Relevant area(s)
Linux (LXC and Bubblewrap backends)
Brief description of your issue
In firewall enforcement mode (network.enforcementMode: "firewall" / "both"), NetworkIptablesManager creates the per-container iptables/ip6tables chain(s) with a default policy, but when no veth interface is set it skips the FORWARD hook and still returns success. The chain is therefore never in the packet path, so no traffic is filtered even though the caller believes the network policy was applied.
- The Bubblewrap backend never calls
set_veth_interface (src/backends/bubblewrap/common/src/bwrap_runner.rs:205-206), so every Bubblewrap firewall-mode run installs an orphan chain and enforces nothing — IPv4 and IPv6 alike.
- The LXC backend discovers the veth (
src/backends/lxc/common/src/lxc_runner.rs:208-221) but only sets it if let Some(...), so it hits the same gap whenever discover_veth_interface fails.
This is a silent fail-open on a security control. It is pre-existing on main (not introduced by any single PR); it was identified during review of #724, which corrects the LXC FORWARD direction (-o → -i) and adds LXC hook assertions but does not close this gap and does not cover Bubblewrap.
Relevant code: src/backends/lxc/common/src/network_iptables.rs:811-818 (the else branch logs "No veth interface set for container. Cannot scope iptables rules. Skipping FORWARD hook." and returns Ok(())), surfacing as apply_firewall_rules returning Ok(true) with rules_applied = true at network_iptables.rs:670-673.
Steps to reproduce
- Run a Bubblewrap container (or an LXC container where veth discovery fails) with:
network.enforcementMode: "firewall"network.defaultPolicy: "block"- a non-empty
allowedHosts / blockedHosts list.
- Observe the log line:
Warning: No veth interface set for container. Cannot scope iptables rules. Skipping FORWARD hook.
- From inside the container, connect to a destination that the policy should block (e.g. any host not in
allowedHosts under defaultPolicy: "block").
Expected behavior
When network enforcement is requested but cannot be safely scoped to the container (no veth interface), setup should fail closed — return an error so the container does not run with an unenforced network policy. For Bubblewrap specifically, the backend should either implement process/cgroup-scoped enforcement (e.g. OUTPUT with cgroup/UID matching) or explicitly reject firewall mode rather than reporting success.
Actual behavior
apply_firewall_rules returns Ok(true) and sets rules_applied = true. The chain exists but is never hooked into FORWARD, so all container egress (IPv4 and IPv6) flows unfiltered while the run reports success. For Bubblewrap this occurs on every firewall-mode run because set_veth_interface is never called; for LXC it occurs whenever veth discovery fails.
Relevant area(s)
Linux (LXC and Bubblewrap backends)
Brief description of your issue
In firewall enforcement mode (
network.enforcementMode: "firewall"/"both"),NetworkIptablesManagercreates the per-containeriptables/ip6tableschain(s) with a default policy, but when no veth interface is set it skips theFORWARDhook and still returns success. The chain is therefore never in the packet path, so no traffic is filtered even though the caller believes the network policy was applied.set_veth_interface(src/backends/bubblewrap/common/src/bwrap_runner.rs:205-206), so every Bubblewrap firewall-mode run installs an orphan chain and enforces nothing — IPv4 and IPv6 alike.src/backends/lxc/common/src/lxc_runner.rs:208-221) but only sets itif let Some(...), so it hits the same gap wheneverdiscover_veth_interfacefails.This is a silent fail-open on a security control. It is pre-existing on
main(not introduced by any single PR); it was identified during review of #724, which corrects the LXCFORWARDdirection (-o→-i) and adds LXC hook assertions but does not close this gap and does not cover Bubblewrap.Relevant code:
src/backends/lxc/common/src/network_iptables.rs:811-818(theelsebranch logs"No veth interface set for container. Cannot scope iptables rules. Skipping FORWARD hook."and returnsOk(())), surfacing asapply_firewall_rulesreturningOk(true)withrules_applied = trueatnetwork_iptables.rs:670-673.Steps to reproduce
network.enforcementMode: "firewall"network.defaultPolicy: "block"allowedHosts/blockedHostslist.Warning: No veth interface set for container. Cannot scope iptables rules. Skipping FORWARD hook.allowedHostsunderdefaultPolicy: "block").Expected behavior
When network enforcement is requested but cannot be safely scoped to the container (no veth interface), setup should fail closed — return an error so the container does not run with an unenforced network policy. For Bubblewrap specifically, the backend should either implement process/cgroup-scoped enforcement (e.g.
OUTPUTwith cgroup/UID matching) or explicitly reject firewall mode rather than reporting success.Actual behavior
apply_firewall_rulesreturnsOk(true)and setsrules_applied = true. The chain exists but is never hooked intoFORWARD, so all container egress (IPv4 and IPv6) flows unfiltered while the run reports success. For Bubblewrap this occurs on every firewall-mode run becauseset_veth_interfaceis never called; for LXC it occurs whenever veth discovery fails.