Bug 1943386

Summary:	knockd: pcap: can't parse filter expression: syntax error
Product:	[Fedora] Fedora EPEL	Reporter:	Leon Fauster <leonfauster>
Component:	knock	Assignee:	Christos Triantafyllidis <christos.triantafyllidis>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	epel8	CC:	carl, christos.triantafyllidis
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	knock-0.8-1.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-07 17:30:58 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Leon Fauster 2021-03-26 00:07:16 UTC

Description of problem:
Upcoming RHEL8.4 will show following problem (tested in centos 8 stream):

Working config in RHEL83 

rpm -qa |grep knock
knock-server-0.7.8-10.20151227git258a27e.el8.x86_64
knock-0.7.8-10.20151227git258a27e.el8.x86_64

and

tcpflags      = syn

in 

/etc/knockd.conf


Updating to RHEL8.4/CentOS Stream8

produces 

knockd[1249]: pcap: can't parse filter expression: syntax error

while starting (systemctl start knockd.service). 




Additional info:

Solution

https://github.com/jvinet/knock/commit/4a5e12b2c01bd13d8d5ece5c8cbc6139ec2de765.patch


or workaround by setting explicitly

tcpflags      = syn,!fin,!syn,!rst,!psh,!ack,!urg



###############

BTW: For having a working start process with knockd I need

cat /usr/lib/systemd/system/knockd.service.d/network.conf 
[Unit]
After=network-online.target

check: https://bugzilla.redhat.com/show_bug.cgi?id=1730634

Comment 1 Fedora Update System 2021-10-06 04:25:40 UTC

FEDORA-EPEL-2021-007682c950 has been submitted as an update to Fedora EPEL 8. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-007682c950

Comment 2 Fedora Update System 2021-10-06 17:46:46 UTC

FEDORA-EPEL-2021-007682c950 has been pushed to the Fedora EPEL 8 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-007682c950

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 3 Leon Fauster 2021-10-07 12:13:11 UTC

This update still suffers from a missing correct boot order. 

Description:
https://bugzilla.redhat.com/show_bug.cgi?id=1730634


Solution:
https://bugzilla.redhat.com/attachment.cgi?id=1729711&action=diff

Tested:
Yes, against current version 
knock-server-0.8-1.el8.x86_64

How:
mkdir /usr/lib/systemd/system/knockd.service.d/
touch /usr/lib/systemd/system/knockd.service.d/network.conf
cat /usr/lib/systemd/system/knockd.service.d/network.conf
[Unit]
After=network.target network-online.target
Wants=network.target network-online.target

Comment 4 Carl George 🤠 2021-10-07 16:20:41 UTC

Leon if you know the fix you can submit it as a pull request.

https://src.fedoraproject.org/rpms/knock/tree/epel8

That's what I did to update it to 0.8 to resolve this bug.

https://src.fedoraproject.org/rpms/knock/pull-request/1

I'm not a maintainer of the knock package, I just merged my own pull request via my proven packager permissions after not getting a response from the maintainer.

Comment 5 Fedora Update System 2021-10-07 17:30:58 UTC

FEDORA-EPEL-2021-007682c950 has been pushed to the Fedora EPEL 8 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 Leon Fauster 2021-10-07 18:59:02 UTC

(In reply to Carl George 🤠 from comment #4)
> Leon if you know the fix you can submit it as a pull request.
> 
> https://src.fedoraproject.org/rpms/knock/tree/epel8
> 
> That's what I did to update it to 0.8 to resolve this bug.
> 
> https://src.fedoraproject.org/rpms/knock/pull-request/1
> 
> I'm not a maintainer of the knock package, I just merged my own pull request
> via my proven packager permissions after not getting a response from the
> maintainer.


Hi Carl, thanks for the pointer. I'm not fedora nor epel packager but I will take
a look at it. Above all I need to understand this contribution process at all.