Bug 1594657
| Summary: | Docker with firewalld produces WARNING messages | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Takayoshi Kimura <tkimura> |
| Component: | firewalld | Assignee: | Eric Garver <egarver> |
| Status: | CLOSED ERRATA | QA Contact: | Tomas Dolezal <todoleza> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 7.5 | CC: | dapark, egarver, hasuzuki, jmaxwell, sbrivio, todoleza |
| Target Milestone: | rc | Keywords: | TestOnly |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | firewalld-0.6.3-1.el7 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-03-31 20:00:54 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1637204 | ||
| Bug Blocks: | 1723958 | ||
|
Description
Takayoshi Kimura
2018-06-25 06:51:49 UTC
(In reply to Takayoshi Kimura from comment #0) [..] > Looks like docker is checking if the chain exists using -C option, this is > normal operation and expected behavior. The initial failures are docker attempting to delete rules that don't exist. It looks like docker is attempting to delete rules even before it does a probe (-C) to see if they exist. > firewalld WARNINGs for normal operation is not reasonable. How is firewalld to determine if this is normal? The requests are coming from docker. At best firewalld could check if "-C" or "-L" options are in the direct rule and squelch the log, but this won't address the other failed commands that are coming from docker. Those need to be addressed on the docker side. > The initial failures are docker attempting to delete rules that don't exist. It looks like docker is attempting to delete rules even before it does a probe (-C) to see if they exist. I agree that this is docker side issue. It needs to check the existing rules first. > At best firewalld could check if "-C" or "-L" options are in the direct rule and squelch the log I think this is reasonable, iptables -C could return -1 and it's not good condition for warnings. I pushed two commits upstream to avoid the log if "-C" or "-L" are used. For the other issues you'll have to create a BZ against docker.
8c1c0d047b2e ("test/regression: new test for untracked passthrough logging")
7662061f1640 ("fw_direct: avoid log for untracked passthrough queries")
The log no longer occurs for "-C" and "-L" as of firewalld-0.6.3-1.el7, for the other log reports you'll have to file a bug with Docker as per comment 2. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1109 |