Bug 1499367 - ip6tables.service unit file has invalid value for After=
Summary: ip6tables.service unit file has invalid value for After=
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: iptables
Version: 7.4
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: rc
: ---
Assignee: Phil Sutter
QA Contact: Tomas Dolezal
URL:
Whiteboard:
: 1504647 1505043 1541501 (view as bug list)
Depends On:
Blocks: 1538549
TreeView+ depends on / blocked
 
Reported: 2017-10-06 20:17 UTC by Micah Abbott
Modified: 2018-11-23 19:12 UTC (History)
19 users (show)

Fixed In Version: iptables-1.4.21-23.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1538549 (view as bug list)
Environment:
Last Closed: 2018-04-10 11:28:02 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2018:0715 normal SHIPPED_LIVE iptables bug fix and enhancement update 2018-04-10 16:09:27 UTC

Description Micah Abbott 2017-10-06 20:17:32 UTC
When 'systemctl daemon-reload' was used, the following log message was observed:

Oct 06 20:05:43 micah-rhelah-vm1006a systemd[1]: [/usr/lib/systemd/system/ip6tables.service:3] Failed to add dependency on syslog.target,iptables.service, ignoring: Invalid argument


An inspection of the service file shows:

# cat /usr/lib/systemd/system/ip6tables.service                             
[Unit]                                                                                                   
Description=IPv6 firewall with ip6tables                                                                 
After=syslog.target,iptables.service                  
...


According to the systemd.unit man page, the section for 'After=' starts off with:

"These two settings expect a space-separated list of unit names."


I believe the 'After=' section for the ip6tables.service file should look like:

After=syslog.target iptables.service

This was observed using RHEL Atomic Host 7.4.2 with iptables-services-1.4.21-18.2.el7_4.x86_64

Comment 2 Micah Abbott 2017-10-06 20:34:08 UTC
I edited the ip6tables.service file with the new value for 'After=' and put it in /etc/systemd/system

# cat /etc/systemd/system/ip6tables.service
[Unit]
Description=IPv6 firewall with ip6tables
After=syslog.target iptables.service
AssertPathExists=/etc/sysconfig/ip6tables

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/libexec/iptables/ip6tables.init start
ExecReload=/usr/libexec/iptables/ip6tables.init reload
ExecStop=/usr/libexec/iptables/ip6tables.init stop
Environment=BOOTUP=serial
Environment=CONSOLETYPE=serial
StandardOutput=syslog
StandardError=syslog

[Install]
WantedBy=basic.target


When I did 'systemctl daemon-reload', the error previously found in the journal did not occur.

Comment 3 Phil Sutter 2017-10-09 12:58:16 UTC
Hi Micah,

Thanks for reporting. Strangely, this error message doesn't occur when both units are restarted at the same time using 'systemctl restart iptables ip6tables'.

Anyway, the fix is trivial. This probably should be added to 7.4.z as well since it contains the same piece of code.

Thanks, Phil

Comment 5 Robert Scheck 2017-10-21 23:31:56 UTC
Cross-filed ticket 01903155 on the Red Hat customer portal.

Comment 6 Phil Sutter 2017-10-23 15:20:42 UTC
*** Bug 1504647 has been marked as a duplicate of this bug. ***

Comment 8 Yaniv Kaul 2017-10-23 15:48:38 UTC
I've just seen it in oVirt (RHV downstream).

Comment 9 Phil Sutter 2017-10-25 20:57:39 UTC
This issue has been addressed as follow-up fix to Bug 1486803.

Comment 10 Phil Sutter 2017-10-25 21:00:21 UTC
Proposing this bug for z-stream.

Comment 12 Phil Sutter 2017-10-25 21:58:55 UTC
*** Bug 1505043 has been marked as a duplicate of this bug. ***

Comment 14 shyam.biradar 2018-01-01 11:28:54 UTC
Hi,

How we I get this fix? We have updated our packages to latest on RHEL7.4 and still we have issue on our system.
We still have 1.4.21 version of iptables-services package. 

Installed Packages
Name        : iptables-services
Arch        : x86_64
Version     : 1.4.21
Release     : 18.2.el7_4
Size        : 25 k
Repo        : installed
From repo   : rhel-7-server-rpms
Summary     : iptables and ip6tables services for iptables
URL         : http://www.netfilter.org/
License     : GPLv2
Description : iptables services for IPv4 and IPv6
            :
            : This package provides the services iptables and ip6tables that have been split
            : out of the base package since they are not active by default anymore.

Comment 15 Harald Reindl 2018-01-01 11:42:27 UTC
just edit the unit file in the meantime and there is no good reason to clone it to /etc because that would prevent future updates

hopefully the guys at redhat become some basic education about their own operating system - that's at least the third time some crap makes it into unit files where the one which did the change didn't systemctl daemon-reload and read his sys logs before put it into a package and every bug at RHEL/CentOS takes ages to get fixed

Comment 16 Harald Reindl 2018-01-01 11:56:11 UTC
@Phil Sutter "Strangely, this error message doesn't occur when both units are restarted at the same time using 'systemctl restart iptables ip6tables'"

are you kidding me?

units are reloaded with "systemctl daemon-reload" and then the warning fires while "systemctl restart" only complains when the unit on disk was changed since the last reload which is a differnt story

you guys please learn grep your syslogs for "error", "alert" and "warn" after changes and before appy them to packages which would reduce the number of bugs and reports

[root@srv-rhsoft:~]$ cat /scripts/system-errors.sh
#!/usr/bin/bash
dmesg | grep -i warn
dmesg | grep -i fail
dmesg | grep -i error
cat /var/log/messages | grep -i warn
cat /var/log/messages | grep -i fail
cat /var/log/messages | grep -i error

Comment 17 shyam.biradar 2018-01-01 12:28:35 UTC
Thanks Herald. I know workaround, but I was looking for solution from upstream. But looks like it is not in the release yet.

Comment 18 shyam.biradar 2018-01-01 12:29:01 UTC
Thanks Herald. I know workaround, but I was looking for solution from upstream. But looks like it is not in the release yet.

Comment 19 shyam.biradar 2018-01-01 12:29:20 UTC
Thanks Herald. I know workaround, but I was looking for solution from upstream. But looks like it is not in the release yet.

Comment 22 Phil Sutter 2018-02-17 14:55:34 UTC
*** Bug 1541501 has been marked as a duplicate of this bug. ***

Comment 24 errata-xmlrpc 2018-04-10 11:28:02 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:0715


Note You need to log in before you can comment on or make changes to this bug.