5d51ff6dd7
A problem may occur if puppet attempts to inject a firewall rule while the underlying iptables/ip6tables has existing rules which use the --random-fully flag in the NAT table. The issue occurs because puppet-firewall first makes a call to iptables-save/ip6tables-save to parse the existing rules (to determine if the rule already exists). If it finds a rule with --random-fully, it will immediately bail out. The current version(s) of puppet-firewall in StarlingX are old enough that they don't have parsing logic for the --random-fully flag that was initially supported in iptables version 1.6.2+. Now that StarlingX uses iptables 1.8.4, we must account for the possibility that various components (ie. kubernetes) will make use of --random-fully rules. This feature has been implemented upstream in the following commits: https://github.com/puppetlabs/puppetlabs-firewall/commits/ 9a4bc6a81cf0cd4a56ba458fadac830a2c4df529 0ea2b74c0b4a451a37bae8c2ff105b72481ab485 The above commits have been ported back to: CentOS: puppet-firewall-1.8.2 Debian: puppetlabs-firewall-1.12.0 Since StarlingX does not currently build it's own version of puppet-firewall in either CentOS or Debian, this commit also contains the infrastructure to do so. Testing: Note: Since the issue is intermittent on unlock, the functional tests were performed with a custom runtime manifest that installed a dummy iptables/ip6tables rule when an interface was modified. At this time, it was guaranteed that there were rules with the --random-fully flag present. CentOS: Package build: PASS Present in iso: PASS IPv4 functional test (iptables): PASS IPv6 functional test (ip6tables): PASS Debian: Package build: PASS Present in iso: PASS IPv4 functional test (iptables): PASS IPv6 functional test (ip6tables): PASS Closes-Bug: #1971900 Signed-off-by: Steven Webster <steven.webster@windriver.com> Change-Id: I7dbb9e1b99d95df0aa5a7db7aa22c3c314253788
34 lines
1.0 KiB
Diff
34 lines
1.0 KiB
Diff
From 5df5c090b1a87421f567cc2f79046ec4852f9597 Mon Sep 17 00:00:00 2001
|
|
From: Steven Webster <steven.webster@windriver.com>
|
|
Date: Fri, 29 Apr 2022 14:57:50 -0400
|
|
Subject: [PATCH] Add support for random fully flag
|
|
|
|
Signed-off-by: Steven Webster <steven.webster@windriver.com>
|
|
---
|
|
SPECS/puppet-firewall.spec | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/SPECS/puppet-firewall.spec b/SPECS/puppet-firewall.spec
|
|
index f5925f1..87d0410 100644
|
|
--- a/SPECS/puppet-firewall.spec
|
|
+++ b/SPECS/puppet-firewall.spec
|
|
@@ -15,6 +15,7 @@ License: ASL 2.0
|
|
URL: http://github.com/puppetlabs/puppetlabs-firewall
|
|
|
|
Source0: https://github.com/puppetlabs/%{upstream_name}/archive/%{commit}.tar.gz#/%{upstream_name}-%{shortcommit}.tar.gz
|
|
+Patch0001: 0001-Add-support-for-random-fully-flag.patch
|
|
|
|
BuildArch: noarch
|
|
|
|
@@ -25,6 +26,7 @@ Manages Firewalls such as iptables
|
|
|
|
%prep
|
|
%setup -q -n %{upstream_name}-%{upstream_version}
|
|
+%patch0001 -p1
|
|
|
|
find . -type f -name ".*" -exec rm {} +
|
|
find . -size 0 -exec rm {} +
|
|
--
|
|
2.29.2
|
|
|