[netcf-devel] ncftool fails due to bridge-nf-call-iptables turning on when bridge module loads

Laine Stump laine at laine.org
Fri Sep 17 05:17:33 UTC 2010


  On 09/16/2010 08:00 PM, Dale Bewley wrote:
> Regarding:
>
> http://fedorahosted.org/pipermail/netcf-devel/2009-December/000397.html
> https://bugzilla.redhat.com/show_bug.cgi?id=536895
>
> which discusses ncftool failing when bridge-nf-call-iptables is turned
> on, and how "off" would be a better default state for the bridge module.
>
> This is still a problem on F13.
>
> [root at tofu ~]# rpm -q netcf
> netcf-0.1.6-1.fc13.x86_64
>
> [root at tofu ~]# grep bridge-nf-call-iptables /etc/sysctl.conf
> net.bridge.bridge-nf-call-iptables = 0
>
> [root at tofu ~]# cat /proc/sys/net/bridge/bridge-nf-call-iptables
> 1
>
> [root at tofu ~]# ncftool list
> Failed to initialize netcf
> error: unspecified error
>
> [root at tofu ~]# echo 0>  /proc/sys/net/bridge/bridge-nf-call-iptables
> [root at tofu ~]# ncftool list
> eth0
> lo
>
> I suppose this is outside the realm of netcf, but perhaps ncftool could
> fail with a more helpful error? Not sure if that could also percolate
> through netcf-libs to libvirt and virsh.
>
> I have not tested in F14. Has any more thought been given to how to turn
> this off by default at the distro level?

Actually, it is supposed to be off by default (that's what the setting 
in /etc/sysctl.conf is for). The problem is that if sysctl.conf is 
loaded when the bridge module isn't, that variable (and the other 
similar ones) won't exist, so they won't be set. If the bridge module is 
loaded later, the setting from /etc/sysctl.conf isn't used until the 
next time "sysctl -a -p" is run. The bridge module init doesn't do that; 
I believe it should, and filed a bug earlier today (oops, I mean 
yesterday ;-) to that effect:

     https://bugzilla.redhat.com/show_bug.cgi?id=634736

(I've been told that a request was made to have the default for those 
variables in the bridge module be 0, but that request was denied and 
instead the requesters were told to put the desired default in 
/etc/sysctl.conf - too bad it's not honored (except by coincidence, as 
the bug report explains)).

As far as the effect of this on netcf, after several different bugs were 
filed related to this code, we discussed the merits of having netcf 
automatically modify the iptables config, and decided that it really 
isn't a good idea in many ways, so I sent a patch series to this list 
yesterday (er, day before yesterday) that removes the iptables 
modification code from netcf:

     
https://fedorahosted.org/pipermail/netcf-devel/2010-September/000459.html

The comments in those patches explains the reasoning for doing this. 
Unless there are objections to this within the next day or so, I'll be 
pushing those patches and making a new netcf release for all Fedora 
releases with netcf that are still being supported (so if you have an 
argument against removal, bring it up now! ;-)

(In the meantime, once libvirt is running, if you run "sysctl -a -p", 
the values will be loaded from there, and you can then successfully run 
ncftool (or restart libvirtd, then run virsh).



More information about the netcf-devel mailing list