Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

libvirt: don't use iptables-nftables #109722

Merged
merged 1 commit into from Jan 23, 2021
Merged

libvirt: don't use iptables-nftables #109722

merged 1 commit into from Jan 23, 2021

Conversation

euank
Copy link
Member

@euank euank commented Jan 18, 2021

Motivation for this change

Per a comment on the PR that made this change, it turns out to cause
issues in some cases: #109332 (comment)

For now, let's revert back. Presumably the issues derive from the system
iptables not matching libvirt's iptables.

In the future, #81172 should move us back into the future, and I'm
perfectly fine waiting for that PR to handle this separately.

I'm marking this as a draft until I confirm this fixes the reporter's issue.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@euank euank mentioned this pull request Jan 18, 2021
Merged
10 tasks
@ofborg ofborg bot requested review from fpletz and globin January 18, 2021 10:13
@pmeiyu
Copy link
Member

pmeiyu commented Jan 18, 2021

I have found out what caused the problem. See #109332 (comment)

@euank
Copy link
Member Author

euank commented Jan 18, 2021 •
edited

@pmeiyu Thanks for digging into the problem more. Based on that, I think this pr (reverting back from iptables-nftables to iptables-legacy for now) seems right.
If you can pull it in locally and verify it fixes the issue you ran into, that'd be helpful!

You should be able to test it locally on nixos with something like:

nixpkgs.overlays = [
  (super: self: { libvirt = (import (builtins.fetchTarball "https://github.com/NixOS/nixpkgs/archive/066676b839a217f6b1b5d8ab05842604d33b7258.tar.gz") {}).libvirt; })
];

in configuration.nix

@pmeiyu
Copy link
Member

pmeiyu commented Jan 19, 2021

@pmeiyu Thanks for digging into the problem more. Based on that, I think this pr (reverting back from iptables-nftables to iptables-legacy for now) seems right.
If you can pull it in locally and verify it fixes the issue you ran into, that'd be helpful!

You should be able to test it locally on nixos with something like:

nixpkgs.overlays = [
  (super: self: { libvirt = (import (builtins.fetchTarball "https://github.com/NixOS/nixpkgs/archive/066676b839a217f6b1b5d8ab05842604d33b7258.tar.gz") {}).libvirt; })
];

in configuration.nix

I have tested this code snippet and can confirm libvirt's firewall is back to normal. Thank you. @euank

@euank euank marked this pull request as ready for review January 19, 2021 02:47
@SuperSandro2000
Copy link
Member

This is a semi-automatic executed nixpkgs-review which is checked by a human on a best effort basis and does not build all packages (e.g. lumo, tensorflow or pytorch).
If you have any questions or problems please reach out to SuperSandro2000 on IRC.

Result of nixpkgs-review pr 109722 run on x86_64-linux 1

1 package built:
  • libvirt

The following issues got detected with the above build packages.
Please fix at least the ones listed with your changed packages:

libvirt:

Please consider this feature to be alpha.

A substituteInPlace with an unused --replace got detected:

substituteStream(): WARNING: pattern 'ON_BOOT=start' doesn't match anything in file '/nix/store/k2blycijdng2sby85na404s2faaha6j6-libvirt-6.8.0/libexec/libvirt-guests.sh'
substituteStream(): WARNING: pattern 'ON_SHUTDOWN=suspend' doesn't match anything in file '/nix/store/k2blycijdng2sby85na404s2faaha6j6-libvirt-6.8.0/libexec/libvirt-guests.sh'

Please check the offending substituteInPlace for typos or changes in source.

@euank
Copy link
Member Author

euank commented Jan 19, 2021

Thanks for running that / catching that issue, @SuperSandro2000; I updated the replace to match upstream quoting changes.

@SuperSandro2000
Copy link
Member

Thanks for running that / catching that issue, @SuperSandro2000; I updated the replace to match upstream quoting changes.

I have hoped to catch such issues with that feature and the time I invested was already worth it!

@SuperSandro2000
Copy link
Member

This is a semi-automatic executed nixpkgs-review which is checked by a human on a best effort basis and does not build all packages (e.g. lumo, tensorflow or pytorch).
If you have any questions or problems please reach out to SuperSandro2000 on IRC.

Result of nixpkgs-review pr 109722 run on x86_64-linux 1

1 package failed to build and already failed to build on hydra master:
  • libvmi: log was empty
30 packages built:
  • collectd
  • collectd-data
  • docker-machine-kvm
  • docker-machine-kvm2
  • gnome3.gnome-boxes
  • haskellPackages.libvirt-hs
  • libguestfs
  • libvirt
  • libvirt-glib
  • minikube
  • minishift
  • perl530Packages.SysVirt
  • perl532Packages.SysVirt
  • python37Packages.guestfs
  • python37Packages.libvirt
  • python38Packages.guestfs
  • python38Packages.libvirt
  • python39Packages.guestfs
  • python39Packages.libvirt
  • rubyPackages.ruby-libvirt (rubyPackages_2_6.ruby-libvirt)
  • rubyPackages_2_5.ruby-libvirt
  • rubyPackages_2_7.ruby-libvirt
  • terraform-full
  • terraform-providers.libvirt
  • vagrant
  • virt-manager
  • virt-manager-qt
  • virt-top
  • virt-viewer
  • virtlyst

@mohe2015 mohe2015 mentioned this pull request Jan 20, 2021
Closed
mohe2015
mohe2015 approved these changes Jan 20, 2021
View reviewed changes
Copy link
Contributor

@mohe2015 mohe2015 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested and works. sudo systemctl restart libvirtd if you want to skip a full reboot.

SuperSandro2000
SuperSandro2000 reviewed Jan 20, 2021
View reviewed changes
Copy link
Member

@SuperSandro2000 SuperSandro2000 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Mic92 Can you please take another look at this?

Technical27
Technical27 approved these changes Jan 20, 2021
View reviewed changes
Copy link
Contributor

@Technical27 Technical27 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks fine, and my VM has internet again.

@jezcope
Copy link
Contributor

jezcope commented Jan 22, 2021

In case you still want the extra data points: I had the same problem and this fixes it for me too.

@euank
Copy link
Member Author

euank commented Jan 22, 2021

Rebased due to a merge conflict; the rebase was trivial, but I didn't rebuild the package yet since master right now has changes that basically require rebuilding the whole world, so I'll wait on hydra.

@mohe2015
Copy link
Contributor

@euank The changes got reverted I think.

@euank
libvirt: don't use iptables-nftables
f0b1cdb 
Per a comment on the PR that made this change, it turns out to cause
issues in some cases: NixOS#109332 (comment)

For now, let's revert back. Presumably the issues derive from the system
iptables not matching libvirt's iptables.

In the future, NixOS#81172 should move us back into the future, and I'm
perfectly fine waiting for that PR to handle this separately.
@euank
Copy link
Member Author

euank commented Jan 22, 2021

Ah, yup, thanks for the heads up @mohe2015!
Verified the rebased package still builds and the binary runs.
I think this can be merged now (given it fixes a bug, and several people have verified it works)

@Mic92 Mic92 merged commit 103dfe6 into NixOS:master Jan 23, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@SuperSandro2000 SuperSandro2000 SuperSandro2000 left review comments

@mohe2015 mohe2015 mohe2015 approved these changes

@Technical27 Technical27 Technical27 approved these changes

@fpletz fpletz Awaiting requested review from fpletz

@globin globin Awaiting requested review from globin

@Mic92 Mic92 Awaiting requested review from Mic92

Assignees
No one assigned
Labels
10.rebuild-darwin: 11-100 10.rebuild-linux: 11-100
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
7 participants
@euank @pmeiyu @SuperSandro2000 @jezcope @mohe2015 @Technical27 @Mic92