Description of problem: IPTables-libiptc perl module does not deal with xtables lock file (/run/xtables.lock) properly. Upon a call of IPTables::libiptc::init() a lock file is created. But this lock file is not removed after commit(). It is actually being recreated after each iptables_do_command() call. As a result, any script using this module will get stuck on the second invocation of iptables_do_command, as the lock file will be already created at this time. It will wait forever for a release of this lock file which would never happen. Version-Release number of selected component (if applicable): 0.52-27.fc29 How reproducible: Always Steps to Reproduce: 1.a) Run the simple perl code: use IPTables::libiptc; my $filter = IPTables::libiptc::init('filter'); $filter->commit(); #an empty commit 2.a) ls /run/xtables.lock 1.b) If you add iptables_do_command() the script will never finish: $| = 1; use IPTables::libiptc; my $filter = IPTables::libiptc::init('filter'); print "debug: after init\n"; $filter->iptables_do_command(['--flush', "OUTPUT"]); print "debug: after the first flush\n"; $filter->iptables_do_command(['--flush', "OUTPUT"]); # a wait occurs here print "debug: after the second flush\n"; $filter->commit(); Actual results: a) Lock file persists after the script has finished. b) Lock file prevents script from being finished. The messages printed: debug: after init debug: after the first flush Another app is currently holding the xtables lock; still -9s 0us time ahead to have a chance to grab the lock... Another app is currently holding the xtables lock; still -19s 0us time ahead to have a chance to grab the lock... [...] Expected results: No self-locking behaviour. xtables.lock removed after all objects called ->commit() or the script has finished. Additional info: - From my inspection perl-IPTables-libiptc has the most recent patch against iptables 1.6.1, which is older than 1.8.0 shipped with FC29. - There was no such problem in FC26 which ships older iptables 1.6.x - The same version is in rawhide, but I have not tested it
I wonder that the Perl worked so far. Upstream was unable to provide any fix in last 8 years and claimed guilty iptables upstream that it does not provide a library. iptables upstream postponed making the library as the people moved to firewalld and nftables. If I recall correctly, iptables 1.6 did not perform locking correctly and did not enforce it. Perl module never bothered with any locking. It seems that the recent iptables changed the locking. Not only they force it, they also make it difficult for use as a library. E.g. the locking subroutine exits current program if it times out. This is unacceptable for the Perl module. Reading the code it seems as iptables's do_command4() obtained another argument for enforcing the locking and the Perl module does not specify it. If I disable locking, it works. I think this is the easiest fix without a risk of exiting a program.
perl-IPTables-libiptc-0.52-28.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-f0bf1ecc73
perl-IPTables-libiptc-0.52-26.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2019-c60748c7fb
Yes, you are right about the upstream. Fedora was bundling patching it with increasing versions of bundled iptables, so I wondered that it might be enough to continue this with iptables 1.8. Currently there is a version mismatch in the bundled version (1.6.1) and the system one. Yes, the perl module is ignorant about locking.
Installed perl-IPTables-libiptc-0.52-28.fc29. Tested. No lockfile is being created and there is no wait. It works for me. Thank you.
perl-IPTables-libiptc-0.52-28.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-f0bf1ecc73
perl-IPTables-libiptc-0.52-26.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-c60748c7fb
perl-IPTables-libiptc-0.52-26.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
perl-IPTables-libiptc-0.52-28.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.