From: "Max R. Carrara" <m.carrara@proxmox.com>
To: pve-devel@lists.proxmox.com
Cc: Wolfgang Bumiller <w.bumiller@proxmox.com>
Subject: [pve-devel] [RFC pve-firewall v1 0/1] Silence ebtables Audit Messages in dmesg
Date: Fri, 1 Aug 2025 17:45:20 +0200 [thread overview]
Message-ID: <20250801154521.594077-1-m.carrara@proxmox.com> (raw)
Silence ebtables Audit Messages in dmesg - RFC v1
=================================================
In short, this is done by switching the `update-alternatives` calls
in pve-firewall.service from ebtables-legacy / iptables-legacy to
ebtables-nft / iptables-nft.
Switching to ebtables-nft in particular silences the audit log spam one
encounters after upgrading a PVE 8.4 node to PVE 9. This should be
alright as the original bug appears to be fixed [1].
As the bug for iptables [0] appears to be fixed as well, switch to
iptables-nft (and ip6tables-nft), too.
! ! ! NOTE ! ! !
----------------
Switching to {eb,ip}tables-nft might come with some very subtle
consequences that aren't really explained anywhere. Moreover, the nft
subsystem probably handles things completely differently, as Wolfgang
pointed out off-list.
Both versions seem to have slightly different featuresets that can be
determined by diffing their respective manpages--for example, so see how
the -nft versions differ from the -legacy ones, it's possible to do the
following (in bash / zsh, as the penguin operator isn't in sh):
diff -u <(man ebtables-legacy) <(man ebtables-nft) | less
diff -u <(man iptables-legacy) <(man iptables-nft) | less
Since the original change is referred to "a bit of a hack" [2], consider
this "a bit of a hack" as well, so be wary when applying this. I'll have
this run in my test cluster and my workstation for a bit until I'm
really sure that this doesn't cause any unintended side-effects.
Wanted to send this out for now while I'm reading up on everything, so
that others could have a look at least and install it on their own
setups for testing purposes.
References
----------
[0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929527
[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929976
[2]: https://git.proxmox.com/?p=pve-firewall.git;a=commit;h=c743e671dad7a36871b6ab8e061e4200e64a4f54
Summary of Changes
------------------
Max R. Carrara (1):
pve-firewall.service: update-alternatives to {ip,eb}tables-nft
debian/pve-firewall.service | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
next reply other threads:[~2025-08-01 15:43 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-01 15:45 Max R. Carrara [this message]
2025-08-01 15:45 ` [pve-devel] [RFC pve-firewall v1 1/1] pve-firewall.service: update-alternatives to {ip, eb}tables-nft Max R. Carrara
2025-08-01 16:00 ` Thomas Lamprecht
2025-08-01 16:07 ` Max R. Carrara
2025-08-01 16:24 ` Thomas Lamprecht
2025-08-04 7:53 ` Max R. Carrara
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250801154521.594077-1-m.carrara@proxmox.com \
--to=m.carrara@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
--cc=w.bumiller@proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.