linux: Backport fixes for bpfilter and usermode helper to prevent iptable failures with "no child processes"

[randomvariable]

Under some circumstances which are not fully understood, the user mode helper process of the bpfilter module may fail. This causes applications that use iptables (notably Kubernetes kube-proxy and CNIs such as Calico) to not be able to view or change iptables. The error message received under such circumstances is:

• kube-proxy:

proxier.go:859] "Failed to ensure chain exists" err="error creating chain \"KUBE-EXTERNAL-SERVICES\": exit status 3: iptables v1.8.2 (legacy): can't initialize iptables table `filter': No child processes\nPerhaps iptables or your kernel needs to be upgraded.\n" table=filter chain=KUBE-EXTERNAL-SERVICES

• calico-node / felix:

[PANIC][8557] felix/table.go 769: iptables-legacy-save command failed after retries ipVersion=0x4 table="nat"
panic: (*logrus.Entry) 0xc000577540

goroutine 294 [running]:
github.com/sirupsen/logrus.Entry.log(0xc00007e1e0, 0xc00061a630, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f2800000000, ...)
	/go/pkg/mod/github.com/projectcalico/logrus@v1.0.4-calico/entry.go:128 +0x6a5
github.com/sirupsen/logrus.(*Entry).Panic(0xc0001aa960, 0xc000998b58, 0x1, 0x1)
	/go/pkg/mod/github.com/projectcalico/logrus@v1.0.4-calico/entry.go:173 +0xfa

Ways to reproduce:

Failure mode 1:

1. Rename bpfilter.ko.xz to something else
2. rmmod bpfilter
3. iptables

Failure mode 2:

1. grep dmesg for bpfilter_umh, e.g.

bpfilter: Loaded bpfilter_umh pid 1720

2. echo garbage into /proc/<pid>/fd/0
3. iptables (this will break until the next reboot)

In some failure modes, this can be worked around with rmmod bpfilter.

The patches here make getsockopt, which is the syscall that iptables expects to succeed return successfully even if the usermode helper process is not working. Additionally, there are pre-requisite backports to improve the robustness of the bpfilter module.

When used together, neither of the failure modes are present.

Signed-off-by: Naadir Jeewa jeewan@vmware.com