Bug 11127 - shorewall start fails - kernel/iptables do not include state match support
Summary: shorewall start fails - kernel/iptables do not include state match support
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: i586 Linux
Priority: Normal major
Target Milestone: ---
Assignee: Thomas Backlund
QA Contact:
URL:
Whiteboard: 4alpha2
Keywords:
Depends on:
Blocks:
 
Reported: 2013-09-01 18:33 CEST by Dave Hodgins
Modified: 2016-01-24 12:23 CET (History)
9 users (show)

See Also:
Source RPM: iptables-1.4.20-1.mga4.src.rpm
CVE:
Status comment:


Attachments
Compressed contents of /etc/shorewall (5.49 KB, application/octet-stream)
2013-09-02 23:17 CEST, Dave Hodgins
Details
Debugging output (10.48 KB, text/plain)
2013-09-03 22:12 CEST, Dave Hodgins
Details
Compressed output of journalctl -a (35.11 KB, application/octet-stream)
2013-09-03 22:24 CEST, Dave Hodgins
Details
Compressed output of journalctl -b from 2nd boot after install (17.67 KB, application/octet-stream)
2013-09-03 23:19 CEST, Dave Hodgins
Details

Description Dave Hodgins 2013-09-01 18:33:57 CEST
From systemctl -a status shorewall.service
Sep 01 12:16:52 localhost shorewall[1371]: ERROR: Your kernel/iptables do not include state match support. No version of Shorewall will run on this system
Sep 01 12:16:52 localhost systemd[1]: shorewall.service: main process exited, code=exited, status=3/NOTIMPLEMENTED

Using 4alpha2 kde i586 live cd, in live mode.

Message was different in gnome, but as gnome won't start, can't copy/paste the
message. IIRC, it was
ERROR TC_ENABLED=Internel requires Packet Mangling in your kernel and iptables.



Reproducible: 

Steps to Reproduce:
Comment 1 Dave Hodgins 2013-09-01 18:35:28 CEST
I think this bug is a blocker for alpha2

CC: (none) => eeeemail, ennael1
Whiteboard: (none) => 4alpha2

Comment 2 David Walser 2013-09-01 20:45:43 CEST
CC'ing Oden who updated the iptables package.

CC: (none) => oe

Comment 3 David Walser 2013-09-02 02:41:53 CEST
blino just fixed something in iptables.  I'm not sure if it was meant to address this issue.

CC: (none) => mageia

Comment 4 Oden Eriksson 2013-09-02 11:57:03 CEST
Do you still get this error?

If so please attach your shorewall config to this bugreport.
Comment 5 Dave Hodgins 2013-09-02 23:17:43 CEST
Created attachment 4313 [details]
Compressed contents of /etc/shorewall

Note that this is a live cd, running in live mode, so any config changes
were done by /usr/sbin/finish-install.
Comment 6 Dave Hodgins 2013-09-02 23:49:18 CEST
Note that this only occurs in live mode. Once installed on
the vb hard drive, and the network configured, shorewall
does start ok.
Comment 7 Dave Hodgins 2013-09-03 00:02:14 CEST
This is really strange. I just booted the live cd again,
and this time shorewall started ok.

As it only seems to affect live mode, and it's inconsistent,
I'm lowering the priority.

Severity: critical => minor

Comment 8 Dave Hodgins 2013-09-03 22:12:07 CEST
Created attachment 4319 [details]
Debugging output

It's a timing problem. Happened on first boot after installing from the gnome live cd (2nd build). Starting shorewall works after system is running.

Attached is the output of journalctl -a -b |grep -e finish -e eth0 -e enp0s3 -e shorewall -e iptables
Comment 9 Dave Hodgins 2013-09-03 22:24:21 CEST
Created attachment 4320 [details]
Compressed output of journalctl -a
Comment 10 Dave Hodgins 2013-09-03 23:19:34 CEST
Created attachment 4321 [details]
Compressed output of journalctl -b from 2nd boot after install

Doesn't just affect live mode and 1st boot after install.

Here's the output of journalctl -b from the 2nd (or 3rd) boot, after
install.
Comment 11 Dave Hodgins 2013-09-03 23:20:41 CEST
Raising the severity again, as it isn't as limited as it appeared before.

Severity: minor => major

Comment 12 claire robinson 2013-09-06 11:22:14 CEST
Confirmed here. shorewall fails to start 4alpha2 DVD 64
Comment 13 AL13N 2014-01-19 22:07:05 CET
is this really a timing issue? can this be fixed by systemd "after=" stuff?

perhaps systemd-analyze plot in those cases where it happens and where it doesn't happen could be used...


what is the chance that NetworkManager is re-reloading the kernel modules to be used in iptables/ip6tables?

CC: (none) => alien

Comment 14 Dick Gevers 2014-02-01 14:12:59 CET
@davidwhodgins

IMHO this bug is old. If you could close it: it is also listed in the errata ?

Thanks !

CC: (none) => dvgevers

Comment 15 Florian Hubold 2014-02-03 22:12:34 CET
Can somebody please provide a more precise description for the Errata, or remove it from Errata when it doesn't happen anymore with final?

Otherwise we get questions like https://forums.mageia.org/en/viewtopic.php?f=7&t=6857

CC: (none) => doktor5000

Comment 16 Samuel Verschelde 2014-02-04 14:31:31 CET
AFAIK it's fixed. Removing from Erratas, please add back with explanations if still valid.

CC: (none) => stormi

Comment 17 Nic Baxter 2016-01-24 12:23:26 CET
Appears to be fixed so closed

Status: NEW => RESOLVED
CC: (none) => nic
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.