[pve-devel] [RFC pve-firewall v1 1/1] pve-firewall.service: update-alternatives to {ip, eb}tables-nft

[Thomas Lamprecht]

Am 01.08.25 um 17:45 schrieb Max R. Carrara:
> Back in c743e671d it was necessary to update-alternative `ebtables`
> to `ebtables-legacy` due to some bugs [0][1]. However, these bugs
> appear to be fixed now.

Oh, what a throwback ^^ Yeah might be good to change this, but we're
a bit to late for the next release, still see below for a potential
option.

> 
> In Trixie, `ebtables-legacy` seems to cause an enormous amount of audit
> message spam in `dmesg` after upgrading from Bookworm--about 5 long
> lines every ~10 seconds-- making it very tedious to find anything one
> actually cares about.
> 
> Thus, use the -nft variants instead of the -legacy ones as the
> aforementioned bugs have since long been fixed and the audit log spam
> is silenced that way.
> 
> [0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929527
> [1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929976
> 
> Signed-off-by: Max R. Carrara <m.carrara at proxmox.com>
> ---
>  debian/pve-firewall.service | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/debian/pve-firewall.service b/debian/pve-firewall.service
> index f95ce6d..c99db26 100644
> --- a/debian/pve-firewall.service
> +++ b/debian/pve-firewall.service
> @@ -8,9 +8,9 @@ Before=shutdown.target
>  Conflicts=shutdown.target
>  
>  [Service]
> -ExecStartPre=-/usr/bin/update-alternatives --set ebtables /usr/sbin/ebtables-legacy
> -ExecStartPre=-/usr/bin/update-alternatives --set iptables /usr/sbin/iptables-legacy
> -ExecStartPre=-/usr/bin/update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
> +ExecStartPre=-/usr/bin/update-alternatives --set ebtables /usr/sbin/ebtables-nft
> +ExecStartPre=-/usr/bin/update-alternatives --set iptables /usr/sbin/iptables-nft
> +ExecStartPre=-/usr/bin/update-alternatives --set ip6tables /usr/sbin/ip6tables-nft

Could we make this opt-in? Then we could a. take more time to thoroughly test
this while b. still being able to tell willing users that they could enabled
the nft variant if they are annoyed by the auditd messages.

An implementation option might be using an node-local environment file
sourced by the unit file, e.g.

Environment="VARIANT=legacy"
EnvironmentFile=-/var/lib/pve-firewall/tables-variant

ExecStartPre=-/usr/bin/update-alternatives --set ebtables-${VARIANT}
...




>  ExecStart=/usr/sbin/pve-firewall start
>  ExecStop=/usr/sbin/pve-firewall stop
>  ExecReload=/usr/sbin/pve-firewall restart