Bug 1682913

Summary:	native ipsets are not cleaned up upon daemon exit
Product:	Red Hat Enterprise Linux 8	Reporter:	Tomas Dolezal <todoleza>
Component:	firewalld	Assignee:	Eric Garver <egarver>
Status:	CLOSED ERRATA	QA Contact:	Jiri Peska <jpeska>
Severity:	medium	Docs Contact:	Sagar Dubewar <sdubewar>
Priority:	medium
Version:	8.0	CC:	egarver, jpeska, lmanasko, rkhan, todoleza
Target Milestone:	rc
Target Release:	8.1
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	firewalld-0.8.2-1.el8	Doc Type:	Bug Fix
Doc Text:	.`firewalld` no longer retains `ipset` entries after shutdown Previously, shutting down `firewalld` did not remove `ipset` entries. Consequently, `ipset` entries remained active in the kernel even after stopping the `firewalld` service. With this fix, shutting down `firewalld` removes `ipset` entries as expected.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-04 01:39:57 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2020-09-28

Description Tomas Dolezal 2019-02-25 19:32:19 UTC

Description of problem:
after creating an firewalld ipset using --new-ipset in permanent mode and subsequent service start and stop, the defined ipset remains active in kernel and is visible via ipset list
the behaviour is same if iptables or nftables backend is used

Version-Release number of selected component (if applicable):
firewalld-0.6.3-7.el8.noarch

How reproducible:
always

Steps to Reproduce:
firewall-cmd --new-ipset fwdset --permanent --type hash:ip
firewall-cmd --ipset fwdset --permanent --add-entry 192.0.2.10
restart firewalld and stop it
ipset list still shows 'fwdset' and it's entry

Actual results:
ipset remains in memory
any additional entries are wiped upon service start

Expected results:
ipset is destroyed like in previous versions?

Additional info:

Comment 4 Eric Garver 2020-03-03 17:34:03 UTC

Upstream:

81d784f8c856 ("test: ipset: verify clean up on exit/reload")
f5ed30ce7175 ("fix: ipset: destroy runtime sets on reload/stop")

Comment 16 errata-xmlrpc 2020-11-04 01:39:57 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (firewalld bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4461