RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Two distinct backport requests:

1) iptables-restore --wait

OpenShift, docker, kubernetes, and other tools often use the --wait option to iptables itself to ensure that different invocations from different tools wont' conflict with each other.  OpenShift/Kubernetes use iptables-restore with large rulesets which means it may be running for a couple hundred ms or more.  Because it doesn't use the --wait flag it may cause other processes that run iptables itself (docker, openshift, kubernetes, etc) to fail, even if those processes use the --wait flag.

Relevant commits:
b91af533f4da15854893ba5cc082e1df6bcf9a97
836846f0d747e1be8e37d2d43b215a68b30ea1a9
6e2e169eb66b63d2991e1c7ada931e3cdb0ced32
999eaa241212d3952ddff39a99d0d55a74e3639e
1cf4ba6fbe85b3cbe9828a7947000290e1989986


2) iptables -C set_changed() fix

iptables -C would mistakenly call kernel ioctls to update rules when passed jump targets that were not built-in.  Thus when iptables -C was run in parallel with other iptables calls (like a long-running iptables-restore) this would cause the -C to fail, even though -C isn't supposed to modify anything.

Relevant commit:
9b8cb7564a53865bf0e239bbc3e057de70edf65d

Also, I think we'd like to request Z-stream on this too so that we can get a fix into RHEL 7.3 when it's ready.  I don't think OpenShift can wait for 7.4 here.

We'd also like to backport http://www.spinics.net/lists/netfilter-devel/msg47275.html whenever that lands...

The requested --version patch was recently merged upstream:

9cd3adbed2fd8cdb6366293f3799573b811be89b

And there's a follow-up patch for the --wait patches that adds manpage documentation for them:

65801d02a482befd2745c792d6596ec75d434934

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:2280