[Bug 1917920] Re: magic-proxy broke with iptables 1.8.7-1ubuntu2

[Dimitri John Ledkov]

i think either -L or -S "made everything work".

Note that there is no iptables installs in the lxd container, and we
install iptables on the fly.

nftables are not installed either, because that's not in main.

So when lxd container started, nothing did "restore" of any default
chains I don't think. But also have no idea if any are needed, or if I
can tune any debugging in the kernel to notice if iptables are poked in
some odd ways inside the network namespace that we are in.

Also note all the extra setup that launchpad-buildd does:
https://git.launchpad.net/launchpad-buildd/tree/lpbuildd/target/lxd.py

in terms of creating lxd profile, and doing stuff to the bridge with
iptables.

I wonder if I must always use legacy iptables, if that's what used on
the host to configure the bridge of the lxd container one is in.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/1917920

Title:
  magic-proxy broke with iptables 1.8.7-1ubuntu2

Status in launchpad-buildd:
  New
Status in iptables package in Ubuntu:
  New
Status in livecd-rootfs package in Ubuntu:
  New
Status in lxd package in Ubuntu:
  New

Bug description:
  when iptables got upgraded from 1.8.5-3ubuntu4 to 1.8.7-1ubuntu2 magic
  proxy stopped working in livecd-rootfs.

  It does very simple thing:

  iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner
  daemon -j REDIRECT --to 8080

  inside hirsute lxd container, with quite high privileges, in a bionic
  VM, running 4.15 kernel.

  With 1.8.5 above worked fine, with 1.8.7 somehow there was no outbound
  connectivity the very first http networking command after the above
  call would just hang indefinitely.

  However, if one does this instead:

  iptables -vv -t nat -S
  iptables-legacy -vv -t nat -S
  iptables -vv -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner daemon -j REDIRECT --to 8080

  somehow magically everything starts to work fine.

  weird.

To manage notifications about this bug go to:
https://bugs.launchpad.net/launchpad-buildd/+bug/1917920/+subscriptions