[PATCH pve-firewall 0/2] switch iptables/ebtables alternatives back to nft-based versions

[PATCH pve-firewall 0/2] switch iptables/ebtables alternatives back to nft-based versions

[Ethan Zuo]

The issues with nft-based iptables/ebtables were fixed years ago, so switching back to them shouldn't have problems.

Ethan Zuo (2):
  Revert "pve-firewall.service: update-alternative ip-/eb- tables to
    legacy versions"
  d/postinst: reset iptables/ebtables alternatives to auto

 debian/postinst             | 4 ++++
 debian/pve-firewall.service | 3 ---
 2 files changed, 4 insertions(+), 3 deletions(-)

-- 
2.51.0

[PATCH container 1/2] Revert "pve-firewall.service: update-alternative ip-/eb- tables to legacy versions"

[Ethan Zuo]

This reverts commit c743e671dad7a36871b6ab8e061e4200e64a4f54.

The original commit introduced a workaround forcing the use of
legacy iptables and ebtables backends via `update-alternatives`
in the systemd service unit. This was originally required due to
critical bugs in the nftables-based variants.

As these upstream issues have been fixed and the nftables backend
is now stable and preferred in Debian, this workaround is no longer
necessary.

Signed-off-by: Ethan Zuo <yuxuan.zuo@outlook.com>
---
 debian/pve-firewall.service | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/debian/pve-firewall.service b/debian/pve-firewall.service
index f95ce6d..63fc57f 100644
--- a/debian/pve-firewall.service
+++ b/debian/pve-firewall.service
@@ -8,9 +8,6 @@ Before=shutdown.target
 Conflicts=shutdown.target
 
 [Service]
-ExecStartPre=-/usr/bin/update-alternatives --set ebtables /usr/sbin/ebtables-legacy
-ExecStartPre=-/usr/bin/update-alternatives --set iptables /usr/sbin/iptables-legacy
-ExecStartPre=-/usr/bin/update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
 ExecStart=/usr/sbin/pve-firewall start
 ExecStop=/usr/sbin/pve-firewall stop
 ExecReload=/usr/sbin/pve-firewall restart
-- 
2.51.0

[PATCH container 2/2] d/postinst: reset iptables/ebtables alternatives to auto

[Ethan Zuo]

Following commit 67e3e322a881 ("Revert "pve-firewall.service:
update-alternative ip-/eb- tables to legacy versions""), modify the
postinst script to explicitly switch these alternatives back to auto
mode during package configuration. This ensures a seamless transition
during upgrades.

Signed-off-by: Ethan Zuo <yuxuan.zuo@outlook.com>
---
 debian/postinst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/debian/postinst b/debian/postinst
index 8cdb468..8d6a14f 100644
--- a/debian/postinst
+++ b/debian/postinst
@@ -6,6 +6,10 @@ set -e
 
 case "$1" in
     configure)
+	update-alternatives --auto ebtables || true
+	update-alternatives --auto iptables || true
+	update-alternatives --auto ip6tables || true
+
 	# modeled after dh_systemd_start output
 	systemctl --system daemon-reload >/dev/null || true
 	if [ -n "$2" ]; then
-- 
2.51.0

[PATCH pve-firewall 0/2] switch iptables/ebtables alternatives back to nft-based versions

[Ethan Zuo]

Sorry for the double mail, but I wrote wrong subject prefix in the first one.

The issues with nft-based iptables/ebtables were fixed years ago, so switching back to them shouldn't have problems.

Ethan Zuo (2):
  Revert "pve-firewall.service: update-alternative ip-/eb- tables to
    legacy versions"
  d/postinst: reset iptables/ebtables alternatives to auto

 debian/postinst             | 4 ++++
 debian/pve-firewall.service | 3 ---
 2 files changed, 4 insertions(+), 3 deletions(-)

-- 
2.51.0