Re: libprocps3 procps update this morning causing shorewall/iptables routing problems.

From	Abhijith PA <abhijith@disroot.org>
Newsgroups	linux.debian.security
Subject	Re: libprocps3 procps update this morning causing shorewall/iptables routing problems.
Date	2018-05-26 09:00 +0200
Message-ID	<vTBlf-8iz-7@gated-at.bofh.it> (permalink)
References	<vSyz7-1Gm-5@gated-at.bofh.it> <vSyz7-1Gm-7@gated-at.bofh.it> <vSyz7-1Gm-3@gated-at.bofh.it> <vSYjT-174-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw


On Thursday 24 May 2018 06:01 PM, Jonathan Wiltshire wrote:
> (CC because I'm not sure whether you're subscribed)
> 
> On 23/05/18 11:36, Luke Hall wrote:>>> This morning a number of our
> jessie firewall servers received these updates.
>>>>
>>>> 2018-05-23 06:53:20,879 INFO Allowed origins are:
>>>> ['origin=Debian,codename=jessie,label=Debian-Security']
>>>> 2018-05-23 06:53:23,120 INFO Packages that will be upgraded: libprocps3
>>>> procps
>>>> 2018-05-23 06:53:23,121 INFO Writing dpkg log to
>>>> '/var/log/unattended-upgrades/unattended-upgrades-dpkg.log'
>>>> 2018-05-23 06:53:24,836 INFO All upgrades installed
>>>>
>>>> Those machines, all running shorewall 4.6.4.3-2 and the 3.16.0-4-amd64
>>>> kernel stopped routing traffic through to hosts behind them and we found
>>>> it necessary to restart shorewall for this to resume. I will do some
>>>> further debugging this morning but I'm wondering if this affected anyone
>>>> else.
> 
> Do you have a stray 'net.ipv4.ip_forward=0' or similar in
> /etc/sysctl{.conf,.d}?
> 
> We also saw one instance of this problem, because the sysctls were
> reloaded during the update and so forwarding became disabled. Restarting
> shorewall of course fixes this by setting ip_forward back to 1.
> 
> All our other machines without ip_forward=0 in the configuration were
> unaffected.
> 
> 

Do you think it is a regression in recent upload of procps in
oldstable-security ?

--abhijith

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: libprocps3 procps update this morning causing shorewall/iptables  routing problems. Emilio Pozuelo Monfort <pochu@debian.org> - 2018-05-23 11:50 +0200
  Re: libprocps3 procps update this morning causing shorewall/iptables  routing problems. Jonathan Wiltshire <jmw@tiger-computing.co.uk> - 2018-05-24 15:20 +0200
    Re: libprocps3 procps update this morning causing shorewall/iptables  routing problems. Abhijith PA <abhijith@disroot.org> - 2018-05-26 09:00 +0200

csiph-web