Date: Sun, 28 Aug 2022 14:37:03 -0500
From: "W. Michael Petullo" <mike@flyn.org>
To: ~alpine/devel@lists.alpinelinux.org
Subject: Strange behavior in "awall activate -f"
Message-ID: <YwvD38auXDts3zJn@imp.flyn.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

I find that "awall activate -f" fails on a fresh install unless I run
"awall activate" at least once in interactive mode first. The failure
message is:

  host:~# (Deploy firewall rules ...)
  host:~# awall activate -f
  Warning: firewall not enabled for inet6
  Warning: firewall not enabled for inet
  awall: Firewall not enabled in kernel

It turns out this is because the ip_tables and ip6_tables kernel
modules are not loaded. It seems "awall activate" will load the required
modules. Indeed, the first "awall activate" is quite chatty about doing
this and a number of other things:

  Warning: firewall not enabled for inet6
  Warning: firewall not enabled for inet
  Firewall is not active
  Press RETURN to perform initial configuration and activation: 
   * rc-update: ip6tables already installed in runlevel `default'; skipping
   * Caching service dependencies ...
   [ ok ]
   * Loading ip6tables state and starting firewall ...
   [ ok ]
   * Enabling forwarding ...
   [ ok ]
   * rc-update: iptables already installed in runlevel `default'; skipping
   * Caching service dependencies ...
   [ ok ]
   * Loading iptables state and starting firewall ...
   [ ok ]
   * Enabling forwarding ...
   [ ok ]

If I do start a new system, load ip_tables and ip6_tables, and run
"awall activate -f", then awall runs without error. However, I do not
see evidence of the other configuration going on, as with the output from
"awall activate" above.

My questions:

Should "awall activate -f" be changed to load the kernel modules, as
interactive mode does? Is there a reason for the inconsistency?

Does running "awall activate -f" after manually loading the modules
perform all the steps to activate the firewall for the first time?
Put another way, does "awall activate -f" do everything "awall activate"
does, albeit in a much less verbose mode?

Having a fully-automated install motivates my questions.

-- 
Mike

:wq