Application doesn't find libraries during runtime (iptables)

snapcraft
1

Hi,

I am trying to build and run iptables for Ubuntu Core 18 on the Raspberry Pi 3 (arm64) and I am encountering a strange behaviour.

The following simplified example shows what happens, when I try to add a new rule to the FORWARD chain on the target system using the match / module / extension (I am not sure what the correct term is) “tcp”:

root@rpi3:/snap/iptables# iptables -A FORWARD -p tcp -m tcp --dport 77 -j DROP iptables v1.6.1: Couldn’t load match tcp':No such file or directory Try iptables -h’ or ‘iptables --help’ for more information.

It looks like iptables just can’t find the required file(s), although they are part of the snap:

root@rpi3:/snap/iptables/current/lib/xtables# ls -hl libxt_tcp.so -rwxr-xr-x 1 root root 44K Apr 3 2019 libxt_tcp.so

root@icx-sn01234567:/snap/iptables/current/lib/xtables# ldd libxt_tcp.so linux-vdso.so.1 (0x0000ffff94b76000) libxtables.so.12 => not found libc.so.6 => /lib/aarch64-linux-gnu/libc.so.6 (0x0000ffff949de000) /lib/ld-linux-aarch64.so.1 (0x0000ffff94b4b000)

libxtables.so is in fact available:

root@rpi3:/snap/iptables/current/lib# ls -hl libxtables.so* lrwxrwxrwx 1 root root 20 Apr 3 2019 libxtables.so → libxtables.so.12.0.0 lrwxrwxrwx 1 root root 20 Apr 3 2019 libxtables.so.12 → libxtables.so.12.0.0 -rwxr-xr-x 1 root root 181K Apr 3 2019 libxtables.so.12.0.0

I tried several different approaches (shown below), none of them worked. The packages were built using

snapcraft --target-arch=arm64

Approach #1 (First try):

name: iptables base: core18 version: ‘0.0.1’ summary: Iptables description: | Initial snap for Iptables grade: devel confinement: devmode # use ‘strict’ once you have the right plugs and slots apps: iptables: command: sbin/iptables parts: build-iptables: plugin: autotools source: . configflags: - --disable-nftables

Approach #2 (with wrapper scripts, which sets LD_LIBRARY_PATH explicitely):

name: iptables base: core18 version: ‘0.0.1’ summary: Iptables description: | Initial snap for Iptables grade: devel confinement: devmode # use ‘strict’ once you have the right plugs and slots apps: iptables: command: bin/iptables […]

Wrapper script (/bin/iptables):

#!/bin/sh export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$SNAP/lib:$SNAP/lib/xtables $SNAP/sbin/iptables “$@”

Last but not least I even tried to use the prebuilt variant from the Ubuntu repository. Approach #3 (stage-packages):

name: iptables base: core18 version: ‘0.0.1’ summary: Iptables description: | Initial snap for Iptables grade: devel confinement: devmode # use ‘strict’ once you have the right plugs and slots apps: iptables: command: sbin/iptables parts: iptables: plugin: nil stage-packages: - on amd64 to arm64: - “iptables:arm64” - else: - “iptables”

Same behaviour on the target system for any of the approaches listed above. I am out of ideas / options, what am I doing wrong? Help is very much appreciated.

Kind regards, Michael

2

I don’t have much experience with cross-builds, but I don’t see that you are staging libxtables12, so I wonder if what is in your snap is the wrong arch for some reason.

Eg,

$ unsquashfs ./your.snap
$ file squashfs-root/lib/libxtables.so.12.0.0
3

Hi, thanks for your help!

The library included in the snap is for the correct architecture:

libxtables.so.12.2.0: ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, BuildID[sha1]=cb3389240e44f5e2f06d87e1684128078b737267, with debug_info, not stripped

So unfortunately this is not the source of the problem.

I just tested the snap on Ubuntu Core 18 running on amd64 - doesn’t work, either (same effect). So the problem doesn’t seem to be related to cross compiling.

Kind regards, Michael

4

Hey,

Taking a quick look at iptables/libxtables/xtables.c, it’s calling dlopen with a full pathname instead of a library name, so setting LD_LIBRARY_PATH wont be enough. However, it looks like setting XTABLES_LIBDIR should do the trick.

1 Like
5

Hi,

sorry for the delayed response, I wasn’t able to test your suggestion until now.

Setting XTABLES_LIBDIR indeed solves the problem, thank you very much!

The wrapper script now looks like this:

#!/bin/sh export XTABLES_LIBDIR=$SNAP/lib/xtables $SNAP/sbin/iptables “$@”

1 Like