https://bugzilla.redhat.com/show_bug.cgi?id=1670047
Bug ID: 1670047 Summary: xtables.lock is not removed Product: Fedora Version: 29 Hardware: x86_64 OS: Linux Status: NEW Component: perl-IPTables-libiptc Severity: medium Assignee: ppisar@redhat.com Reporter: balwierz@gmail.com QA Contact: extras-qa@fedoraproject.org CC: perl-devel@lists.fedoraproject.org, ppisar@redhat.com Target Milestone: --- Classification: Fedora
Description of problem: IPTables-libiptc perl module does not deal with xtables lock file (/run/xtables.lock) properly. Upon a call of IPTables::libiptc::init() a lock file is created. But this lock file is not removed after commit(). It is actually being recreated after each iptables_do_command() call.
As a result, any script using this module will get stuck on the second invocation of iptables_do_command, as the lock file will be already created at this time. It will wait forever for a release of this lock file which would never happen.
Version-Release number of selected component (if applicable): 0.52-27.fc29
How reproducible: Always
Steps to Reproduce: 1.a) Run the simple perl code:
use IPTables::libiptc; my $filter = IPTables::libiptc::init('filter'); $filter->commit(); #an empty commit
2.a) ls /run/xtables.lock
1.b) If you add iptables_do_command() the script will never finish:
$| = 1; use IPTables::libiptc; my $filter = IPTables::libiptc::init('filter'); print "debug: after init\n"; $filter->iptables_do_command(['--flush', "OUTPUT"]); print "debug: after the first flush\n"; $filter->iptables_do_command(['--flush', "OUTPUT"]); # a wait occurs here print "debug: after the second flush\n"; $filter->commit();
Actual results: a) Lock file persists after the script has finished. b) Lock file prevents script from being finished. The messages printed: debug: after init debug: after the first flush Another app is currently holding the xtables lock; still -9s 0us time ahead to have a chance to grab the lock... Another app is currently holding the xtables lock; still -19s 0us time ahead to have a chance to grab the lock... [...]
Expected results: No self-locking behaviour. xtables.lock removed after all objects called ->commit() or the script has finished.
Additional info: - From my inspection perl-IPTables-libiptc has the most recent patch against iptables 1.6.1, which is older than 1.8.0 shipped with FC29. - There was no such problem in FC26 which ships older iptables 1.6.x - The same version is in rawhide, but I have not tested it
https://bugzilla.redhat.com/show_bug.cgi?id=1670047
balwierz@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|xtables.lock is not removed |upon script completion | |xtables.lock is not | |removed; multiple calls of | |IPTables::libiptc::iptables | |_do_command() result in an | |infinite wait loop
https://bugzilla.redhat.com/show_bug.cgi?id=1670047
balwierz@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|upon script completion |perl-IPTables-libiptc-0.52- |xtables.lock is not |27.fc29: upon script |removed; multiple calls of |completion xtables.lock is |IPTables::libiptc::iptables |not removed; multiple calls |_do_command() result in an |of |infinite wait loop |IPTables::libiptc::iptables | |_do_command() result in an | |infinite wait loop
https://bugzilla.redhat.com/show_bug.cgi?id=1670047
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED
--- Comment #1 from Petr Pisar ppisar@redhat.com --- I wonder that the Perl worked so far. Upstream was unable to provide any fix in last 8 years and claimed guilty iptables upstream that it does not provide a library. iptables upstream postponed making the library as the people moved to firewalld and nftables.
If I recall correctly, iptables 1.6 did not perform locking correctly and did not enforce it. Perl module never bothered with any locking. It seems that the recent iptables changed the locking. Not only they force it, they also make it difficult for use as a library. E.g. the locking subroutine exits current program if it times out. This is unacceptable for the Perl module.
Reading the code it seems as iptables's do_command4() obtained another argument for enforcing the locking and the Perl module does not specify it. If I disable locking, it works. I think this is the easiest fix without a risk of exiting a program.
https://bugzilla.redhat.com/show_bug.cgi?id=1670047
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |MODIFIED Fixed In Version| |perl-IPTables-libiptc-0.52- | |28.fc30
https://bugzilla.redhat.com/show_bug.cgi?id=1670047
--- Comment #2 from Fedora Update System updates@fedoraproject.org --- perl-IPTables-libiptc-0.52-28.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-f0bf1ecc73
https://bugzilla.redhat.com/show_bug.cgi?id=1670047
--- Comment #3 from Fedora Update System updates@fedoraproject.org --- perl-IPTables-libiptc-0.52-26.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2019-c60748c7fb
https://bugzilla.redhat.com/show_bug.cgi?id=1670047
--- Comment #4 from balwierz@gmail.com --- Yes, you are right about the upstream. Fedora was bundling patching it with increasing versions of bundled iptables, so I wondered that it might be enough to continue this with iptables 1.8. Currently there is a version mismatch in the bundled version (1.6.1) and the system one. Yes, the perl module is ignorant about locking.
https://bugzilla.redhat.com/show_bug.cgi?id=1670047
--- Comment #5 from balwierz@gmail.com --- Installed perl-IPTables-libiptc-0.52-28.fc29. Tested. No lockfile is being created and there is no wait.
It works for me. Thank you.
https://bugzilla.redhat.com/show_bug.cgi?id=1670047
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |ON_QA
--- Comment #6 from Fedora Update System updates@fedoraproject.org --- perl-IPTables-libiptc-0.52-28.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-f0bf1ecc73
https://bugzilla.redhat.com/show_bug.cgi?id=1670047
--- Comment #7 from Fedora Update System updates@fedoraproject.org --- perl-IPTables-libiptc-0.52-26.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-c60748c7fb
https://bugzilla.redhat.com/show_bug.cgi?id=1670047
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Fixed In Version|perl-IPTables-libiptc-0.52- |perl-IPTables-libiptc-0.52- |28.fc30 |28.fc30 | |perl-IPTables-libiptc-0.52- | |26.fc28 Resolution|--- |ERRATA Last Closed| |2019-02-08 02:29:30
--- Comment #8 from Fedora Update System updates@fedoraproject.org --- perl-IPTables-libiptc-0.52-26.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1670047
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version|perl-IPTables-libiptc-0.52- |perl-IPTables-libiptc-0.52- |28.fc30 |28.fc30 |perl-IPTables-libiptc-0.52- |perl-IPTables-libiptc-0.52- |26.fc28 |26.fc28 | |perl-IPTables-libiptc-0.52- | |28.fc29
--- Comment #9 from Fedora Update System updates@fedoraproject.org --- perl-IPTables-libiptc-0.52-28.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.
perl-devel@lists.fedoraproject.org