From 31e0467885ef3986b476ea070941a786b426f298 Mon Sep 17 00:00:00 2001 From: Pavel Moravec Date: Fri, 8 May 2020 14:06:41 +0200 Subject: [PATCH] [networking] collect iptables when proper kernel modules loaded Since kernel-4, iptables / ip6tables is newly provided by nf_tables kernel module. Therefore, collecting ip[,6]tables commands should be gated by presence of also this kernel module. Resolves: #2054 Signed-off-by: Pavel Moravec Signed-off-by: Bryan Quigley --- sos/plugins/networking.py | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/sos/plugins/networking.py b/sos/plugins/networking.py index cac6ccca..5230303d 100644 --- a/sos/plugins/networking.py +++ b/sos/plugins/networking.py @@ -35,22 +35,24 @@ class Networking(Plugin): ns_wide = "-W" def collect_iptable(self, tablename): - """ When running the iptables command, it unfortunately auto-loads - the modules before trying to get output. Some people explicitly - don't want this, so check if the modules are loaded before running - the command. If they aren't loaded, there can't possibly be any - relevant rules in that table """ + """ Collecting iptables rules for a table loads either kernel module + of the table name (for kernel <= 3), or nf_tables (for kernel >= 4). + If neither module is present, the rules must be empty.""" modname = "iptable_" + tablename cmd = "iptables -t " + tablename + " -nvL" - self.add_cmd_output(cmd, pred=SoSPredicate(self, kmods=[modname])) + self.add_cmd_output( + cmd, + pred=SoSPredicate(self, kmods=[modname, 'nf_tables'])) def collect_ip6table(self, tablename): """ Same as function above, but for ipv6 """ modname = "ip6table_" + tablename cmd = "ip6tables -t " + tablename + " -nvL" - self.add_cmd_output(cmd, pred=SoSPredicate(self, kmods=[modname])) + self.add_cmd_output( + cmd, + pred=SoSPredicate(self, kmods=[modname, 'nf_tables'])) def collect_nftables(self): """ Collects nftables rulesets with 'nft' commands if the modules @@ -151,16 +153,17 @@ class Networking(Plugin): self.add_cmd_output(ss_cmd, pred=ss_pred, changes=True) # When iptables is called it will load the modules - # iptables and iptables_filter if they are not loaded. + # iptables_filter (for kernel <= 3) or + # nf_tables (for kernel >= 4) if they are not loaded. # The same goes for ipv6. self.add_cmd_output( "iptables -vnxL", - pred=SoSPredicate(self, kmods=['iptable_filter']) + pred=SoSPredicate(self, kmods=['iptable_filter', 'nf_tables']) ) self.add_cmd_output( "ip6tables -vnxL", - pred=SoSPredicate(self, kmods=['ip6table_filter']) + pred=SoSPredicate(self, kmods=['ip6table_filter', 'nf_tables']) ) # Get ethtool output for every device that does not exist in a -- 2.21.3