Bug 1534571
| Summary: | runtime rules deduplication may remove additional rules of other services | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Petr Sklenar <psklenar> | ||||
| Component: | firewalld | Assignee: | Eric Garver <egarver> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Jiri Peska <jpeska> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 7.5 | CC: | atragler, shuali, todoleza, twoerner | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | firewalld-0.5.3-1.el7 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2018-10-30 10:11:40 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1554861 | ||||||
| Attachments: |
|
||||||
/var/log/message says: Jan 15 14:37:30 localhost firewalld[760]: WARNING: '/usr/sbin/iptables-restore --wait=2 -n' failed: iptables-restore: line 2 failed Jan 15 14:37:30 localhost firewalld[760]: WARNING: '/usr/sbin/ip6tables-restore --wait=2 -n' failed: ip6tables-restore: line 2 failed Jan 15 14:37:30 localhost firewalld[760]: ERROR: COMMAND_FAILED Jan 15 14:37:34 localhost firewalld[760]: WARNING: '/usr/sbin/iptables-restore --wait=2 -n' failed: iptables-restore: line 3 failed Jan 15 14:37:34 localhost firewalld[760]: WARNING: '/usr/sbin/ip6tables-restore --wait=2 -n' failed: ip6tables-restore: line 3 failed Jan 15 14:37:34 localhost firewalld[760]: ERROR: COMMAND_FAILED present in firewalld-0.4.4.4-14.el7.noarch seems that loading permanent configuration optimizes the rules so there are no duplicate ones. that causes individual request for unloading the deduplicated ones to fail. RUNTIME firewall-cmd --add-service nfs3 --add-service nfs success [root@vm-rhel7s ~]# iptables-save | grep 2049 -A IN_public_allow -p tcp -m tcp --dport 2049 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 2049 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p udp -m udp --dport 2049 -m conntrack --ctstate NEW -j ACCEPT [root@vm-rhel7s ~]# firewall-cmd --remove-service nfs3 success [root@vm-rhel7s ~]# iptables-save | grep 2049 -A IN_public_allow -p tcp -m tcp --dport 2049 -m conntrack --ctstate NEW -j ACCEPT [root@vm-rhel7s ~]# firewall-cmd --remove-service nfs success PERMANENT->RUNTIME failure here firewall-cmd --add-service nfs --add-service nfs3 --permanent success firewall-cmd --reload iptables-save | grep 2049 -A IN_public_allow -p tcp -m tcp --dport 2049 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p udp -m udp --dport 2049 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 2049 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p udp -m udp --dport 2049 -m conntrack --ctstate NEW -j ACCEPT [root@vm-rhel7s ~]# firewall-cmd --remove-service nfs success [root@vm-rhel7s ~]# firewall-cmd --remove-service nfs3 Error: COMMAND_FAILED led 18 18:19:32 vm-rhel7s.brq.redhat.com firewalld[2373]: WARNING: '/usr/sbin/iptables-restore --wait=2 -n' failed: iptables-restore: line 2 failed led 18 18:19:32 vm-rhel7s.brq.redhat.com firewalld[2373]: WARNING: '/usr/sbin/ip6tables-restore --wait=2 -n' failed: ip6tables-restore: line 2 failed led 18 18:19:32 vm-rhel7s.brq.redhat.com firewalld[2373]: ERROR: COMMAND_FAILED Please have a look at https://github.com/firewalld/firewalld/pull/288 Upstream commit:
54835164f610 ("firewall/core/fw_transaction.py: Remove deduplication in add_rule")
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3120 |
Created attachment 1381442 [details] screencast about removing ipp or ipp-client Description of problem: firewall-config cannot remove ipp/ipp-client service Interesting is that there is port 631 in both servise Version-Release number of selected component (if applicable): rhel75.nightly firewalld-0.4.4.4-14.el7.noarch cups-1.6.3-35.el7.x86_64 How reproducible: always, tried twice, two different rhel75 Steps to Reproduce: 1. have a cups 2. firewall-config 3. add service ipp or ipp-client 4. then try to remove it, yo can remove one or another - NOT BOTH the last one cannot be remove, its probably caused that port 631/udp is part of both services see video Actual results: firewall-config writes "cannot remove" Expected results: I can remove ipp* Additional info: [root@localhost ~]# firewall-cmd --info-service=ipp ipp ports: 631/tcp 631/udp protocols: source-ports: modules: destination: [root@localhost ~]# firewall-cmd --info-service=ipp-client ipp-client ports: 631/udp protocols: source-ports: modules: destination: