Bug 97686 - DNS failing to punch through firewall due to indescriminate grep in ifup-post
Summary: DNS failing to punch through firewall due to indescriminate grep in ifup-post
Status: CLOSED RAWHIDE
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: initscripts   
(Show other bugs)
Version: 9
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Bill Nottingham
QA Contact: Brock Organ
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2003-06-19 11:02 UTC by Martin Ebourne
Modified: 2014-03-17 02:36 UTC (History)
1 user (show)

Fixed In Version: 7.25-1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2003-06-19 18:03:01 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Proposed patch as detailed in text (679 bytes, patch)
2003-06-19 11:03 UTC, Martin Ebourne
no flags Details | Diff

Description Martin Ebourne 2003-06-19 11:02:06 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3.1) Gecko/20030510

Description of problem:
ifup-post contains code to open the firewall for DNS replies when PEERDNS=yes.

However, there is a grep to prevent the repeated addition of DNS rules, as in:

    if ! iptables -L RH-Lokkit-0-50-INPUT -n | grep -q $nameserver ; then

This of course matches any rule which the nameserver IP address is entered for.
Hence if your DNS server (or relay) has other services (smtp, etc) which the
firewall is explicitly open for, then the nameserver entries are not added and
DNS fails to work.

I have changed mine to:

    if ! iptables -L RH-Lokkit-0-50-INPUT -n | grep -q "$nameserver.* --sport 53
" ; then

This slightly more specific grep ensures that only DNS lines are considered.

Version-Release number of selected component (if applicable):
initscripts-7.14-1

How reproducible:
Always

Comment 1 Martin Ebourne 2003-06-19 11:03:43 UTC
Created attachment 92481 [details]
Proposed patch as detailed in text

Comment 2 Bill Nottingham 2003-06-19 18:03:01 UTC
Thanks, added to CVS. Will be in 7.25-1.


Note You need to log in before you can comment on or make changes to this bug.