On Sun, 2011-08-21 at 15:43 +0100, Ed W wrote: > On 20/08/2011 17:29, Tom Eastep wrote: > > 3) Previously, if a provider interface was derived from an optional > > wildcard entry in /etc/shorewall/providers, then the interface was > > never considered to be usable. > > Thanks for fixing this. > > I notice a new gremlin in 4.4.22.3:
That gremlin has been around for a long time and as you point out below, it can happen if the generated script is killed while it is running. > > shorewall restart seems to choke? Possibly a locking issue, struggling > a little to debug. > > sh -x shorewall restart gives: > > ... > + /bin/sh /var/lib/shorewall/firewall version > + sed s/-.*// > + temp=4.4.22.3 > + [ 0 -ne 0 ] > + ifs= > > + IFS=. > + echo 4 4 22 3 > + temp=4 4 22 3 > + IFS= > > + digits=0 > + printf %02d 4 > + version=04 > + digits=1 > + [ 1 -eq 3 ] > + printf %02d 4 > + version=0404 > + digits=2 > + [ 2 -eq 3 ] > + printf %02d 22 > + version=040422 > + digits=3 > + [ 3 -eq 3 ] > + break > + echo 040422 > + VERBOSITY=1 > + version=040422 > + [ 040422 -lt 040408 ] > + [ xrestart = xtrace -o xrestart = xdebug ] > + options=- > + [ -n ] > + [ -n ] > + [ -n ] > + [ -n ] > + options=-V 1 > + [ -n restore ] > + options=-V 1 -R restore > + /bin/sh /var/lib/shorewall/firewall -V 1 -R restore restart > Restarting Shorewall.... > Initializing... > Processing /etc/shorewall/init ... > Command: restart > > then a long pause here and then every 45 (ish) seconds, I get: > > ...pause... > ipset v6.8: Set cannot be created: set with the same name already exists > ...pause... > ipset v6.8: Set cannot be created: set with the same name already exists > ..pause... > > > Which corresponds with my init file of: > > if [ "$COMMAND" = start -o "$COMMAND" = restart ]; then The above is wrong. Doing a blanket create of ipsets during a restart will always result in failures if the ipsets are used in the current configuration. > ipset create cp1 bitmap:ip,mac range $LOC_IP > ipset create cp2 bitmap:ip,mac range $LOC_IP > ipset create cp3 bitmap:ip,mac range $LOC_IP > ... > fi > > > I don't have 4.4.22.1 around to double check, but I don't think I was > hitting this before The patches from 4.4.22.1 -> 4.4.22.2 -> 4.4.22.3 are available from the download sites. And nothing in this area has changed for quite a while. > > > A follow-on minor gremlin is that if I control-C to kill this, then > there is a stale lock file left - this causes some follow on slowness > trying to do anything subsequently (a stale lock test might be nice?) As a workaround, simply remove the lockfile or set MUTEX_TIMEOUT to a few seconds. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------------ Get a FREE DOWNLOAD! and learn more about uberSVN rich system, user administration capabilities and model configuration. Take the hassle out of deploying and managing Subversion and the tools developers use with it. http://p.sf.net/sfu/wandisco-d2d-2
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
