|
 |
900e1b |
From 7d5157aa5071e3620246e2d4aa80acb2d3ed30f0 Mon Sep 17 00:00:00 2001
|
|
|
900e1b |
From: Pavel Moravec <pmoravec@redhat.com>
|
|
|
900e1b |
Date: Tue, 28 Sep 2021 22:44:52 +0200
|
|
|
900e1b |
Subject: [PATCH] [networking] prevent iptables-save commands to load nf_tables
|
|
|
900e1b |
kmod
|
|
|
900e1b |
|
|
|
900e1b |
If iptables has built-in nf_tables kmod, then
|
|
|
900e1b |
'ip netns <foo> iptables-save' command requires the kmod which must
|
|
|
900e1b |
be guarded by predicate.
|
|
|
900e1b |
|
|
|
900e1b |
Analogously for ip6tables.
|
|
|
900e1b |
|
|
|
900e1b |
Resolves: #2703
|
|
|
900e1b |
|
|
|
900e1b |
Signed-off-by: Pavel Moravec <pmoravec@redhat.com>
|
|
|
900e1b |
---
|
|
|
900e1b |
sos/report/plugins/networking.py | 29 ++++++++++++++++++++++++-----
|
|
|
900e1b |
1 file changed, 24 insertions(+), 5 deletions(-)
|
|
|
900e1b |
|
|
|
900e1b |
diff --git a/sos/report/plugins/networking.py b/sos/report/plugins/networking.py
|
|
|
900e1b |
index c80ae719..1237f629 100644
|
|
|
900e1b |
--- a/sos/report/plugins/networking.py
|
|
|
900e1b |
+++ b/sos/report/plugins/networking.py
|
|
|
900e1b |
@@ -182,22 +182,41 @@ class Networking(Plugin):
|
|
|
900e1b |
# per-namespace.
|
|
|
900e1b |
self.add_cmd_output("ip netns")
|
|
|
900e1b |
cmd_prefix = "ip netns exec "
|
|
|
900e1b |
- for namespace in self.get_network_namespaces(
|
|
|
900e1b |
- self.get_option("namespace_pattern"),
|
|
|
900e1b |
- self.get_option("namespaces")):
|
|
|
900e1b |
+ namespaces = self.get_network_namespaces(
|
|
|
900e1b |
+ self.get_option("namespace_pattern"),
|
|
|
900e1b |
+ self.get_option("namespaces"))
|
|
|
900e1b |
+ if (namespaces):
|
|
|
900e1b |
+ # 'ip netns exec <foo> iptables-save' must be guarded by nf_tables
|
|
|
900e1b |
+ # kmod, if 'iptables -V' output contains 'nf_tables'
|
|
|
900e1b |
+ # analogously for ip6tables
|
|
|
900e1b |
+ co = {'cmd': 'iptables -V', 'output': 'nf_tables'}
|
|
|
900e1b |
+ co6 = {'cmd': 'ip6tables -V', 'output': 'nf_tables'}
|
|
|
900e1b |
+ iptables_with_nft = (SoSPredicate(self, kmods=['nf_tables'])
|
|
|
900e1b |
+ if self.test_predicate(self,
|
|
|
900e1b |
+ pred=SoSPredicate(self, cmd_outputs=co))
|
|
|
900e1b |
+ else None)
|
|
|
900e1b |
+ ip6tables_with_nft = (SoSPredicate(self, kmods=['nf_tables'])
|
|
|
900e1b |
+ if self.test_predicate(self,
|
|
|
900e1b |
+ pred=SoSPredicate(self, cmd_outputs=co6))
|
|
|
900e1b |
+ else None)
|
|
|
900e1b |
+ for namespace in namespaces:
|
|
|
900e1b |
ns_cmd_prefix = cmd_prefix + namespace + " "
|
|
|
900e1b |
self.add_cmd_output([
|
|
|
900e1b |
ns_cmd_prefix + "ip address show",
|
|
|
900e1b |
ns_cmd_prefix + "ip route show table all",
|
|
|
900e1b |
ns_cmd_prefix + "ip -s -s neigh show",
|
|
|
900e1b |
ns_cmd_prefix + "ip rule list",
|
|
|
900e1b |
- ns_cmd_prefix + "iptables-save",
|
|
|
900e1b |
- ns_cmd_prefix + "ip6tables-save",
|
|
|
900e1b |
ns_cmd_prefix + "netstat %s -neopa" % self.ns_wide,
|
|
|
900e1b |
ns_cmd_prefix + "netstat -s",
|
|
|
900e1b |
ns_cmd_prefix + "netstat %s -agn" % self.ns_wide,
|
|
|
900e1b |
ns_cmd_prefix + "nstat -zas",
|
|
|
900e1b |
], priority=50)
|
|
|
900e1b |
+ self.add_cmd_output([ns_cmd_prefix + "iptables-save"],
|
|
|
900e1b |
+ pred=iptables_with_nft,
|
|
|
900e1b |
+ priority=50)
|
|
|
900e1b |
+ self.add_cmd_output([ns_cmd_prefix + "ip6tables-save"],
|
|
|
900e1b |
+ pred=ip6tables_with_nft,
|
|
|
900e1b |
+ priority=50)
|
|
|
900e1b |
|
|
|
900e1b |
ss_cmd = ns_cmd_prefix + "ss -peaonmi"
|
|
|
900e1b |
# --allow-system-changes is handled directly in predicate
|
|
|
900e1b |
--
|
|
|
900e1b |
2.31.1
|
|
|
900e1b |
|