Bug 1943386 - knockd: pcap: can't parse filter expression: syntax error
Summary: knockd: pcap: can't parse filter expression: syntax error
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: knock
Version: epel8
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Christos Triantafyllidis
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-03-26 00:07 UTC by Leon Fauster
Modified: 2021-10-07 18:59 UTC (History)
2 users (show)

Fixed In Version: knock-0.8-1.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-07 17:30:58 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Leon Fauster 2021-03-26 00:07:16 UTC
Description of problem:
Upcoming RHEL8.4 will show following problem (tested in centos 8 stream):

Working config in RHEL83 

rpm -qa |grep knock
knock-server-0.7.8-10.20151227git258a27e.el8.x86_64
knock-0.7.8-10.20151227git258a27e.el8.x86_64

and

tcpflags      = syn

in 

/etc/knockd.conf


Updating to RHEL8.4/CentOS Stream8

produces 

knockd[1249]: pcap: can't parse filter expression: syntax error

while starting (systemctl start knockd.service). 




Additional info:

Solution

https://github.com/jvinet/knock/commit/4a5e12b2c01bd13d8d5ece5c8cbc6139ec2de765.patch


or workaround by setting explicitly

tcpflags      = syn,!fin,!syn,!rst,!psh,!ack,!urg



###############

BTW: For having a working start process with knockd I need

cat /usr/lib/systemd/system/knockd.service.d/network.conf 
[Unit]
After=network-online.target

check: https://bugzilla.redhat.com/show_bug.cgi?id=1730634

Comment 1 Fedora Update System 2021-10-06 04:25:40 UTC
FEDORA-EPEL-2021-007682c950 has been submitted as an update to Fedora EPEL 8. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-007682c950

Comment 2 Fedora Update System 2021-10-06 17:46:46 UTC
FEDORA-EPEL-2021-007682c950 has been pushed to the Fedora EPEL 8 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-007682c950

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 3 Leon Fauster 2021-10-07 12:13:11 UTC
This update still suffers from a missing correct boot order. 

Description:
https://bugzilla.redhat.com/show_bug.cgi?id=1730634


Solution:
https://bugzilla.redhat.com/attachment.cgi?id=1729711&action=diff

Tested:
Yes, against current version 
knock-server-0.8-1.el8.x86_64

How:
mkdir /usr/lib/systemd/system/knockd.service.d/
touch /usr/lib/systemd/system/knockd.service.d/network.conf
cat /usr/lib/systemd/system/knockd.service.d/network.conf
[Unit]
After=network.target network-online.target
Wants=network.target network-online.target

Comment 4 Carl George 🤠 2021-10-07 16:20:41 UTC
Leon if you know the fix you can submit it as a pull request.

https://src.fedoraproject.org/rpms/knock/tree/epel8

That's what I did to update it to 0.8 to resolve this bug.

https://src.fedoraproject.org/rpms/knock/pull-request/1

I'm not a maintainer of the knock package, I just merged my own pull request via my proven packager permissions after not getting a response from the maintainer.

Comment 5 Fedora Update System 2021-10-07 17:30:58 UTC
FEDORA-EPEL-2021-007682c950 has been pushed to the Fedora EPEL 8 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 Leon Fauster 2021-10-07 18:59:02 UTC
(In reply to Carl George 🤠 from comment #4)
> Leon if you know the fix you can submit it as a pull request.
> 
> https://src.fedoraproject.org/rpms/knock/tree/epel8
> 
> That's what I did to update it to 0.8 to resolve this bug.
> 
> https://src.fedoraproject.org/rpms/knock/pull-request/1
> 
> I'm not a maintainer of the knock package, I just merged my own pull request
> via my proven packager permissions after not getting a response from the
> maintainer.


Hi Carl, thanks for the pointer. I'm not fedora nor epel packager but I will take
a look at it. Above all I need to understand this contribution process at all.


Note You need to log in before you can comment on or make changes to this bug.