1499367 – ip6tables.service unit file has invalid value for After=

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1499367 - ip6tables.service unit file has invalid value for After=

Summary: ip6tables.service unit file has invalid value for After=

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	iptables
Sub Component:
Version:	7.4
Hardware:	Unspecified
OS:	Unspecified
Priority:	urgent
Severity:	urgent
Target Milestone:	rc
Target Release:	---
Assignee:	Phil Sutter
QA Contact:	Tomas Dolezal
Docs Contact:
URL:
Whiteboard:
Duplicates (3):	1504647 1505043 1541501 (view as bug list)
Depends On:
Blocks:	1538549
TreeView+	depends on / blocked

Reported:	2017-10-06 20:17 UTC by Micah Abbott
Modified:	2022-03-13 14:28 UTC (History)
CC List:	19 users (show)
Fixed In Version:	iptables-1.4.21-23.el7
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Clones:	1538549 (view as bug list)
Environment:
Last Closed:	2018-04-10 11:28:02 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHEA-2018:0715	0	normal	SHIPPED_LIVE	iptables bug fix and enhancement update	2018-04-10 16:09:27 UTC

Description Micah Abbott 2017-10-06 20:17:32 UTC

When 'systemctl daemon-reload' was used, the following log message was observed:

Oct 06 20:05:43 micah-rhelah-vm1006a systemd[1]: [/usr/lib/systemd/system/ip6tables.service:3] Failed to add dependency on syslog.target,iptables.service, ignoring: Invalid argument


An inspection of the service file shows:

# cat /usr/lib/systemd/system/ip6tables.service                             
[Unit]                                                                                                   
Description=IPv6 firewall with ip6tables                                                                 
After=syslog.target,iptables.service                  
...


According to the systemd.unit man page, the section for 'After=' starts off with:

"These two settings expect a space-separated list of unit names."


I believe the 'After=' section for the ip6tables.service file should look like:

After=syslog.target iptables.service

This was observed using RHEL Atomic Host 7.4.2 with iptables-services-1.4.21-18.2.el7_4.x86_64

Comment 2 Micah Abbott 2017-10-06 20:34:08 UTC

I edited the ip6tables.service file with the new value for 'After=' and put it in /etc/systemd/system

# cat /etc/systemd/system/ip6tables.service
[Unit]
Description=IPv6 firewall with ip6tables
After=syslog.target iptables.service
AssertPathExists=/etc/sysconfig/ip6tables

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/libexec/iptables/ip6tables.init start
ExecReload=/usr/libexec/iptables/ip6tables.init reload
ExecStop=/usr/libexec/iptables/ip6tables.init stop
Environment=BOOTUP=serial
Environment=CONSOLETYPE=serial
StandardOutput=syslog
StandardError=syslog

[Install]
WantedBy=basic.target


When I did 'systemctl daemon-reload', the error previously found in the journal did not occur.

Comment 3 Phil Sutter 2017-10-09 12:58:16 UTC

Hi Micah,

Thanks for reporting. Strangely, this error message doesn't occur when both units are restarted at the same time using 'systemctl restart iptables ip6tables'.

Anyway, the fix is trivial. This probably should be added to 7.4.z as well since it contains the same piece of code.

Thanks, Phil

Comment 5 Robert Scheck 2017-10-21 23:31:56 UTC

Cross-filed ticket 01903155 on the Red Hat customer portal.

Comment 6 Phil Sutter 2017-10-23 15:20:42 UTC

*** Bug 1504647 has been marked as a duplicate of this bug. ***

Comment 8 Yaniv Kaul 2017-10-23 15:48:38 UTC

I've just seen it in oVirt (RHV downstream).

Comment 9 Phil Sutter 2017-10-25 20:57:39 UTC

This issue has been addressed as follow-up fix to Bug 1486803.

Comment 10 Phil Sutter 2017-10-25 21:00:21 UTC

Proposing this bug for z-stream.

Comment 12 Phil Sutter 2017-10-25 21:58:55 UTC

*** Bug 1505043 has been marked as a duplicate of this bug. ***

Comment 14 shyam.biradar 2018-01-01 11:28:54 UTC

Hi,

How we I get this fix? We have updated our packages to latest on RHEL7.4 and still we have issue on our system.
We still have 1.4.21 version of iptables-services package. 

Installed Packages
Name        : iptables-services
Arch        : x86_64
Version     : 1.4.21
Release     : 18.2.el7_4
Size        : 25 k
Repo        : installed
From repo   : rhel-7-server-rpms
Summary     : iptables and ip6tables services for iptables
URL         : http://www.netfilter.org/
License     : GPLv2
Description : iptables services for IPv4 and IPv6
            :
            : This package provides the services iptables and ip6tables that have been split
            : out of the base package since they are not active by default anymore.

Comment 15 Harald Reindl 2018-01-01 11:42:27 UTC Comment hidden (abuse)

just edit the unit file in the meantime and there is no good reason to clone it to /etc because that would prevent future updates

hopefully the guys at redhat become some basic education about their own operating system - that's at least the third time some crap makes it into unit files where the one which did the change didn't systemctl daemon-reload and read his sys logs before put it into a package and every bug at RHEL/CentOS takes ages to get fixed

Comment 16 Harald Reindl 2018-01-01 11:56:11 UTC Comment hidden (abuse)

@Phil Sutter "Strangely, this error message doesn't occur when both units are restarted at the same time using 'systemctl restart iptables ip6tables'"

are you kidding me?

units are reloaded with "systemctl daemon-reload" and then the warning fires while "systemctl restart" only complains when the unit on disk was changed since the last reload which is a differnt story

you guys please learn grep your syslogs for "error", "alert" and "warn" after changes and before appy them to packages which would reduce the number of bugs and reports

[root@srv-rhsoft:~]$ cat /scripts/system-errors.sh
#!/usr/bin/bash
dmesg | grep -i warn
dmesg | grep -i fail
dmesg | grep -i error
cat /var/log/messages | grep -i warn
cat /var/log/messages | grep -i fail
cat /var/log/messages | grep -i error

Comment 17 shyam.biradar 2018-01-01 12:28:35 UTC

Thanks Herald. I know workaround, but I was looking for solution from upstream. But looks like it is not in the release yet.

Comment 18 shyam.biradar 2018-01-01 12:29:01 UTC

Thanks Herald. I know workaround, but I was looking for solution from upstream. But looks like it is not in the release yet.

Comment 19 shyam.biradar 2018-01-01 12:29:20 UTC

Thanks Herald. I know workaround, but I was looking for solution from upstream. But looks like it is not in the release yet.

Comment 22 Phil Sutter 2018-02-17 14:55:34 UTC

*** Bug 1541501 has been marked as a duplicate of this bug. ***

Comment 24 errata-xmlrpc 2018-04-10 11:28:02 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:0715

Note You need to log in before you can comment on or make changes to this bug.