On 09/16/2010 08:00 PM, Dale Bewley wrote:
Regarding:
http://fedorahosted.org/pipermail/netcf-devel/2009-December/000397.html
https://bugzilla.redhat.com/show_bug.cgi?id=536895
which discusses ncftool failing when bridge-nf-call-iptables is turned
on, and how "off" would be a better default state for the bridge module.
This is still a problem on F13.
[root@tofu ~]# rpm -q netcf
netcf-0.1.6-1.fc13.x86_64
[root@tofu ~]# grep bridge-nf-call-iptables /etc/sysctl.conf
net.bridge.bridge-nf-call-iptables = 0
[root@tofu ~]# cat /proc/sys/net/bridge/bridge-nf-call-iptables
1
[root@tofu ~]# ncftool list
Failed to initialize netcf
error: unspecified error
[root@tofu ~]# echo 0> /proc/sys/net/bridge/bridge-nf-call-iptables
[root@tofu ~]# ncftool list
eth0
lo
I suppose this is outside the realm of netcf, but perhaps ncftool could
fail with a more helpful error? Not sure if that could also percolate
through netcf-libs to libvirt and virsh.
I have not tested in F14. Has any more thought been given to how to turn
this off by default at the distro level?
Actually, it is supposed to be off by default (that's what the setting
in /etc/sysctl.conf is for). The problem is that if sysctl.conf is
loaded when the bridge module isn't, that variable (and the other
similar ones) won't exist, so they won't be set. If the bridge module is
loaded later, the setting from /etc/sysctl.conf isn't used until the
next time "sysctl -a -p" is run. The bridge module init doesn't do that;
I believe it should, and filed a bug earlier today (oops, I mean
yesterday ;-) to that effect:
https://bugzilla.redhat.com/show_bug.cgi?id=634736
(I've been told that a request was made to have the default for those
variables in the bridge module be 0, but that request was denied and
instead the requesters were told to put the desired default in
/etc/sysctl.conf - too bad it's not honored (except by coincidence, as
the bug report explains)).
As far as the effect of this on netcf, after several different bugs were
filed related to this code, we discussed the merits of having netcf
automatically modify the iptables config, and decided that it really
isn't a good idea in many ways, so I sent a patch series to this list
yesterday (er, day before yesterday) that removes the iptables
modification code from netcf:
https://fedorahosted.org/pipermail/netcf-devel/2010-September/000459.html
The comments in those patches explains the reasoning for doing this.
Unless there are objections to this within the next day or so, I'll be
pushing those patches and making a new netcf release for all Fedora
releases with netcf that are still being supported (so if you have an
argument against removal, bring it up now! ;-)
(In the meantime, once libvirt is running, if you run "sysctl -a -p",
the values will be loaded from there, and you can then successfully run
ncftool (or restart libvirtd, then run virsh).