[pve-devel] [RFC pve-firewall v1 0/1] Silence ebtables Audit Messages in dmesg

[Max R. Carrara]

Silence ebtables Audit Messages in dmesg - RFC v1
=================================================

In short, this is done by switching the `update-alternatives` calls
in pve-firewall.service from ebtables-legacy / iptables-legacy to
ebtables-nft / iptables-nft.

Switching to ebtables-nft in particular silences the audit log spam one
encounters after upgrading a PVE 8.4 node to PVE 9. This should be
alright as the original bug appears to be fixed [1].

As the bug for iptables [0] appears to be fixed as well, switch to
iptables-nft (and ip6tables-nft), too.

! ! ! NOTE ! ! !
----------------

Switching to {eb,ip}tables-nft might come with some very subtle
consequences that aren't really explained anywhere. Moreover, the nft
subsystem probably handles things completely differently, as Wolfgang
pointed out off-list.

Both versions seem to have slightly different featuresets that can be
determined by diffing their respective manpages--for example, so see how
the -nft versions differ from the -legacy ones, it's possible to do the
following (in bash / zsh, as the penguin operator isn't in sh):

  diff -u <(man ebtables-legacy) <(man ebtables-nft) | less

  diff -u <(man iptables-legacy) <(man iptables-nft) | less

Since the original change is referred to "a bit of a hack" [2], consider
this "a bit of a hack" as well, so be wary when applying this. I'll have
this run in my test cluster and my workstation for a bit until I'm
really sure that this doesn't cause any unintended side-effects.

Wanted to send this out for now while I'm reading up on everything, so
that others could have a look at least and install it on their own
setups for testing purposes.

References
----------

[0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929527
[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929976
[2]: https://git.proxmox.com/?p=pve-firewall.git;a=commit;h=c743e671dad7a36871b6ab8e061e4200e64a4f54

Summary of Changes
------------------

Max R. Carrara (1):
  pve-firewall.service: update-alternatives to {ip,eb}tables-nft

 debian/pve-firewall.service | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

-- 
2.39.5