LXC veth discovery reads a failed probe as no interface, so firewall setup can succeed with no FORWARD hook

[dhoehna]

src/backends/lxc/common/src/network_iptables.rs reads a failed veth probe as no interface, so the FORWARD hook is never installed.

[github-actions]

Triage complete.

Labels applied: OS-Linux, Area-Executor-LXC

Assigned: @SohamDas2021 (LXC/Linux backend) and @bbonaby (networking/firewall/iptables)

This is a correctness/security bug in the LXC veth discovery path — a failed probe is silently treated as "no interface found," allowing firewall setup to report success without installing the FORWARD hook, leaving container traffic unfiltered.

Maintainers: Comment /investigate to check whether this issue or bug is valid against the most current code. Copilot will also produce a report with the changes that will be needed. For a small, unambiguous documentation or test fix, it may also create one draft PR.

Generated by 🏷️ Issue Triage for #878 · sonnet46 · 23.2 AIC · ⌖ 5.31 AIC · ⊞ 7.4K · ◷

[dhoehna]

Consolidated into #896 -- [LXC] Network policy: egress enforcement, hook scoping, and proxy pinning.

The backlog now carries one issue per area instead of one per finding. This report is reproduced there in full and unedited; nothing here is dropped. Track and fix it at #896.