iptables/ip6tables regressions in deleting rules

Bug #1691752 reported by Seth Forshee
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
Medium
Seth Forshee

Bug Description

https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-artful-canonical-kernel-team-ppa/artful/amd64/s/snapd/20170517_171222_5c77c@/log.gz

2017-05-17 17:11:40 Error restoring autopkgtest:ubuntu-17.10-amd64:tests/main/econnreset :
-----
+ echo 'Remove the firewall rule again'
Remove the firewall rule again
++ id -u test
+ iptables -D OUTPUT -m owner --uid-owner 12345 -j REJECT -p tcp --reject-with tcp-reset
iptables: No chain/target/match by that name.
-----

Can be easily reproduced by hand:

$ sudo iptables -I OUTPUT -m owner --uid-owner $(id -u) -j REJECT -p tcp --reject-with tcp-reset
$ sudo iptables -D OUTPUT -m owner --uid-owner $(id -u) -j REJECT -p tcp --reject-with tcp-reset
iptables: No chain/target/match by that name.

The rule is successfully deleted in xenial/zesty.

Revision history for this message
Seth Forshee (sforshee) wrote :

Reverting f77bc5b23fb1 "iptables: use match, target and data copy_to_user helpers" fixes the problem.

Seth Forshee (sforshee)
Changed in linux (Ubuntu):
status: In Progress → Fix Committed
Revision history for this message
Seth Forshee (sforshee) wrote :

Similar failures observed with lxd and ip6tables, reverting a similar patch fixes the problem. I've narrowed this down to one change each in these patches which is causing some data for rules to not be copied to userspace, so iptables/ip6tables cannot find a match. A partial revert fixes the issues.

summary: - iptables regression causing snapd ADT failure
+ iptables/ip6tables regressions in deleting rules
Changed in linux (Ubuntu):
status: Fix Committed → In Progress
Seth Forshee (sforshee)
Changed in linux (Ubuntu):
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (4.0 KiB)

This bug was fixed in the package linux - 4.11.0-10.15

---------------
linux (4.11.0-10.15) artful; urgency=low

  * linux: 4.11.0-10.15 -proposed tracker (LP: #1701271)

  * Artful update to v4.11.8 stable release (LP: #1701269)
    - clk: sunxi-ng: a31: Correct lcd1-ch1 clock register offset
    - clk: sunxi-ng: v3s: Fix usb otg device reset bit
    - clk: sunxi-ng: sun5i: Fix ahb_bist_clk definition
    - xen/blkback: fix disconnect while I/Os in flight
    - xen-blkback: don't leak stack data via response ring
    - ALSA: firewire-lib: Fix stall of process context at packet error
    - ALSA: pcm: Don't treat NULL chmap as a fatal error
    - ALSA: hda - Add Coffelake PCI ID
    - ALSA: hda - Apply quirks to Broxton-T, too
    - fs/exec.c: account for argv/envp pointers
    - powerpc/perf: Fix oops when kthread execs user process
    - autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL
    - fs/dax.c: fix inefficiency in dax_writeback_mapping_range()
    - lib/cmdline.c: fix get_options() overflow while parsing ranges
    - perf/x86/intel: Add 1G DTLB load/store miss support for SKL
    - perf probe: Fix probe definition for inlined functions
    - KVM: x86: fix singlestepping over syscall
    - KVM: MIPS: Fix maybe-uninitialized build failure
    - KVM: s390: gaccess: fix real-space designation asce handling for gmap
      shadows
    - KVM: PPC: Book3S HV: Cope with host using large decrementer mode
    - KVM: PPC: Book3S HV: Preserve userspace HTM state properly
    - KVM: PPC: Book3S HV: Ignore timebase offset on POWER9 DD1
    - KVM: PPC: Book3S HV: Context-switch EBB registers properly
    - KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit
    - KVM: PPC: Book3S HV: Save/restore host values of debug registers
    - CIFS: Improve readdir verbosity
    - CIFS: Fix some return values in case of error in 'crypt_message'
    - cxgb4: notify uP to route ctrlq compl to rdma rspq
    - HID: Add quirk for Dell PIXART OEM mouse
    - random: silence compiler warnings and fix race
    - signal: Only reschedule timers on signals timers have sent
    - powerpc/kprobes: Pause function_graph tracing during jprobes handling
    - powerpc/64s: Handle data breakpoints in Radix mode
    - Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list
    - brcmfmac: add parameter to pass error code in firmware callback
    - brcmfmac: use firmware callback upon failure to load
    - brcmfmac: unbind all devices upon failure in firmware callback
    - time: Fix clock->read(clock) race around clocksource changes
    - time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting
    - arm64/vdso: Fix nsec handling for CLOCK_MONOTONIC_RAW
    - target: Fix kref->refcount underflow in transport_cmd_finish_abort
    - iscsi-target: Fix delayed logout processing greater than
      SECONDS_FOR_LOGOUT_COMP
    - iscsi-target: Reject immediate data underflow larger than SCSI transfer
      length
    - drm/radeon: add a PX quirk for another K53TK variant
    - drm/radeon: add a quirk for Toshiba Satellite L20-183
    - drm/amdgpu/atom: fix ps allocation size for EnableDispPowerGating
    - drm/amdgpu: adjust default display clock
   ...

Read more...

Changed in linux (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.