Bug 89269

Summary: systemd-networkd: auto-load iptables kernel modules
Product: systemd Reporter: Wolf Ramovsky <wolf.ramovsky>
Component: generalAssignee: systemd-bugs
Status: RESOLVED FIXED QA Contact: systemd-bugs
Severity: major    
Priority: medium CC: bevan, wolf.ramovsky
Version: unspecified   
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:

Description Wolf Ramovsky 2015-02-21 19:37:48 UTC 
Description:
I was playing around systemd-nspawn containers and new systemd-219 feature: default masquerading veth'ed (started with --network-veth) containers, and faced a weird systemd-networkd behaviour.
systemd-networkd could not enable or disable IP masquerading (and do any other firewall related things like forwarding, I suppose) if iptables haven't been touched anyhow since boot time.


How to reproduce:

The most important prerequisite here is that iptables haven't been touched since boot time. iptables shouldn't be touched either by iptables-load from iptables.service or manually from console.
Run
# iptables-save
and its output should be completely empty. Not tables with empty rules; just no output at all.

1. Then prepare some distro in some directory to use with nspawn.
2. Start systemd-networkd on host.
3. Boot container with -n (--network-veth) option:
# systemd-nspawn -n -b -D $path_to_container
4. Try to ping from container: ping won't be able to reach anything.
5. See systemd-networkd status on host:
# systemctl status systemd-networkd
It will report:
systemd-networkd: ve-%containername% : Could not enable IP masquerading: Protocol not avaliable
6. Turn off container.
7. Touch iptables, e. g.:
# iptables -t nat --list
After you have touched iptables in such way, iptables-save will output tables with empty set of rules.
8. Now boot container and try to ping: voilà, it pings!
9. Check systemd-networkd status: there is no any complains now.
Comment 1 Wolf Ramovsky 2015-02-22 14:12:58 UTC 
I think the reason is that iptables load kernel module at first invocation, see [1], but systemd doesn't and just gives up if iptc_init() fails.

[1] https://git.netfilter.org/iptables/tree/iptables/iptables.c?id=0e067c7142c73404eb9ba6e355a28a92bf493675#n1775
Comment 2 Lennart Poettering 2015-04-14 13:25:46 UTC 
Hmm, i figure the iptables modules does not support module autoloading when needed (which is kinda understandable, given that it's API is a setsockopt call...

I am not too convinced though that networkd should be able to load the kernel modules if they are missing...

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.