From: "Max R. Carrara" <m.carrara@proxmox.com>
To: pve-devel@lists.proxmox.com
Cc: Wolfgang Bumiller <w.bumiller@proxmox.com>
Subject: [pve-devel] [RFC pve-firewall v1 0/1] Silence ebtables Audit Messages in dmesg
Date: Fri, 1 Aug 2025 17:45:20 +0200 [thread overview]
Message-ID: <20250801154521.594077-1-m.carrara@proxmox.com> (raw)
Silence ebtables Audit Messages in dmesg - RFC v1
=================================================
In short, this is done by switching the `update-alternatives` calls
in pve-firewall.service from ebtables-legacy / iptables-legacy to
ebtables-nft / iptables-nft.
Switching to ebtables-nft in particular silences the audit log spam one
encounters after upgrading a PVE 8.4 node to PVE 9. This should be
alright as the original bug appears to be fixed [1].
As the bug for iptables [0] appears to be fixed as well, switch to
iptables-nft (and ip6tables-nft), too.
! ! ! NOTE ! ! !
----------------
Switching to {eb,ip}tables-nft might come with some very subtle
consequences that aren't really explained anywhere. Moreover, the nft
subsystem probably handles things completely differently, as Wolfgang
pointed out off-list.
Both versions seem to have slightly different featuresets that can be
determined by diffing their respective manpages--for example, so see how
the -nft versions differ from the -legacy ones, it's possible to do the
following (in bash / zsh, as the penguin operator isn't in sh):
diff -u <(man ebtables-legacy) <(man ebtables-nft) | less
diff -u <(man iptables-legacy) <(man iptables-nft) | less
Since the original change is referred to "a bit of a hack" [2], consider
this "a bit of a hack" as well, so be wary when applying this. I'll have
this run in my test cluster and my workstation for a bit until I'm
really sure that this doesn't cause any unintended side-effects.
Wanted to send this out for now while I'm reading up on everything, so
that others could have a look at least and install it on their own
setups for testing purposes.
References
----------
[0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929527
[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929976
[2]: https://git.proxmox.com/?p=pve-firewall.git;a=commit;h=c743e671dad7a36871b6ab8e061e4200e64a4f54
Summary of Changes
------------------
Max R. Carrara (1):
pve-firewall.service: update-alternatives to {ip,eb}tables-nft
debian/pve-firewall.service | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
next reply other threads:[~2025-08-01 15:43 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-01 15:45 Max R. Carrara [this message]
2025-08-01 15:45 ` [pve-devel] [RFC pve-firewall v1 1/1] pve-firewall.service: update-alternatives to {ip, eb}tables-nft Max R. Carrara
2025-08-01 16:00 ` Thomas Lamprecht
2025-08-01 16:07 ` Max R. Carrara
2025-08-01 16:24 ` Thomas Lamprecht
2025-08-04 7:53 ` Max R. Carrara
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250801154521.594077-1-m.carrara@proxmox.com \
--to=m.carrara@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
--cc=w.bumiller@proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox