Bug 1481207
| Summary: | Firewall fails to apply when using iptables-services [rhel-7.4.z] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Oneata Mircea Teodor <toneata> |
| Component: | iptables | Assignee: | Thomas Woerner <twoerner> |
| Status: | CLOSED ERRATA | QA Contact: | Tomas Dolezal <todoleza> |
| Severity: | high | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 7.4 | CC: | ahrechan, ajb, ajohn, ajz, amuller, anderson.gomes, baumanmo, contact, cww, dornelas, dwd, egarver, fabiano.martins, ian, igkioka, ihrachys, iptables-maint-list, jarno.huuskonen, jmelvin, jraju, netwiz, pasik, pasteur, pbrobinson, pcaruana, perobins, phil, psutter, rcernin, redhat-bugzilla, richard.cunningham, riehecky, robert.scheck, todoleza, toracat, twoerner |
| Target Milestone: | rc | Keywords: | Regression, Security, ZStream |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
Previously, at boot time or after running the "systemctl restart iptables ip6tables" command, the systemd service was running both iptables and ip6tables services in parallel. Due to the internal locking mechanism that prevented concurrent updates, one of the two services failed to start. This update adds the --wait option to the "iptables-restore" and "ip6tables-restore" commands to make them wait until the lock becomes free, and the described problem no longer occurs.
|
Story Points: | --- |
| Clone Of: | 1477413 | Environment: | |
| Last Closed: | 2017-10-19 14:58:45 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1380141, 1438937, 1477413, 1486803, 1486871, 1544921, 1544922, 1544923 | ||
| Bug Blocks: | 1399762, 1460116, 1480374, 1482087 | ||
|
Description
Oneata Mircea Teodor
2017-08-14 11:17:43 UTC
I don't think -17 is affected. We currently experience failures for OpenStack Neutron with -18 with a similar issue; with -17, it passes broken tests just fine. By the quick look at backported iptables patches, it doesn't seem like xlock was a thing in -17 at all, so you can't possibly get the error there. This is affecting Red Hat OpenStack CI, can we have the latest status here? I'm putting this back ON_QA. There is a new bug 1486871 to track the issue found in comment 6. *** Bug 1460116 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2919 Obviously, the QA for this update was incomplete, leading to bug #1499367 now. |