neutron-linuxbridge-agent fails to start with iptables 1.8.5

This issue was fixed in iptables git master commit dac904bdcd9a18aabafee7275ccf0c2bd53800f3

I guess the actual fix may have been "iptables-nft: fix basechain policy configuration", commit 0bd7a8eaf3582159490ab355b1217a4e42ed021f

I could reproduce the issue by building git v1.8.5 and the issue was fixed after cherry-picking "iptables-nft: fix basechain policy configuration"

$ git log
commit 8d985eb4eb7a23fd98b75d71179af40169144cc5 (HEAD -> bug1898547)
Author: Pablo Neira Ayuso <email address hidden>
Date: Fri Oct 2 13:44:36 2020 +0200

    iptables-nft: fix basechain policy configuration

    Previous to this patch, the basechain policy could not be properly
    configured if it wasn't explictly set when loading the ruleset, leading
    to iptables-nft-restore (and ip6tables-nft-restore) trying to send an
    invalid ruleset to the kernel.

    Signed-off-by: Arturo Borrero Gonzalez <email address hidden>
    Signed-off-by: Pablo Neira Ayuso <email address hidden>

commit 14ac250946289e280fb09ef978a45042871275b0 (tag: v1.8.5)
Author: Pablo Neira Ayuso <email address hidden>
Date: Wed Jun 3 11:37:52 2020 +0200

    configure: bump version for 1.8.5 release

    Signed-off-by: Pablo Neira Ayuso <email address hidden>

Status changed to 'Confirmed' because the bug affects multiple users.

Link to upstream commit - https://git.netfilter.org/iptables/commit/?id=0bd7a8eaf3582159490ab355b1217a4e42ed021f

FYI, 1.8.5-3ubuntu3 was uploaded to hirsute-proposed yesterday. 1.8.5-3ubuntu2.20.10.1 is in the unapproved queue for groovy-proposed. Alex said he'd do the SRU paperwork.

Hello Albert, or anyone else affected,

Accepted iptables into groovy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/iptables/1.8.5-3ubuntu2.20.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-groovy to verification-done-groovy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-groovy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

All autopkgtests for the newly accepted iptables (1.8.5-3ubuntu2.20.10.1) for groovy have finished running.
The following regressions have been reported in tests triggered by the package:

sshuttle/1.0.4-1ubuntu4 (arm64)
firewalld/0.9.1-1ubuntu1 (arm64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/groovy/update_excuses.html#iptables

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

FYI the two autopkgtest failures for arm64 (sshuttle & firewalld) both appear to be transient failures so these are currently being retried...

I have verified the fixed package, see attached terminal output.

Steps taken:
- check package version
- verify nf_tables is used
- check default chains have not been created yet
- run test case
- check if default chain has been created

After that I upgraded the iptables packages on my neutron and compute hosts and rebooted them. Without any manual intervention the linuxbridge-agent was started and I could start a new instance which entered the "Running" state and had network connectivity.
The linuxbridge-agent logs did not contain errors regarding iptables after the reboot.

I've tested this (s390x, groovy) and im able to launch an instance with the specific version of iptables mentioned above

This bug was fixed in the package iptables - 1.8.5-3ubuntu3

---------------
iptables (1.8.5-3ubuntu3) hirsute; urgency=medium

  * Fix regression when configuring basechain policy (LP: #1898547)
    - d/p/9003-iptables_nft_fix_basechain_policy_configuration.patch: Backport
      patch from upstream to fix basechain policy configuration when it
      wasn't explicitly set.

 -- Alex Murray <email address hidden> Tue, 03 Nov 2020 11:57:59 +1030

jdstrand sponsored this to groovy-proposed and autopkgtests have all passed - ~ubuntu-sru - could you please review?

This bug was fixed in the package iptables - 1.8.5-3ubuntu2.20.10.1

---------------
iptables (1.8.5-3ubuntu2.20.10.1) groovy; urgency=medium

  * Fix regression when configuring basechain policy (LP: #1898547)
    - d/p/9003-iptables_nft_fix_basechain_policy_configuration.patch: Backport
      patch from upstream to fix basechain policy configuration when it
      wasn't explicitly set.

 -- Alex Murray <email address hidden> Tue, 03 Nov 2020 11:57:59 +1030

The verification of the Stable Release Update for iptables has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.