Bug 1829104
| Summary: | With FirewallBackend=iptables iptables in RHEL 8.2 fails direct rules with: Error: gen_chain_rules() missing 1 required positional argument: 'transaction' | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | James Hartsock <hartsjc> |
| Component: | firewalld | Assignee: | Eric Garver <egarver> |
| Status: | CLOSED ERRATA | QA Contact: | Jiri Peska <jpeska> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.2 | CC: | todoleza |
| Target Milestone: | rc | Keywords: | Regression |
| Target Release: | 8.0 | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | firewalld-0.8.2-2.el8 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-04 01:40:13 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
firewalld-0.8.0-2.el8 looks to be the first GA version that has this behavior. firewalld on Fedora 31 is still 0.7.4 and thus issue not seen there. Upstream:
8d3469041737 ("test(direct): rule in a zone chain")
9eed8ee763c6 ("fix(direct): rule in a zone chain")
Using upstream, see the following. $ git remote get-url origin https://github.com/firewalld/firewalld.git $ git log --oneline --grep 'rhbz 1829104' f88617bb205c test(direct): rule in a zone chain f2941a82592b fix(direct): rule in a zone chain Did an rpmbuild, and verified the poliby_from_chain() is now in fw_zone.py but still seeing the error. Is there test package want me to try? (In reply to James Hartsock from comment #6) > Using upstream, see the following. > > $ git remote get-url origin > https://github.com/firewalld/firewalld.git > > $ git log --oneline --grep 'rhbz 1829104' > f88617bb205c test(direct): rule in a zone chain > f2941a82592b fix(direct): rule in a zone chain > > > > Did an rpmbuild, and verified the poliby_from_chain() is now in fw_zone.py > but still seeing the error. Is there test package want me to try? I don't have a test package. You did an rpmbuild of what? Are you sure you restarted the daemon? (In reply to Eric Garver from comment #7) > (In reply to James Hartsock from comment #6) > > Using upstream, see the following. > > > > $ git remote get-url origin > > https://github.com/firewalld/firewalld.git > > > > $ git log --oneline --grep 'rhbz 1829104' > > f88617bb205c test(direct): rule in a zone chain > > f2941a82592b fix(direct): rule in a zone chain > > > > > > > > Did an rpmbuild, and verified the poliby_from_chain() is now in fw_zone.py > > but still seeing the error. Is there test package want me to try? > > I don't have a test package. You did an rpmbuild of what? Are you sure you > restarted the daemon? Did a tar of the git clone and used the SPEC file provided in the upstream repo. # rpm -q firewalld ; grep -c policy_from_chain /usr/lib/python3.6/site-packages/firewall/core/fw_zone.py firewalld-0.8.0-4.el8.noarch 0 # dnf localupdate /tmp/*.rpm # rpm -q firewalld ; grep -c policy_from_chain /usr/lib/python3.6/site-packages/firewall/core/fw_zone.py firewalld-0.8.999-1.el8.noarch 3 # systemctl stop firewalld # systemctl start firewalld # firewall-cmd --zone=james --direct --add-rule ipv4 filter FWDI_james_allow 0 -s 172.31.0.0/24 ! -d 172.16.0.0/12 -m state --state NEW -j ACCEPT Error: COMMAND_FAILED: '/usr/sbin/iptables-restore -w -n' failed: iptables-restore: line 2 failed Please double check your FirewallBackend setting in /etc/firewalld/firewalld.conf. Your example worked for me after I set FirewalldBackend=iptables. (In reply to Eric Garver from comment #9) > Please double check your FirewallBackend setting in /etc/firewalld/firewalld.conf. Your example worked for me after I set FirewalldBackend=iptables. You are correct, I thought was on same test KVM ... but had reloaded the OS for different issue. Thank you, and sorry about that! Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (firewalld bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:4461 |
Description of problem: With FirewallBackend=iptables iptables in RHEL 8.2 fails direct rules with: Error: gen_chain_rules() missing 1 required positional argument: 'transaction' Version-Release number of selected component (if applicable): firewalld-0.8.0-4.el8.noarch How reproducible: VERY Steps to Reproduce: 1. firewall-cmd --permanent --new-zone=james 2. firewall-cmd --complete-reload 3. firewall-cmd --zone=james --direct --add-rule ipv4 filter FWDI_james_allow 0 -s 172.31.0.0/24 ! -d 172.16.0.0/12 -m state --state NEW -j ACCEPT Actual results: ============== # rpm -q firewalld firewalld-0.8.0-4.el8.noarch # firewall-cmd --permanent --new-zone=james success # firewall-cmd --complete-reload success # firewall-cmd --zone=james --direct --add-rule ipv4 filter FWDI_james_allow 0 -s 172.31.0.0/24 ! -d 172.16.0.0/12 -m state --state NEW -j ACCEPT Error: gen_chain_rules() missing 1 required positional argument: 'transaction' Expected results (8.1's 0.7.0-5.el8 version): ============================================ # rpm -q firewalld firewalld-0.7.0-5.el8.noarch # firewall-cmd --permanent --new-zone=james success # firewall-cmd --complete-reload success # firewall-cmd --zone=james --direct --add-rule ipv4 filter FWDI_james_allow 0 -s 172.31.0.0/24 ! -d 172.16.0.0/12 -m state --state NEW -j ACCEPT success Additional info: ================ If you upgrade RHEL 8.1 system that has direct rules you will get following in debug 2020-04-28 16:32:34 DEBUG1: Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/firewall/server/decorators.py", line 53, in handle_exceptions return func(*args, **kwargs) File "/usr/lib/python3.6/site-packages/firewall/server/firewalld.py", line 94, in start return self.fw.start() File "/usr/lib/python3.6/site-packages/firewall/core/fw.py", line 479, in start self._start() File "/usr/lib/python3.6/site-packages/firewall/core/fw.py", line 458, in _start self.direct.apply_direct(transaction) File "/usr/lib/python3.6/site-packages/firewall/core/fw_direct.py", line 88, in apply_direct transaction) File "/usr/lib/python3.6/site-packages/firewall/core/fw_direct.py", line 150, in set_config use_transaction=transaction) File "/usr/lib/python3.6/site-packages/firewall/core/fw_direct.py", line 263, in add_rule self._rule(True, ipv, table, chain, priority, args, transaction) File "/usr/lib/python3.6/site-packages/firewall/core/fw_direct.py", line 386, in _rule transaction) File "/usr/lib/python3.6/site-packages/firewall/core/fw_zone.py", line 210, in create_zone_base_by_chain transaction) TypeError: gen_chain_rules() missing 1 required positional argument: 'transaction' 2020-04-28 16:32:34 Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/firewall/server/decorators.py", line 53, in handle_exceptions return func(*args, **kwargs) File "/usr/lib/python3.6/site-packages/firewall/server/firewalld.py", line 94, in start return self.fw.start() File "/usr/lib/python3.6/site-packages/firewall/core/fw.py", line 479, in start self._start() File "/usr/lib/python3.6/site-packages/firewall/core/fw.py", line 458, in _start self.direct.apply_direct(transaction) File "/usr/lib/python3.6/site-packages/firewall/core/fw_direct.py", line 88, in apply_direct transaction) File "/usr/lib/python3.6/site-packages/firewall/core/fw_direct.py", line 150, in set_config use_transaction=transaction) File "/usr/lib/python3.6/site-packages/firewall/core/fw_direct.py", line 263, in add_rule self._rule(True, ipv, table, chain, priority, args, transaction) File "/usr/lib/python3.6/site-packages/firewall/core/fw_direct.py", line 386, in _rule transaction) File "/usr/lib/python3.6/site-packages/firewall/core/fw_zone.py", line 210, in create_zone_base_by_chain transaction) TypeError: gen_chain_rules() missing 1 required positional argument: 'transaction'