Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 107105

Summary: Restarting iptables can leave modules wedged
Product: [Retired] Red Hat Linux Reporter: Need Real Name <mark>
Component: iptablesAssignee: Thomas Woerner <twoerner>
Status: CLOSED DUPLICATE QA Contact: Ben Levenson <benl>
Severity: high Docs Contact:
Priority: medium    
Version: 8.0   
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-02-21 18:59:08 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Need Real Name 2003-10-15 02:43:38 UTC 
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0.2) Gecko/20030716

Description of problem:
The module loading change in the recent iptables errata can now break a firewall
after a simple "service iptables restart". Previously modules were not
repeatedly loaded and unloaded. Currently module unloading cannot be relied on
by production servers due to the possibility of modules wedging.

I now need to comment out the module loading/unloading from the iptables init
script to reliably restart firewalls under Red Hat Linux.

I have repeated this problem under Red Hat 7.2 and 8.0 on several different
machines. I'm sure it would also occur on 9 and any other version with the
recent iptables errata.

Version-Release number of selected component (if applicable):
iptables-1.2.8-8.80.2

How reproducible:
Sometimes

Steps to Reproduce:
1.Create a firewall that relies on conntrack (and other modules)
2.service network restart
3.Repeat

Actual Results:  The init script attempts to unload the modules and fails part
way through.

Module                  Size  Used by    Not tainted
ip_conntrack               0   0  (deleted)

This partially unloaded module will prevent conntrack loading again until the
system is rebooted.

Expected Results:  The iptables modules should not be unloaded. It is too risky.
This would prevent the conntrack (or other) modules from wedging under normal
conditions.

Additional info:
Comment 1 Need Real Name 2003-10-15 03:04:24 UTC 

*** This bug has been marked as a duplicate of 103177 ***
Comment 2 Red Hat Bugzilla 2006-02-21 18:59:08 UTC 
Changed to 'CLOSED' state since 'RESOLVED' has been deprecated.