Silence ebtables Audit Messages in dmesg - RFC v1
=================================================
In short, this is done by switching the `update-alternatives` calls
in pve-firewall.service from ebtables-legacy / iptables-legacy to
ebtables-nft / iptables-nft.
Switching to ebtables-nft in particular silences the audit log spam one
encounters after upgrading a PVE 8.4 node to PVE 9. This should be
alright as the original bug appears to be fixed [1].
As the bug for iptables [0] appears to be fixed as well, switch to
iptables-nft (and ip6tables-nft), too.
! ! ! NOTE ! ! !
----------------
Switching to {eb,ip}tables-nft might come with some very subtle
consequences that aren't really explained anywhere. Moreover, the nft
subsystem probably handles things completely differently, as Wolfgang
pointed out off-list.
Both versions seem to have slightly different featuresets that can be
determined by diffing their respective manpages--for example, so see how
the -nft versions differ from the -legacy ones, it's possible to do the
following (in bash / zsh, as the penguin operator isn't in sh):
diff -u <(man ebtables-legacy) <(man ebtables-nft) | less
diff -u <(man iptables-legacy) <(man iptables-nft) | less
Since the original change is referred to "a bit of a hack" [2], consider
this "a bit of a hack" as well, so be wary when applying this. I'll have
this run in my test cluster and my workstation for a bit until I'm
really sure that this doesn't cause any unintended side-effects.
Wanted to send this out for now while I'm reading up on everything, so
that others could have a look at least and install it on their own
setups for testing purposes.
References
----------
[0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929527
[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929976
[2]:
https://git.proxmox.com/?p=pve-firewall.git;a=commit;h=c743e671dad7a36871b6ab8e061e4200e64a4f54
Summary of Changes
------------------
Max R. Carrara (1):
pve-firewall.service: update-alternatives to {ip,eb}tables-nft
debian/pve-firewall.service | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
