79 lines
3.1 KiB
Diff
79 lines
3.1 KiB
Diff
From 31e0467885ef3986b476ea070941a786b426f298 Mon Sep 17 00:00:00 2001
|
|
From: Pavel Moravec <pmoravec@redhat.com>
|
|
Date: Fri, 8 May 2020 14:06:41 +0200
|
|
Subject: [PATCH] [networking] collect iptables when proper kernel modules
|
|
loaded
|
|
|
|
Since kernel-4, iptables / ip6tables is newly provided by nf_tables
|
|
kernel module. Therefore, collecting ip[,6]tables commands should
|
|
be gated by presence of also this kernel module.
|
|
|
|
Resolves: #2054
|
|
|
|
Signed-off-by: Pavel Moravec <pmoravec@redhat.com>
|
|
Signed-off-by: Bryan Quigley <bryan.quigley@canonical.com>
|
|
---
|
|
sos/plugins/networking.py | 23 +++++++++++++----------
|
|
1 file changed, 13 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/sos/plugins/networking.py b/sos/plugins/networking.py
|
|
index cac6ccca..5230303d 100644
|
|
--- a/sos/plugins/networking.py
|
|
+++ b/sos/plugins/networking.py
|
|
@@ -35,22 +35,24 @@ class Networking(Plugin):
|
|
ns_wide = "-W"
|
|
|
|
def collect_iptable(self, tablename):
|
|
- """ When running the iptables command, it unfortunately auto-loads
|
|
- the modules before trying to get output. Some people explicitly
|
|
- don't want this, so check if the modules are loaded before running
|
|
- the command. If they aren't loaded, there can't possibly be any
|
|
- relevant rules in that table """
|
|
+ """ Collecting iptables rules for a table loads either kernel module
|
|
+ of the table name (for kernel <= 3), or nf_tables (for kernel >= 4).
|
|
+ If neither module is present, the rules must be empty."""
|
|
|
|
modname = "iptable_" + tablename
|
|
cmd = "iptables -t " + tablename + " -nvL"
|
|
- self.add_cmd_output(cmd, pred=SoSPredicate(self, kmods=[modname]))
|
|
+ self.add_cmd_output(
|
|
+ cmd,
|
|
+ pred=SoSPredicate(self, kmods=[modname, 'nf_tables']))
|
|
|
|
def collect_ip6table(self, tablename):
|
|
""" Same as function above, but for ipv6 """
|
|
|
|
modname = "ip6table_" + tablename
|
|
cmd = "ip6tables -t " + tablename + " -nvL"
|
|
- self.add_cmd_output(cmd, pred=SoSPredicate(self, kmods=[modname]))
|
|
+ self.add_cmd_output(
|
|
+ cmd,
|
|
+ pred=SoSPredicate(self, kmods=[modname, 'nf_tables']))
|
|
|
|
def collect_nftables(self):
|
|
""" Collects nftables rulesets with 'nft' commands if the modules
|
|
@@ -151,16 +153,17 @@ class Networking(Plugin):
|
|
self.add_cmd_output(ss_cmd, pred=ss_pred, changes=True)
|
|
|
|
# When iptables is called it will load the modules
|
|
- # iptables and iptables_filter if they are not loaded.
|
|
+ # iptables_filter (for kernel <= 3) or
|
|
+ # nf_tables (for kernel >= 4) if they are not loaded.
|
|
# The same goes for ipv6.
|
|
self.add_cmd_output(
|
|
"iptables -vnxL",
|
|
- pred=SoSPredicate(self, kmods=['iptable_filter'])
|
|
+ pred=SoSPredicate(self, kmods=['iptable_filter', 'nf_tables'])
|
|
)
|
|
|
|
self.add_cmd_output(
|
|
"ip6tables -vnxL",
|
|
- pred=SoSPredicate(self, kmods=['ip6table_filter'])
|
|
+ pred=SoSPredicate(self, kmods=['ip6table_filter', 'nf_tables'])
|
|
)
|
|
|
|
# Get ethtool output for every device that does not exist in a
|
|
--
|
|
2.21.3
|
|
|