[netcf-devel] ncftool fails due to bridge-nf-call-iptables turning on when bridge module loads
Laine Stump
laine at laine.org
Fri Sep 17 05:17:33 UTC 2010
On 09/16/2010 08:00 PM, Dale Bewley wrote:
> Regarding:
>
> http://fedorahosted.org/pipermail/netcf-devel/2009-December/000397.html
> https://bugzilla.redhat.com/show_bug.cgi?id=536895
>
> which discusses ncftool failing when bridge-nf-call-iptables is turned
> on, and how "off" would be a better default state for the bridge module.
>
> This is still a problem on F13.
>
> [root at tofu ~]# rpm -q netcf
> netcf-0.1.6-1.fc13.x86_64
>
> [root at tofu ~]# grep bridge-nf-call-iptables /etc/sysctl.conf
> net.bridge.bridge-nf-call-iptables = 0
>
> [root at tofu ~]# cat /proc/sys/net/bridge/bridge-nf-call-iptables
> 1
>
> [root at tofu ~]# ncftool list
> Failed to initialize netcf
> error: unspecified error
>
> [root at tofu ~]# echo 0> /proc/sys/net/bridge/bridge-nf-call-iptables
> [root at tofu ~]# ncftool list
> eth0
> lo
>
> I suppose this is outside the realm of netcf, but perhaps ncftool could
> fail with a more helpful error? Not sure if that could also percolate
> through netcf-libs to libvirt and virsh.
>
> I have not tested in F14. Has any more thought been given to how to turn
> this off by default at the distro level?
Actually, it is supposed to be off by default (that's what the setting
in /etc/sysctl.conf is for). The problem is that if sysctl.conf is
loaded when the bridge module isn't, that variable (and the other
similar ones) won't exist, so they won't be set. If the bridge module is
loaded later, the setting from /etc/sysctl.conf isn't used until the
next time "sysctl -a -p" is run. The bridge module init doesn't do that;
I believe it should, and filed a bug earlier today (oops, I mean
yesterday ;-) to that effect:
https://bugzilla.redhat.com/show_bug.cgi?id=634736
(I've been told that a request was made to have the default for those
variables in the bridge module be 0, but that request was denied and
instead the requesters were told to put the desired default in
/etc/sysctl.conf - too bad it's not honored (except by coincidence, as
the bug report explains)).
As far as the effect of this on netcf, after several different bugs were
filed related to this code, we discussed the merits of having netcf
automatically modify the iptables config, and decided that it really
isn't a good idea in many ways, so I sent a patch series to this list
yesterday (er, day before yesterday) that removes the iptables
modification code from netcf:
https://fedorahosted.org/pipermail/netcf-devel/2010-September/000459.html
The comments in those patches explains the reasoning for doing this.
Unless there are objections to this within the next day or so, I'll be
pushing those patches and making a new netcf release for all Fedora
releases with netcf that are still being supported (so if you have an
argument against removal, bring it up now! ;-)
(In the meantime, once libvirt is running, if you run "sysctl -a -p",
the values will be loaded from there, and you can then successfully run
ncftool (or restart libvirtd, then run virsh).
More information about the netcf-devel
mailing list