Bug 1164243
| Summary: | [rhel 7.1.4] Firewalld support | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Jiri Popelka <jpopelka> |
| Component: | docker | Assignee: | Lokesh Mandvekar <lsm5> |
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.0 | CC: | albenson, dwalsh, eparis, jpopelka, jrieden, lmiksik, lsu, ngalvin, pasik, pvrabec, twoerner |
| Target Milestone: | rc | Keywords: | Extras |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
Cause: Docker does not support managing IPtable rules via firewalld.
Consequence: If firewalld and iptables attempt to adjust rules at the same time, it is possible for filtering rules to be applied incorrectly (or not at all)
Fix: Implement code to check if firewalld is running on the system. If it is, pass filtering rules through firewalld. If firewalld is reloaded, then re-apply filtering rules and configuration.
Result: Firewalld is now supported in docker -- and if it is running on the system, then rules will be added via firewalld passthrough. If firewalld is reloaded, configuration will be re-applied.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-08-06 00:31:46 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1133060 | ||
|
Description
Jiri Popelka
2014-11-14 12:35:57 UTC
There's been firewalld branch in my docker fork. https://github.com/jpopelka/docker/tree/firewalld These two commits should add the firewalld support and therefore solve the above described problems: https://github.com/jpopelka/docker/commit/46d4f66aadbad25899fba2f13674df12923b7e39 https://github.com/jpopelka/docker/commit/3b295156e48db1486f5fa347c5e2814637385d74 If you know somebody who can take a look at them before I create a pull request, I'll be glad if you can point him/her to it so we can increase our chances for merging them upstream. Thanks! Make sure you run these through gofmt.
+ if err != nil {
+ fmt.Println("Failed to connect to D-Bus system bus:", err)
+ }
+
Should the be a log.Errorf()
Thanks Dan, you're right. Here's upstream issue & pull request: https://github.com/docker/docker/issues/9395 (In reply to Jiri Popelka from comment #3) > Here's upstream issue & pull request: > https://github.com/docker/docker/issues/9395 In case it's not obvious from the issue, the pull request is: https://github.com/docker/docker/pull/9397 Looks like that pull request is being hung up for better unit tests. Fixed in docker-1.7 When it ships. Assigning to the default owner of the docker component. Dan, so this is probably a candidate for 7.1.4, right? Yes Hi Jiri, Do i need the latest firewalld to make the support success? The latest firewalld i can get is firewalld-0.3.9-12.el7.noarch in RHEL7, docker is docker-1.7.1-105.el7.x86_64 which includes those patches btw. And after reload, the firewalld still flushes all dockers rule so that the container will lose connection. Steps like:(start all daemon in foreground for easy checking debug log ) #firewalld --no-fork --debug 1 #docker -d -D --selinux-enabled Now the iptable-save can get the dockers iptable rule #firewall-cmd --reload All docker iptable rule were erased and docker daemon show nothing journel error message: journal: operation failed: filter 'allow-arp' already exists with uuid f2a01626-247c-4d52-8b4d-0a231496c2d1 journal: operation failed: filter 'allow-dhcp-server' already exists with uuid e50f60ab-7518-4ed5-8205-acd47c33d72b journal: operation failed: filter 'allow-dhcp' already exists with uuid 3ac27d9f-94fd-41c0-8b91-1eb8b500f914 ournal: operation failed: filter 'allow-incoming-ipv4' already exists with uuid f87d158f-70f2-448f-b6a1-11eaaaa26243 journal: operation failed: filter 'allow-ipv4' already exists with uuid 9a32ff01-9e93-458a-b3bf-ca700e317bc5 journal: operation failed: filter 'clean-traffic' already exists with uuid 65b666a8-51d7-46b6-879a-251363843c7e journal: operation failed: filter 'no-arp-ip-spoofing' already exists with uuid 76153d69-c55c-466f-9456-e6db1b29b100 journal: operation failed: filter 'no-arp-mac-spoofing' already exists with uuid b172576d-2d69-4bde-9325-91fb7909d52c journal: operation failed: filter 'no-arp-spoofing' already exists with uuid 73f4fe72-b6b9-4a95-b263-3814949e344d journal: operation failed: filter 'no-ip-multicast' already exists with uuid 3b859870-965b-43f1-a432-818d629d869a journal: operation failed: filter 'no-ip-spoofing' already exists with uuid 4857b80d-6388-4292-aea4-cb51d78c48c5 journal: operation failed: filter 'no-mac-broadcast' already exists with uuid e90f5089-72fa-4602-ae0a-fcf69b6e83c7 journal: operation failed: filter 'no-mac-spoofing' already exists with uuid 8a04362c-8530-46ba-9439-b5b9792084b3 journal: operation failed: filter 'no-other-l2-traffic' already exists with uuid 5e14eb96-4cdf-47fd-bdf5-30424af55f6d journal: operation failed: filter 'no-other-rarp-traffic' already exists with uuid 80796b32-adbc-4f04-a4fd-57a7f1784f8f journal: operation failed: filter 'qemu-announce-self-rarp' already exists with uuid 3da7e953-a5a9-4bf7-a84a-f10596e6b88d journal: operation failed: filter 'qemu-announce-self' already exists with uuid 5e48c76b-d953-40e6-9a27-d185c11a6ea8 @Luwen I was not able to reproduce this in Fedora 21, but I will grab a RHEL VM and test it out there. I will report back with results when that is done. I tried to emulate your situation as closely as I could. I am still unable to reproduce the errors that you are seeing. I tested on a Centos 7 x64 environment running firewalld-0.3.9-11.el7.noarch. I am using the RPM from: http://koji.fedoraproject.org/koji/buildinfo?buildID=671790 Are you positive the version you are running has the fixes? (In reply to Alec Benson from comment #15) > I tried to emulate your situation as closely as I could. I am still unable > to reproduce the errors that you are seeing. > > I tested on a Centos 7 x64 environment running firewalld-0.3.9-11.el7.noarch. > I am using the RPM from: > http://koji.fedoraproject.org/koji/buildinfo?buildID=671790 > > Are you positive the version you are running has the fixes? Thanks your update Alec, seems like the it's either the previous docker version or my machines issue, With the new one docker-1.7.1-107.el7.x86_64, firewalld is firewalld-0.3.9-12.el7.noarch , same as before, the #firewall-cmd --reload doesn't flush the docker rules anymore. Move to verified Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-1536.html |