Bug 129731 - [PATCH] "service iptables status" can seem to hang due to DNS timeouts
[PATCH] "service iptables status" can seem to hang due to DNS timeouts
Status: CLOSED NEXTRELEASE
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: iptables (Show other bugs)
3.0
All Linux
medium Severity medium
: ---
: ---
Assigned To: Thomas Woerner
Ben Levenson
: EasyFix, Patch
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2004-08-12 05:21 EDT by Nils Philippsen
Modified: 2007-11-30 17:07 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2004-09-17 06:39:10 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Proposed patch to fix the problem. (640 bytes, patch)
2004-08-12 05:24 EDT, Nils Philippsen
no flags Details | Diff

  None (edit)
Description Nils Philippsen 2004-08-12 05:21:18 EDT
Description of problem:

"service iptables status" can seem to hang, probably when making
reverse lookups of IP addresses which run into unreachable servers.
Likewise for "service ip6tables status".

Version-Release number of selected component (if applicable):

iptables-1.2.8-12.3

How reproducible:

Not so easy.

Steps to Reproduce:
1. Configure iptables rule for a specific IP address
2. Make the nameserver for that IP not respond (that's the tricky part ;-)
3. run "service iptables status"
  
Actual results:

Seems to hang until DNS times out.

Expected results:

Returns numerical lists immediately.

Additional info:

This originally came up in #128549 "redhat-config-services locks up
for 5 minutes if iptables is selected". While I plan to keep the GUI
responsive in such cases, it would be better if it could display the
status of iptables/ip6tables immediately instead of presenting the
user an hourglass for some minutes ;-).

It's the same on FC2 with iptables-1.2.9-2.3.1.
Comment 1 Nils Philippsen 2004-08-12 05:24:26 EDT
Created attachment 102643 [details]
Proposed patch to fix the problem.

Runs "iptables -n ... --list" and "ip6tables -n ... --list" when checking the
status.
Comment 2 Nils Philippsen 2004-08-13 06:40:03 EDT
NB: I noticed this problem working on bug #128549.
Comment 3 Thomas Woerner 2004-09-03 05:33:48 EDT
There is already a check for this in /etc/sysconfig/iptables-config: 
IPTABLES_STATUS_NUMERIC

But it is off by default.
Comment 4 Thomas Woerner 2004-09-17 06:39:10 EDT
The default behaviour will be changed for RHEL4.

Note You need to log in before you can comment on or make changes to this bug.