firewall-cmd fails on shutdown

[marcosfrm]

CentOS 7 + EPEL here, firewalld-0.3.9-11.el7.noarch. fail2ban-firewalld package sets firewall-cmd/ipset action, see

https://bugzilla.redhat.com/show_bug.cgi?id=979622

On shutdown, fail2ban calls:

firewall-cmd --direct --remove-rule ipv4 filter INPUT 0 -p XXX -m multiport --dports XXX -m set --match-set fail2ban-XXX src -j REJECT --reject-with icmp-port-unreachable
ipset flush fail2ban-XXX
ipset destroy fail2ban-XXX

But firewall-cmd fails with (excerpt from /var/log/fail2ban.log):

Traceback (most recent call last):
  File "/usr/bin/firewall-cmd", line 703, in <module>
    fw = FirewallClient()
  File "<string>", line 2, in __init__
  File "/usr/lib/python2.7/site-packages/firewall/client.py", line 52, in handle_exceptions
    return func(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/firewall/client.py", line 1594, in __init__
    self.bus = dbus.SystemBus()
  File "/usr/lib64/python2.7/site-packages/dbus/_dbus.py", line 194, in __new__
    private=private)
  File "/usr/lib64/python2.7/site-packages/dbus/_dbus.py", line 100, in __new__
    bus = BusConnection.__new__(subclass, bus_type, mainloop=mainloop)
  File "/usr/lib64/python2.7/site-packages/dbus/bus.py", line 122, in __new__
    bus = cls._new_for_bus(address_or_type, mainloop=mainloop)
    dbus.exceptions.DBusException: org.freedesktop.DBus.Error.NoServer: Failed to connect to socket /var/run/dbus/system_bus_socket: Conex\xc3\xa3o recusada

"Conex\xc3\xa3o recusada" is "Connection refused".

And then ipset also fails:

ipset v6.19: Set cannot be destroyed: it is in use by a kernel component

It only fails this way on system shutdown. When I restart fail2ban.service all works as it should.

On Fedora 22 it works as expected.

[t-woerner]

This means that firewalld has already been stopped in the shutdown process by systemd. There is no way to talk to firewalld anymore at this moment. fail2ban should make sure to make this change before firewalld has been stopped by systemd.

[marcosfrm]

http://thread.gmane.org/gmane.comp.sysutils.systemd.devel/29959/focus=29971

See other Lennart responses too.

Solution is simply After=dbus.service in [Unit] section of firewalld.service. Now it is working fine here, fail2ban jails are stopped correctly.

[marcosfrm]

I have forgotten to say that ordenation between firewalld and fail2ban is ok. The problem is that without After=dbus.service systemd does not guarantee D-Bus daemon will be running when firewalld is stopped on shutdown.

[marcosfrm]

@t-woerner , thanks for modifying firewalld.service in 2948525. However After=syslog.target does nothing, you can remove it.

http://lists.opensuse.org/opensuse-packaging/2013-05/msg00102.html

[marcosfrm]

Fixed in 0.4.0.