firewalld 100% CPU and unresponsive

[Richard Shaw]

I don't know if this has been a problem the whole time after upgrade but I
noticed while checking system load for a different reason that
filrewalld is using 100% of one core.

It is not responsive to firewall-cmd nor is there anything useful in the
journal log:

# journalctl --no-hostname -b0 -u firewalld
-- Logs begin at Thu 2020-05-07 14:07:43 CDT, end at Tue 2020-05-12
07:15:25 CDT. --
May 12 06:47:20 systemd[1]: Starting firewalld - dynamic firewall daemon...
May 12 06:47:21 systemd[1]: Started firewalld - dynamic firewall daemon.
May 12 07:01:26 systemd[1]: Stopping firewalld - dynamic firewall daemon...
May 12 07:01:26 systemd[1]: firewalld.service: Succeeded.
May 12 07:01:26 systemd[1]: Stopped firewalld - dynamic firewall daemon.
May 12 07:01:26 systemd[1]: firewalld.service: Consumed 14min 1.157s CPU
time.
May 12 07:02:03 systemd[1]: Starting firewalld - dynamic firewall daemon...
May 12 07:02:03 systemd[1]: Started firewalld - dynamic firewall daemon.

I tried downgrading but it's still the version that ships with f32 so no
dice...

Anyone else seeing this?

Thanks,
Richard

[Richard Shaw]

Using ipsets in FirewallD is broken in F32...

Filed:
https://bugzilla.redhat.com/show_bug.cgi?id=1834853

Thanks,
Richard

[Jonathan Billings]

On Tue, May 12, 2020 at 12:32:29PM -0500, Richard Shaw wrote:
>  Using ipsets in FirewallD is broken in F32...
>  
>  Filed:
>  https://bugzilla.redhat.com/show_bug.cgi?id=1834853 
Is this because of the backend change to nftables?  Can you change
FirewallBackend=iptables in /etc/firewalld/firewalld.conf?

-- 
Jonathan Billings <billings(a)negate.org&gt;

[Richard Shaw]

On Tue, May 12, 2020 at 12:56 PM Jonathan Billings <billings(a)negate.org&gt;
wrote:

>  On Tue, May 12, 2020 at 12:32:29PM -0500, Richard Shaw wrote:
>  > Using ipsets in FirewallD is broken in F32...
>  >
>  > Filed:
>  > https://bugzilla.redhat.com/show_bug.cgi?id=1834853
>
>  Is this because of the backend change to nftables?  Can you change
>  FirewallBackend=iptables in /etc/firewalld/firewalld.conf?
>  
<sigh> Yes that appears to be the problem but firewalld certainly doesn't
handle the problem gracefully.

Thanks,
Richard