[pkg-lxc-devel] Bug#973439: lxc-net conflicts with iptables-persistent on boot

[Ludwig Gramberg]

Package: lxc
Version: 1:2.0.7-2+deb9u2
Severity: grave
Tags: security
Justification: user security hole

Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

when lxc-net and netfilter/iptables-persistent are installed the start-up script
in lxc-net uses iptables-commands while iptables-restore is used by netfilter-persistent.
this is an unstable situation which sometimes causes iptables-restore to fail on COMMIT.
thus the iptables rules are not being loaded leaving the server vulnerable. 

this should be solved within the service-files of systemd. if netfilter-persistent.service
only runs after lxc-net.service the conflict should be avoided. at least it helped on my server.

*** End of the template - remove these template lines ***


-- System Information:
Debian Release: 9.13
  APT prefers oldstable-updates
  APT policy: (500, 'oldstable-updates'), (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-14-amd64 (SMP w/6 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages lxc depends on:
ii  init-system-helpers  1.48
ii  libapparmor1         2.11.0-3+deb9u2
ii  libc6                2.24-11+deb9u4
ii  libcap2              1:2.25-1
ii  libgnutls30          3.5.8-5+deb9u5
ii  liblxc1              1:2.0.7-2+deb9u2
ii  libseccomp2          2.3.1-2.1+deb9u1
ii  libselinux1          2.6-3+b3
ii  lsb-base             9.20161125
ii  python3              3.5.3-1
ii  python3-lxc          1:2.0.7-2+deb9u2

Versions of packages lxc recommends:
ii  bridge-utils  1.5-13+deb9u1
ii  debootstrap   1.0.89
ii  dirmngr       2.1.18-8~deb9u4
ii  dnsmasq-base  2.76-5+deb9u2
ii  gnupg         2.1.18-8~deb9u4
ii  iptables      1.6.0+snapshot20161117-6
ii  libpam-cgfs   2.0.7-1+deb9u1
ii  lxcfs         2.0.7-1+deb9u1
ii  openssl       1.1.0l-1~deb9u1
ii  rsync         3.1.2-1+deb9u2
ii  uidmap        1:4.4-4.1

Versions of packages lxc suggests:
pn  apparmor     <none>
pn  btrfs-tools  <none>
pn  lvm2         <none>

-- no debconf information