[Bug 1898547] Re: neutron-linuxbridge-agent fails to start with iptables 1.8.5

[Alex Murray]

** Description changed:

- Ubuntu Groovy (20.10)
- kernel 5.8.0-20-generic
- neutron-linuxbridge-agent: 2:17.0.0~git2020091014.215a541bd4-0ubuntu1
- iptables: 1.8.5-3ubuntu1 (nf_tables)
- iptables-restore points to xtables-nft-multi
+ [Impact]
  
- After upgrading iptables from 1.8.4 to 1.8.5 and rebooting the neutron network node, neutron-linuxbridge-agent didn't properly start anymore.
+ With iptables 1.8.5 neutron-linuxbridge-agent fails to properly start.
+ 
  The log file shows many errors like:
  
  2020-10-05 10:20:37.998 551 ERROR
  neutron.plugins.ml2.drivers.agent._common_agent ; Stdout: ; Stderr:
  iptables-restore: line 29 failed
  
- Downgrading iptables to 1.8.4 solves the problem.
- 
- Trying to do what the linuxbridge agent does:
- 2020-10-05 10:20:37.998 551 ERROR neutron.plugins.ml2.drivers.agent._common_agent *filter
- 2020-10-05 10:20:37.998 551 ERROR neutron.plugins.ml2.drivers.agent._common_agent :FORWARD - [0:0]
- 
- shows that
+ This can be demonstrated with a simple test case:
  
  iptables-restore <<EOF
  *filter
  :INPUT - [0:0]
  COMMIT
  EOF
  
- works fine with iptables 1.8.4 but fails with 1.8.5
+ This fails with iptables 1.8.5 and is a known upstream bug that was
+ subsequently fixed in upstream commit
+ https://git.netfilter.org/iptables/commit/?id=0bd7a8eaf3582159490ab355b1217a4e42ed021f
+ 
+ As such, neutron-linuxbridge-agent is not able to be used successfully
+ on groovy. This fix to iptables is required to allow neutron-
+ linuxbridge-agent to successfully run.
+ 
+ In hirsute, iptables 1.8.5-3ubuntu3 has been uploaded which fixes this
+ bug by backporting the upstream fix from commit
+ 0bd7a8eaf3582159490ab355b1217a4e42ed021f above. This is currently
+ sitting in hirsute-proposed waiting for autopkgtests to complete to
+ finish migration.
+ 
+ For groovy, iptables 1.8.5-3ubuntu2.20.10.1 is sitting in Unapproved and
+ is the subject of this SRU (this is simply 1.8.5-3ubuntu3 packaged for
+ groovy)
+ 
+ [Test Case]
+ 
+ This can be reproduced by the test case.
  
  
- Workaround
+ [Regression Potential] 
  
- It seems neutron-linuxbridge agent tries to create the default chains (like INPUT) with a "-" as policy. By making sure the chains already exist (and are shown with iptables-save) the agent doesn't try to create those default chains and the agent starts fine.
- So just running:
- sudo iptables -F OUTPUT
- sudo iptables -F OUTPUT -t raw
- sudo ip6tables -F OUTPUT
- sudo ip6tables -F OUTPUT -t raw
+  * This is a low risk update since it only affects the behaviour when a
+ policy of '-' is specified and so does not affect any users of iptables
+ that specify an explicit policy (like ACCEPT, REJECT etc). Since this
+ '-' behaviour is currently broken it has a very low chance of causing a
+ regression as it does not affect any code paths the use an explicit
+ policy.
  
- is enough to get neutron-linuxbridge-agent working with iptables 1.8.5.
+  * In the event of a regression, iptables can be reverted back to a
+ rebuild of 1.8.5-3ubuntu1 by simply backing out this patch.
+ 
+ [Other Info]
+  
+  * Details regarding an explicit test verification of neutron-linuxbridge-agent will be added soon.

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to neutron in Ubuntu.
https://bugs.launchpad.net/bugs/1898547

Title:
  neutron-linuxbridge-agent fails to start with iptables 1.8.5

Status in iptables package in Ubuntu:
  Fix Committed
Status in neutron package in Ubuntu:
  Invalid
Status in iptables source package in Groovy:
  In Progress
Status in neutron source package in Groovy:
  Invalid
Status in iptables source package in Hirsute:
  Fix Committed
Status in neutron source package in Hirsute:
  Invalid

Bug description:
  [Impact]

  With iptables 1.8.5 neutron-linuxbridge-agent fails to properly start.

  The log file shows many errors like:

  2020-10-05 10:20:37.998 551 ERROR
  neutron.plugins.ml2.drivers.agent._common_agent ; Stdout: ; Stderr:
  iptables-restore: line 29 failed

  This can be demonstrated with a simple test case:

  iptables-restore <<EOF
  *filter
  :INPUT - [0:0]
  COMMIT
  EOF

  This fails with iptables 1.8.5 and is a known upstream bug that was
  subsequently fixed in upstream commit
  https://git.netfilter.org/iptables/commit/?id=0bd7a8eaf3582159490ab355b1217a4e42ed021f

  As such, neutron-linuxbridge-agent is not able to be used successfully
  on groovy. This fix to iptables is required to allow neutron-
  linuxbridge-agent to successfully run.

  In hirsute, iptables 1.8.5-3ubuntu3 has been uploaded which fixes this
  bug by backporting the upstream fix from commit
  0bd7a8eaf3582159490ab355b1217a4e42ed021f above. This is currently
  sitting in hirsute-proposed waiting for autopkgtests to complete to
  finish migration.

  For groovy, iptables 1.8.5-3ubuntu2.20.10.1 is sitting in Unapproved
  and is the subject of this SRU (this is simply 1.8.5-3ubuntu3 packaged
  for groovy)

  [Test Case]

  This can be reproduced by the test case.

  
  [Regression Potential] 

   * This is a low risk update since it only affects the behaviour when
  a policy of '-' is specified and so does not affect any users of
  iptables that specify an explicit policy (like ACCEPT, REJECT etc).
  Since this '-' behaviour is currently broken it has a very low chance
  of causing a regression as it does not affect any code paths the use
  an explicit policy.

   * In the event of a regression, iptables can be reverted back to a
  rebuild of 1.8.5-3ubuntu1 by simply backing out this patch.

  [Other Info]
   
   * Details regarding an explicit test verification of neutron-linuxbridge-agent will be added soon.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/iptables/+bug/1898547/+subscriptions