Package: netfilter-persistent
Version: 1.0.4+nmu2
Severity: grave
Tags: security
Justification: renders package unusable
Dear Maintainer,
* What led up to the situation?
Upgrading from jessie to stretch.
On two Debian systems, netfilter-persistent worked fine in jessie but randomly
fails to load rules.v4 and/or rules.v6 during boot. Most of the time, at
least one of these fails. Restarting later works fine.
* What exactly did you do (or not do) that was effective (or
ineffective)?
1) # apt-get purge iptables-persistent netfilter-persistent && apt-get
install iptables-persistent
2) Edit /usr/share/netfilter-persistent/plugins.d/15-ip4tables and
/usr/share/netfilter-persistent/plugins.d/25-ip6tables so
/sbin/ip(6)tables-restore writes errors to a file instead of /dev/null
3) # systemctl restart netfilter-persistent
* What was the outcome of this action?
1) No effect.
2)
iptables-restore: line 33 failed
ip6tables-restore: line 25 failed
(These are the last lines of rules.v4 and rules.v6, each saying
"COMMIT", respectively.)
3) Works (until next reboot).
Since "systemctl restart netfilter-persistent" works just fine, I think it
might have to do with the patch suggested in #819693. Starting with
stretch, the unit file switched from network.target to network-pre.target.
While network-pre.target is in theory intended for firewall use, I think
network-pre.target might make it impossible to reference specific interfaces
within iptables rules (e.g. "-A INPUT -i lo -j ACCEPT").
-- System Information:
Debian Release: 9.0
APT prefers stable
APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.9.0-3-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages netfilter-persistent depends on:
ii init-system-helpers 1.48
ii lsb-base 9.20161125
netfilter-persistent recommends no packages.
Versions of packages netfilter-persistent suggests:
ii iptables-persistent 1.0.4+nmu2
-- no debconf information
