5d51ff6dd7
A problem may occur if puppet attempts to inject a firewall rule while the underlying iptables/ip6tables has existing rules which use the --random-fully flag in the NAT table. The issue occurs because puppet-firewall first makes a call to iptables-save/ip6tables-save to parse the existing rules (to determine if the rule already exists). If it finds a rule with --random-fully, it will immediately bail out. The current version(s) of puppet-firewall in StarlingX are old enough that they don't have parsing logic for the --random-fully flag that was initially supported in iptables version 1.6.2+. Now that StarlingX uses iptables 1.8.4, we must account for the possibility that various components (ie. kubernetes) will make use of --random-fully rules. This feature has been implemented upstream in the following commits: https://github.com/puppetlabs/puppetlabs-firewall/commits/ 9a4bc6a81cf0cd4a56ba458fadac830a2c4df529 0ea2b74c0b4a451a37bae8c2ff105b72481ab485 The above commits have been ported back to: CentOS: puppet-firewall-1.8.2 Debian: puppetlabs-firewall-1.12.0 Since StarlingX does not currently build it's own version of puppet-firewall in either CentOS or Debian, this commit also contains the infrastructure to do so. Testing: Note: Since the issue is intermittent on unlock, the functional tests were performed with a custom runtime manifest that installed a dummy iptables/ip6tables rule when an interface was modified. At this time, it was guaranteed that there were rules with the --random-fully flag present. CentOS: Package build: PASS Present in iso: PASS IPv4 functional test (iptables): PASS IPv6 functional test (ip6tables): PASS Debian: Package build: PASS Present in iso: PASS IPv4 functional test (iptables): PASS IPv6 functional test (ip6tables): PASS Closes-Bug: #1971900 Signed-off-by: Steven Webster <steven.webster@windriver.com> Change-Id: I7dbb9e1b99d95df0aa5a7db7aa22c3c314253788
45 lines
1.5 KiB
Plaintext
45 lines
1.5 KiB
Plaintext
anaconda-21.48.22.147-1.el7.centos.src.rpm
|
|
cloud-init-0.7.9-24.el7.centos.1.src.rpm
|
|
dhcp-4.2.5-82.el7.centos.src.rpm
|
|
dnsmasq-2.76-7.el7.src.rpm
|
|
facter-2.4.4-4.el7.src.rpm
|
|
grub2-2.02-0.86.el7.centos.src.rpm
|
|
grubby-8.28-25.el7.src.rpm
|
|
haproxy-1.5.18-8.el7.src.rpm
|
|
initscripts-9.49.46-1.el7.src.rpm
|
|
libevent-2.0.21-4.el7.src.rpm
|
|
lighttpd-1.4.54-1.el7.src.rpm
|
|
linuxptp-2.0-2.el7.src.rpm
|
|
logrotate-3.8.6-17.el7.src.rpm
|
|
net-tools-2.0-0.24.20131004git.el7.src.rpm
|
|
ntp-4.2.6p5-29.el7.centos.2.src.rpm
|
|
openldap-2.4.44-20.el7.src.rpm
|
|
openssh-7.4p1-21.el7.src.rpm
|
|
parted-3.1-29.el7.src.rpm
|
|
puppet-4.8.2-1.el7.src.rpm
|
|
puppet-ceph-2.4.1-1.el7.src.rpm
|
|
puppet-firewall-1.8.2-2.2f892e9git.el7.src.rpm
|
|
puppet-haproxy-1.5.0-4.6ffcb07git.el7.src.rpm
|
|
puppet-horizon-11.5.0-1.el7.src.rpm
|
|
puppet-keystone-11.3.0-1.el7.src.rpm
|
|
puppet-openstacklib-11.5.0-1.el7.src.rpm
|
|
puppet-oslo-11.3.0-1.el7.src.rpm
|
|
puppet-rabbitmq-5.6.0-4.5ac45degit.el7.src.rpm
|
|
puppet-staging-1.0.4-1.b466d93git.el7.src.rpm
|
|
puppet-stdlib-4.18.0-2.el7.src.rpm
|
|
python-docker-3.3.0-1.el7.src.rpm
|
|
python-keyring-5.7.1-1.el7.src.rpm
|
|
python-kubernetes-8.0.0-8.el7.src.rpm
|
|
python-psycopg2-2.5.1-3.el7.src.rpm
|
|
python-voluptuous-0.8.9-1.el7.src.rpm
|
|
resource-agents-4.1.1-12.el7_6.7.src.rpm
|
|
setup-2.8.71-10.el7.src.rpm
|
|
shim-15-1.el7.centos.src.rpm
|
|
shim-signed-15-1.el7.centos.src.rpm
|
|
sudo-1.8.23-10.el7_9.1.src.rpm
|
|
systemd-219-78.el7_9.3.src.rpm
|
|
tboot-1.9.6-3.el7.src.rpm
|
|
tpm2-tools-3.0.4-2.el7.src.rpm
|
|
tzdata-2021e-1.el7.src.rpm
|
|
watchdog-5.13-12.el7.src.rpm
|