixes with it and make future SRUs easier and of better quality (since the tests now run correctly).

The actual fixes are two:
- since many iptables commands exit non-zero when the help parameter is given (-h/--help), instead of relying on that, we grep the output. Since bash's pipefail option is not set, it's the grep exit status that will be checked.
- the iptables-compat-save is now being called with the -d (dump) option, which works for what the test wants, and doesn't exit 1 for no reason.

Later versions of iptables have either flipped the exit status of the -h option (but not for all commands, annoyingly), so this fix is not needed after bionic. In other cases, the problematic test was just removed from d/t/control.

[ Test Plan ]
Verify in the autopkgtest report that the DEP8 tests ran and are all green.

[ Where problems could occur ]
This is fixing the existing DEP8 tests, which have been red for bionic since ever. If the fix fails, the tests will remain red, so no change.

I'm assuming that the test goal of the multiple calls to iptables binaries with just the "-h/--help" option is to see if they run and don't crash. This is now being wrapped by a grep filter. If the iptables binary crashes, but still produces the expected help output, then it will be considered a green run, even though there was a problem.

[ Other Info ]
This fix is being included in the same upload as bug #1992454.

[ Original Description]

The Bionic DEP8 tests for iptables are in bad shape[1], even in the migration-reference/0 run.

There are two types of failures:
a) some commands have an exit status of 1 when called with the -h (for help) option, which is what some tests do
b) iptables-compat-save (and its IPv6 counterpart) also exit with status 1, even when there are chains/tables to save

I'll propose:
a) grep the help output instead of relying on the exit status
b) call the command with the -d (dump) option. That doesn't exit 0 in the success case, and actually dumps data when there are tables to do so

1. https://autopkgtest.ubuntu.com/packages/i/iptables/bionic/amd64

[Timo Aaltonen (tjaalton)]

Hello Andreas, or anyone else affected,

Accepted iptables into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/iptables/1.6.1-2ubuntu2.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

The bionic amd64 dep8 test run for 1.6.1-2ubuntu2.1: https://autopkgtest.ubuntu.com/results/autopkgtest-bionic/bionic/amd64/i/iptables/20230512_170407_f7c64@/log.gz

Has all tests passing now:
autopkgtest [17:04:01]: @@@@@@@@@@@@@@@@@@@@ summary
command1 PASS
command2 PASS
command3 PASS
command4 PASS
command5 PASS
command6 PASS
command7 PASS
command8 PASS
command9 PASS
command10 PASS
command11 PASS
command12 PASS
command13 PASS
command14 PASS
command15 PASS
command16 PASS
command17 PASS
command18 PASS
command19 PASS

Bionic verification succeeded.

[Launchpad Janitor (janitor)]

This bug was fixed in the package iptables - 1.6.1-2ubuntu2.1

---------------
iptables (1.6.1-2ubuntu2.1) bionic; urgency=medium

  [ Louis Bouchard ]

  * d/patches: 0001-libiptc-Fix-for-segfault-when-renaming-a-chain.patch
    Apply upstream fix:
    - libiptc: Fix for segfault when renaming a chain (LP: #1992454)
    - include new test for this issue in the DEP8 run

  [ Andreas Hasenack ]
  * d/t/control: fix DEP8 tests (LP: #2019022)

 -- Andreas Hasenack <email address hidden> Tue, 09 May 2023 15:42:18 -0300

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for iptables has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.