NetworkManager 1.10.2启动shorewall时触发段错误 求助排查

Hey, I’ve run into similar crashes between NetworkManager and firewall tools before, so let’s break this down step by step based on your info:

1. Pinpoint the Exact Crash Location in libc #

Your error shows a segfault at 8 with error code 4—that’s an invalid read attempt, meaning libc tried to access memory at an offset of 8 from a bad pointer. To get more context, run this command to map the crash address to a specific libc function:

addr2line -e /lib/x86_64-linux-gnu/libc-2.23.so 00007fa89e102e16

This will tell you if the crash happened in something like free(), malloc(), or a network-related libc function, which narrows down whether it’s a memory management issue or a network event handling bug.

2. Look for Race Conditions Between Shorewall’s Async Execution and NetworkManager #

Shorewall runs asynchronously, and NetworkManager actively listens for iptables rule changes via netlink events. If Shorewall is rapidly adding/removing rules (especially bulk updates) or modifying chains NetworkManager depends on (like INPUT in the filter table), it could create a race: NetworkManager might read a pointer to a rule that Shorewall just deleted, leading to a segfault when it tries to access that memory later.

Unlike your simple iptables script (which probably adds rules sequentially without bulk flushes), Shorewall does a lot of behind-the-scenes work—like backing up old rules, resetting chain policies, or loading kernel modules. These operations can trigger more netlink events than a basic script, overwhelming NetworkManager’s event handler.

3. Check if QoS Configuration Is the Culprit #

You mentioned Shorewall has QoS enabled, which involves modifying tc (traffic control) rules and often using the mangle table in iptables to mark packets. NetworkManager might have its own logic for handling interface traffic control (e.g., for VPNs or bandwidth limits), and overlapping operations here could cause memory corruption. Try temporarily disabling QoS in Shorewall and see if the crash stops—if it does, you’ll know to focus on how Shorewall’s QoS interacts with NetworkManager’s interface management.

4. Test Shorewall’s Generated Rules with a Plain Iptables Script #

Export the final rules Shorewall applies using:

shorewall show > shorewall-rules.txt
# Or use iptables-save after Shorewall runs
iptables-save > shorewall-iptables-save.txt

Then create a simple script to load these rules directly with iptables-restore or individual iptables commands. If NetworkManager still crashes, the issue is in the rule set itself (e.g., a rule that triggers a bug in NetworkManager’s rule monitoring). If it doesn’t crash, the problem is how Shorewall executes the rules (bulk operations, timing, or auxiliary commands) rather than the rules themselves.

5. Enable Verbose Debug Logs for NetworkManager #

Catch what NetworkManager is doing right before the crash by running:

journalctl -u NetworkManager -f -o verbose

Then trigger the network connection and Shorewall configuration. The verbose logs will show the function call stack and events being processed (like netlink messages for iptables changes) just before the segfault. This is usually the fastest way to find which part of NetworkManager is failing.

6. Check for Version Compatibility Issues #

Libc 2.23 is pretty old (shipped with Ubuntu 16.04, for example). If you’re using a newer version of NetworkManager with this older libc, there might be unforeseen compatibility bugs. Try updating NetworkManager to the latest stable version available for your distro, or check if there are known bugs related to NetworkManager handling iptables rule updates with older libc versions.

内容的提问来源于stack exchange，提问作者Walter