Bug 1459673 - iptables init script doesn't support /etc/sysctl.d/
iptables init script doesn't support /etc/sysctl.d/
Status: ON_QA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: iptables (Show other bugs)
6.9
x86_64 Linux
high Severity high
: rc
: ---
Assigned To: Phil Sutter
qe-baseos-daemons
: Reopened
Depends On:
Blocks: 1374441 1461138 1506394
  Show dependency treegraph
 
Reported: 2017-06-07 14:48 EDT by Davide F Bragalone
Modified: 2017-11-20 05:23 EST (History)
7 users (show)

See Also:
Fixed In Version: iptables-1.4.7-17.el6
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-08-16 12:41:55 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Davide F Bragalone 2017-06-07 14:48:39 EDT
Description of problem:

The init script for iptables /etc/init.d/iptables doesn't support /etc/sysctl.d .

load_sysctl() {
    # load matched sysctl values
    if [ -n "$IPTABLES_SYSCTL_LOAD_LIST" ]; then
        echo -n $"Loading sysctl settings: "
        ret=0
        for item in $IPTABLES_SYSCTL_LOAD_LIST; do
            fgrep $item /etc/sysctl.conf | sysctl -p - >/dev/null    <=========
            let ret+=$?;
        done
        [ $ret -eq 0 ] && success || failure
        echo
    fi
    return $ret
}

That means that if you edit a kernel parameter related to iptables via /etc/sysctl.d/foo.conf , this won't be applied on iptables restart.


Version-Release number of selected component (if applicable):
kernel 2.6.32-696.3.1.el6.x86_64
iptables-1.4.7-16.el6.x86_64

How reproducible:
100%

Steps to Reproduce:
1. edit parameter net.nf_conntrack_max via /etc/sysctl.d/iptables.conf 
2. restart iptables
3. verify if /proc/sys/net/nf_conntrack_max has been modified

Actual results:
never updated

Expected results:
always updated
Comment 2 Davide F Bragalone 2017-06-07 15:01:18 EDT
I've forgot this in the bugzilla's description:

initscripts-9.03.58-1.el6_9.1.x86_64
Comment 4 Lukáš Nykrýn 2017-06-08 04:20:25 EDT
The mentioned code is inside a initscript provided by the iputils package.
Comment 5 Carlos Peón 2017-06-08 07:22:00 EDT
(In reply to Lukáš Nykrýn from comment #4)
> The mentioned code is inside a initscript provided by the iputils package.

I think it's provided by iptables package.
Comment 6 Carlos Peón 2017-06-08 07:25:58 EDT
This patch work for us:

--- iptables.old        2017-06-08 13:18:26.680973312 +0200
+++ iptables    2017-06-08 13:18:39.896022411 +0200
@@ -187,7 +187,7 @@
         echo -n $"Loading sysctl settings: "
         ret=0
         for item in $IPTABLES_SYSCTL_LOAD_LIST; do
-            fgrep $item /etc/sysctl.conf | sysctl -p - >/dev/null
+            fgrep -hs $item /etc/sysctl.conf /etc/sysctl.d/*.conf | sysctl -p - >/dev/null
             let ret+=$?;
         done
         [ $ret -eq 0 ] && success || failure


The same code exists in rhel7, iptables-services package, /usr/libexec/iptables/iptables.init file.
Comment 7 Sergi Jimenez Romero 2017-06-08 11:31:31 EDT
(In reply to Carlos Peón from comment #5)
> (In reply to Lukáš Nykrýn from comment #4)
> > The mentioned code is inside a initscript provided by the iputils package.
> 
> I think it's provided by iptables package.

I confirm that:

$ rpm -qf /etc/init.d/iptables 
iptables-1.4.7-16.el6.x86_64
Comment 11 Phil Sutter 2017-10-06 07:25:21 EDT
Already fixed in RHEL7 via bz#1402021. Same solution applies here with one exception: RHEL6 doesn't ship a symlink from /etc/sysctl.d/99-sysctl.conf to /etc/sysctl.conf, so the grep command needs to explicitly search /etc/sysctl.conf as well.

Note You need to log in before you can comment on or make changes to this bug.