Ubuntu
libvirt package

[Hardy] overzealous masquerading affects vm to vm traffic

Bug #227837 reported by John Leach on 2008-05-07

Affects		Status	Importance	Assigned to	Milestone
	libvirt (Ubuntu)	Fix Released	High	Unassigned
	Hardy	Fix Released	High	Unassigned

Bug Description

The default masquerade rule appears to be:

iptables -t nat -A POSTROUTING -s 192.168.122.0/24 -j MASQUERADE

but this causes all internally routed guest to guest traffic to be masqueraded too (breaking such things as redhat cluster dlm connections in my case).

replacing the rule with the following seems to be a good solution:

iptables -t nat -A POSTROUTING -s 192.168.122.0/24 -d ! 192.168.122.0/24 -j MASQUERADE

[Impact]
Causes inappropriate masquerading of internally routed traffic, which makes it difficult to test virtual clusters (among other things)

[How Addressed in Development]
This patch is a cherrypick from upstream's git tree. This fix is already in the version carried in Jaunty today.

[Patch]
Attached is a minimal patch fixing the issue, taken from git upstream.

[Reproduction]
Set up two kvm machines. Ping the first from the second, and run tcpdump on the second; in the tcpdump output, you *should* see that the pings come from the ip address of the first kvm machine, but instead (with the bug) you'll see they come from the ip address associated with virbr0, the bridge device on the host.

[Regression Potential]
It is hard to imagine a situation where it would desirable that all traffic from other machines on the internal bridged network appear to come from the single ip address of the host. That said, users with a pre-existing network of guests may have developed workarounds on the guests to compensate for the bug, in which case applying this fix may require them to reconfigure their guests to remove those workarounds.

See original description

Tags:

Related branches

lp:ubuntu/hardy-proposed/libvirt

Revision history for this message

J. Bruce Fields (bfields-fieldses) wrote on 2008-07-17:

Tweak masquering rules to only capture traffic leaving the virtual network Edit (1.8 KiB, text/plain)

This is already fixed in upstream (in the manner the reporter suggests); see commit d175caad25a4e80800d5e7e7d8c9d920a88b78e1 from git://git.et.redhat.com/libvirt.git, attached.

I've applied that patch to libvirt0 0.4.0-2ubuntu8. It applies cleanly except for a reject on the changelog, and it does fix the problem.

(I ran across this trying to set up a virtual gfs2 cluster for testing; it failed because cluster nodes rejected traffic that (due to thbe unnecessary masquerading) appeared to come from the host instead of the other (guest) cluster nodes.)

Changed in libvirt:
status:	New → Confirmed

Revision history for this message

J. Bruce Fields (bfields-fieldses) wrote on 2008-10-05:

debdiff, with changelog, etc. Edit (2.0 KiB, text/plain)

Just trying to make progress, I figured I'd follow the instructions from https://wiki.ubuntu.com/PackagingGuide/Recipes/Debdiff; results attached. Any chance someone could apply this? It's a trivial change, and fixes an annoying bug.

Bryce Harrington (bryce) on 2008-11-04

Changed in libvirt:
importance:	Undecided → High
status:	Confirmed → Triaged
importance:	Undecided → High
status:	New → Triaged

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-03-10:

libvirt_0.4.0-2ubuntu8.2.debdiff Edit (2.5 KiB, text/plain)

Heya Bruce,

Thanks for packaging the patch as a debdiff, that helps.

I see this is already fixed in Jaunty, so I'll close the development task for that.

Because Hardy is already released, the process for getting changes into it involves a bit more paperwork, and requires structuring the debdiffs slightly differently. They are targeted to 'hardy-proposed' instead of 'hardy', and the version numbering increments by .1's. I fixed up your debdiff accordingly and include it for your review.

I've also gone ahead and uploaded the fix to hardy-proposed so it'll be available for testing.

The 'paperwork' is described at https://wiki.ubuntu.com/StableReleaseUpdates - basically the process is to help ensure changes that go out to everyone are 100% regression free and fix issues that really do need fixed. I'll fill out the bits I know, could you please fill in the remaining blanks? That part is necessary (along with testing) in order to get the fix approved to move from hardy-proposed to hardy.

description:

updated

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-03-10:

Oh also, once you've finished updating the description, please subscribe "ubuntu-sru" to this bug, via the "Subscribe someone else" link at the top right. That will move the bug into the reviewer queue for getting it into hardy.

Changed in libvirt:
status:	Triaged → Fix Released
status:	Triaged → Fix Committed

J. Bruce Fields (bfields-fieldses) on 2009-03-11

description:

updated

Revision history for this message

Martin Pitt (pitti) wrote on 2009-03-13:

Ah, so that was the corresponding bug to the package which I just rejected. Please reupload with a bug ref in the changelog (LP: #227837).

Revision history for this message

Martin Pitt (pitti) wrote on 2010-03-16: Please test proposed package

Accepted libvirt into hardy-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

tags:

added: verification-needed

Revision history for this message

Martin Pitt (pitti) wrote on 2010-04-29:

Anyone who can test the proposed package?

Revision history for this message

Andreas Wenning (andreas-wenning) wrote on 2010-06-09:

Tested this on a fresh hardy server. I can confirm that the fix works.

Created two kqemu-accelerated instances in libvirt. Without the version from proposed packages between the two instances are routed through the host; with the version from proposed, they are now send directly. Tested pinging both the host and external sites from the instances, and can confirm that this also still works as expected.

Martin Pitt (pitti) on 2010-06-10

tags:	added: verification-donee removed: verification-needed
tags:	added: verification-done removed: verification-donee

Revision history for this message

Launchpad Janitor (janitor) wrote on 2010-06-11:

This bug was fixed in the package libvirt - 0.4.0-2ubuntu8.2

---------------
libvirt (0.4.0-2ubuntu8.2) hardy-proposed; urgency=low

  * masquerade-only-outbound-traffic.patch:
    - Ensure masquerading rule only catches traffic leaving the virtual
      network, and not traffic inside it. (Backported from commit
      d175caad25a4e80800d5e7e7d8c9d920a88b78e1 of
      git://git.et.redhat.com/libvirt.git.) (LP: #227837).
-- <email address hidden> (J. Bruce Fields) Sun, 05 Oct 2008 15:13:50 -0400