Bug 1837367
| Summary: | nfnl_osf fails to load signatures | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Phil Sutter <psutter> |
| Component: | iptables | Assignee: | Phil Sutter <psutter> |
| Status: | CLOSED ERRATA | QA Contact: | Jiri Peska <jpeska> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.3 | CC: | iptables-maint-list, jpeska, lveyde, qe-baseos-daemons, sbonazzo, todoleza |
| Target Milestone: | rc | Keywords: | Regression |
| Target Release: | 8.0 | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | iptables-1.8.4-12.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1829820 | Environment: | |
| Last Closed: | 2020-11-04 01:54:58 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1829820 | ||
| Bug Blocks: | |||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (iptables bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:4518 |
Upstream commits to backport: commit c8332553caf48132403895bae750b3cd09a2efd8 Author: Phil Sutter <phil> Date: Sat May 9 13:36:49 2020 +0200 nfnl_osf: Fix broken conversion to nfnl_query() Due to missing NLM_F_ACK flag in request, nfnetlink code in kernel didn't create an own ACK message but left it upon subsystem to ACK or not. Since nfnetlink_osf doesn't ACK by itself, nfnl_query() got stuck waiting for a reply. Whoever did the conversion from deprecated nfnl_talk() obviously didn't even test basic functionality of the tool. Fixes: 52aa15098ebd6 ("nfnl_osf: Replace deprecated nfnl_talk() by nfnl_query()") Signed-off-by: Phil Sutter <phil> commit 3e09bd1888575cfec136574d2b0e810ba33f1cfb Author: Phil Sutter <phil> Date: Sat May 9 13:42:56 2020 +0200 nfnl_osf: Improve error handling For some error cases, no log message was created - hence apart from the return code there was no indication of failing execution. If a line load fails, don't abort but continue with the remaining file contents. The current pf.os file in this repository serves as proof-of-concept: Lines 700 and 701: Duplicates of lines 698 and 699 because 'W*' and 'W0' parse into the same data. Line 704: Duplicate of line 702 because apart from 'W*' and 'W0', only the first three fields on right-hand side are sent to the kernel. When loading, these dups are ignored (they would bounce if NLM_F_EXCL was given). Upon deletion, they cause ENOENT response from kernel. In order to align duplicate-tolerance in both modes, just ignore that ENOENT. Signed-off-by: Phil Sutter <phil>