tests: os: add check for iptables rules

[rcooke-warwick]

Change-type: patch

---

Contributor checklist

• Changes have been tested
  • Covered in automated test suite
  • Manual test case recorded
• Change-type present on at least one commit
• Signed-off-by is present
• The PR complies with the Open Embedded Commit Patch Message Guidelines

Reviewer Guidelines

• When submitting a review, please pick:
  • 'Approve' if this change would be acceptable in the codebase (even if there are minor or cosmetic tweaks that could be improved).
  • 'Request Changes' if this change would not be acceptable in our codebase (e.g. bugs, changes that will make development harder in future, security/performance issues, etc).
  • 'Comment' if you don't feel you have enough information to decide either way (e.g. if you have major questions, or you don't understand the context of the change sufficiently to fully review yourself, but want to make a comment)

[kb2ma]

I think it is useful to verify content is present for the BALENA-FIREWALL chain in the filter table. This tells us that the Supervisor was able to create and add some rules in a way that balenaOS sees them. Supervisor also performs more detailed mock tests.

I also would add a comment in the code that states why we are running this test -- to ensure Supervisor rule generation is working.

Does OS testing include any other checking of firewall rules? If not, consider adding a sanity check. For example, we expect to see the MASQUERADE target used in the nat table POSTROUTING chain for the balena0 network, like below.

root@c5be172:~# iptables -t nat -L -vn
...
Chain POSTROUTING (policy ACCEPT 46 packets, 3058 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  *      !balena0  10.114.101.0/24      0.0.0.0/0           
    0     0 MASQUERADE  all  --  *      !supervisor0  10.114.104.0/25      0.0.0.0/0           

[rcooke-warwick]

assuming new tests are currently failing as expected due to issue with supervisor - waiting on #3390 to rebase over it

[rcooke-warwick]

@resin-jenkins retest this please

[rcooke-warwick]

@resin-jenkins retest this please

[kb2ma]

Revisions look good, and the comments do a great job explaining why the tests are composed as they are.

[rcooke-warwick]

@resin-jenkins retest this please

[rcooke-warwick]

@resin-jenkins retest this please

[rcooke-warwick]

@resin-jenkins retest this please