From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id A03A91FF13F for ; Thu, 12 Feb 2026 08:02:07 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 5525360B4; Thu, 12 Feb 2026 08:02:44 +0100 (CET) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=WchIOrEmT/qXghglE8qRZjq7TCzOV7P/6Per/vMCBAIygQdzQhi+0FeA20h96xXl2NPswr4zoQptV4+7iY7WExvh5Do5XUN2IqOUaviGxxx3+R3xsgmmAEx9h2lTRgllkdclNUXPPawsUIBPiYYBU7YlRhK6je/i6h4N3C8yYCEIRRCwW/jRSBwFj6UeJsuj+mM0whU5RzSmacJh8yPJF8FjdPkxLNooXTYNYPPa7haACJIZGH0QhEfu/gGZXuEJRH0Syns/8XOYv4ohuyUvoIVCrr2F16G2dRxJ05wncHw/Cfx3585WvsKjD7kRzXfulQOAflqJtZKmRuHm9ihoUA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=zmhNZckNI8Foe6ULREL2cR8o2QNFyaX7dVBL7ECUAY8=; b=bZk6EuQvHeRbZ5uHmNWd0QNNFcn/YfdkDaVlP5yqsdbFrRBamT/LjCBI2wFefKSPmz9axZGRLSzUsTw7zH9WL6kJZGH62w5rPTqJB5lmP1VRzpOAUVjOyASB4ueJQ9AirgS+5zhcbScDilZcCCHoGeqpibrT2dkvKVhdhsxuD9uYe/KhN/eIZNnBU1BAxVwvEXM4Nns0eIXECsyte6MOMuINOuFasY8EIeiqdpJ0AJ6iF4CEIQ1E5QzFnFAlL56ik3eneYu9pnpiAAf3ymCWKyLp7Exax+yfc+my9Hk/K5+4br1Z7JqBliEjJ1vMiu9hQU0AhW7jNEidOrM2ciiDww== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zmhNZckNI8Foe6ULREL2cR8o2QNFyaX7dVBL7ECUAY8=; b=oJ1Y53ttIrPRqyxlwFWW+DRw+pVrPpnrvGTKTOXNXKjQXqwLfPCbhqV94fPE9G4vG2xpLpTVphhcy+ainzj3hhRs/HRvPERftiw0FRNmjHB/DoYwTTQaE3xHeaA+V0DedR4gjoAzwSsrxs4EAPFCNnLPiDA5gyl8EiItim4NZnLAEKfxDVJV+bsGjoylFAiL5REJXGa/G9DFAsEQUhyygK4Wb1sxwjvtLRxf11U9Q5D47+tcCyPsBMvlKLcv0IQfbaiMYoS2Fh2pTQ2qLFq7KiV5wEL318KzCVBXCP39G1LSsN72ENUXHmauzLgofQpGT7oU+BesSofTkSiCnl8+LQ== From: Ethan Zuo To: pve-devel@lists.proxmox.com Subject: [PATCH container 1/2] Revert "pve-firewall.service: update-alternative ip-/eb- tables to legacy versions" Date: Thu, 12 Feb 2026 04:16:41 +0800 Message-ID: X-Mailer: git-send-email 2.51.0 In-Reply-To: References: Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: SE2P216CA0151.KORP216.PROD.OUTLOOK.COM (2603:1096:101:2c1::10) To SY0P300MB0609.AUSP300.PROD.OUTLOOK.COM (2603:10c6:10:285::21) X-Microsoft-Original-Message-ID: <20260211201642.165569-2-yuxuan.zuo@outlook.com> MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SY0P300MB0609:EE_|SY7P300MB0526:EE_ X-MS-Office365-Filtering-Correlation-Id: e07f34ff-69c5-4fd5-a7ff-08de69aa99b6 X-MS-Exchange-SLBlob-MailProps: WaIXnCbdHrPy8Gg0T1tV+ubdyTLMpos/OybG5nzGyG1QW1mJupGLPHn110X0nUXFFgQeSNi5L9oU/qxuS/XnL3Pp3Q2GHdZPu8kRcQ/nv44qFQ/pAnkzov8ZlgonhlaNMEUvIPo6WyR5d7MMlrEaQIrqwA0kHqmuKNqpzcQwohzprRJgH27YEE4/kQQ3moCNgi3HCM/sqJvO+Duttv0A9rdpLM1KCyr4I2ery1zCOgn+o2WzULpjCamn3941dcxHeN5F48MqseBuXB8B3kZPqxYK4JW7Zb7hX+odoBkPciUN5CJ4OFdr/WzaAfQQwFr2nV9Sb5Vzx4NihI3flvPsMv0GKQa0003pXPk4ETxrqfyACVZ7xc058FsDmWyPAIKevu4pIrGZGoDWQvgGPiiW5cr5DBd4x9PvsiX/BkEJL/azTG4WTteLYCsdhTbGXUtHFjandI55JMVhHnNTyzUYIOWE2sv/UIaiRo9StU5b30Lwy3Fmdsu7vXaoiGMVrBwRl9Zm3jxxbAUSqRlZotwPAZFdvhlrx/6tFJZz378Ahlif/4MswFK0rnjh31KAYtLOp9WS8F6iyzoVE2qBrKzJXgw1S5RDddEs/nqiDoa3Nnt/ofA+7p2k3fNVmuoaWY2pT2y1/tJDa3sPxoWzL+01rAG8WyHc9q7uKVgyZfz1y/MO2iEPfFxG6CvsOe+Q7WX2gNWFdte7RZGFZCiu3X/J7rVcgKOPX/Ib2UaNi3r8d8sL9LDZHeMcRfyzxviLobhoBjn871jvRHM= X-Microsoft-Antispam: BCL:0;ARA:14566002|15080799012|19110799012|8060799015|21061999006|461199028|5072599009|51005399006|23021999003|3412199025|440099028|40105399003|1710799026; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?TYNr5XFGLMp1+Ev14pLqZQ5gohnw3BdUFi1Wb+tGdQtMFyvbjKH70e9EocOD?= =?us-ascii?Q?lEAbH8Ft/Nat97zLGYM0zCrRHxMw3KWkySyCG+er+V9vUeMq3/xFYdK3tFGt?= =?us-ascii?Q?wjgVNNVy5KCIujxsF/qK/N6meaS1Isi9T6nxEgyYqC6aKczu4Tsw/capnd+L?= =?us-ascii?Q?1mLf0LSHu04Q/6hYuqjwqqCf110bbG5qAG5I6pSf3CK362uy2cDUxcrERl3T?= =?us-ascii?Q?2ERaxc5hb/g9EVo4iB9DZU25II4j4UR5rXl2dJEnQB17J1HjdAGjxlTTk2Xt?= =?us-ascii?Q?0Ujwm7m6oq9lUVaNnjvuTK8W6GCV8//K+yr27qgAFU81CWwACw4IUSY2+yPw?= =?us-ascii?Q?s0FmPDYbdUfwhDZn5MqaxoPWGQRlTO6ALNR580bdn7T3osI9gSXcDCiCCSOu?= =?us-ascii?Q?Ne+HCg5KcySBmZs0qOI5sqjFCYtQS5ZAMY0Y0wG/0indXqCCwK/2Dp0K5uvg?= =?us-ascii?Q?TwUN2JwkRI/35myQzq39bZQYJ3TatIRkoffNUfLOEFp9KdjMmPsBvdJxbFZm?= =?us-ascii?Q?npc9mFNbC+eN1+GoTWiaHIEBX4k+5yWlZXbGfYtxBUUCQM3vu/JW+ag9AG8T?= =?us-ascii?Q?HQT3VAWOwlHsEKPWRUljumctknk1uBgNd5gg/X5WKwmfe+ZAPTjx0a6pZfau?= =?us-ascii?Q?jKZjL6kSM7RTjVUtTilvxyjA0Cx1UXYWGH0sOYFtbUyRBhqhDvpAy4HIFKPD?= =?us-ascii?Q?mVmpfhwsJ527dx7nreXzDf9H3EoCRYwDhd3DT08cmK5Sjces50i2t0qO77J6?= =?us-ascii?Q?32h4cffItzgD4ST/z3ayUh8ixcoVHsPFqaY1T6pqR+H0E0B7TCqRjz1gbfFO?= =?us-ascii?Q?GNmMIzlQ9OFddm6NZZe3TPDrKMhitstfNfGjHo5EvGfzPmbb/uY3/ZNsK+CH?= =?us-ascii?Q?93fDXOH0Ck8UTTZwCxUHEvHmqjXmTOFm6yo80R5yVAbgA08uhPnx4Oq6a2Fa?= =?us-ascii?Q?7xneYNq9NAN78CIvx0C5jsZf4xwISjibho3jvRIeDLRmG0itHtlXztUo26ES?= =?us-ascii?Q?c0N9GPJTHk25oABeoiltlqabSvtfjaPM8q41ZMlBjjdpKWLzSEaWEyxlm8hU?= =?us-ascii?Q?SBzQ+g8geQU3rh9QW08vjYnS4RnFRSRPS8TLdxdmogCaBnD8vtb7dPW4OlMZ?= =?us-ascii?Q?4RsD6Q7j2ZlN9jGpaXXDYYTQ5PVgOkciTvrOY6Lq8mRALjceScpfw1AoOcaW?= =?us-ascii?Q?9Bbqn4ODlO+ITIt5Zhz1ia5REG4+w32uDqX+5+oKQH/aKpLxBC5aul8NE6E?= =?us-ascii?Q?=3D?= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Tca/P+0TthnwaM7S6bvQ9YgsM0wGjLYwdRMK9B4wRqHnm0ZgkmdIUqBoz4bg?= =?us-ascii?Q?OaokbGNcqMO11+Na3B2clH8rkTLnb3ig6SHwc9+E29MU4AWf6OxXJF8a2b52?= =?us-ascii?Q?DaST5BoQhEIq2gN0Y8Q1/AE4jyEtzp/Nwd9qBGh753IAoH4nKVeBrA9zfV0v?= =?us-ascii?Q?lj/7A+s/yyBh+i1RUWnXIc3JPNwr4SZOm4CrkyXzpcqbOUWP1g6wEJv7aIqL?= =?us-ascii?Q?n85AZRTw9VfWxIFwNien8s3V+y7Voc79Lhht9NzjjRLnJ08XHQNuNQPGFS1G?= =?us-ascii?Q?596LJIDtVQNiZNgyX9MXaA1VMx2CfwzthMabxSjDasrAvJg7acZC4+Bx7hSn?= =?us-ascii?Q?qqJRST5XxbiuDlA6NopdgAIvWeH9RgR+6NI4NKsr49GXps0c/g93S2r5U5bM?= =?us-ascii?Q?FkDghPWLy2JMOERT9Ot85/YPiOEc0oD7ojnWHv5Af5ZEdpI2GndQ/1r9UoIP?= =?us-ascii?Q?UOgeoSeUJE2wplyDvgRioThf9+28Lk6XuI3lWFBpnmcAJti+w2SyVT5UyqJV?= =?us-ascii?Q?EPQMeDphiG/e4RRmwVCp2I+2dDrbzdJwr/Cf5L5GXrEIUGrfoTR44nllffQv?= =?us-ascii?Q?6hngFIOqqPeyWuSbqraN93LZ7GE9NPncQ4vswo63uWOXpfFoaai76OUyQcKz?= =?us-ascii?Q?ng26wz3LP0dK5oTwXCbdhBU0mn8wfkRJu2CSXhCekiiWvayJ5zyoou/en9FC?= =?us-ascii?Q?lh8rsx01/1NHz5FB7YHusvPMlfRd6WNEbJoX+IsABvfXzECO2rOxTBpRzDAD?= =?us-ascii?Q?yMXeuLm5AdPFnDOeJQ9fEXRWMjr6FqdgjESyYM2AvFnTzRLqfNq+/WaYISAi?= =?us-ascii?Q?ExBTzmETCMO4FTYqLGVr1Uf4089P2GwVBzMDg4orWLfnXjitX93h9IMXWfjM?= =?us-ascii?Q?JqXTVuhGq7FaC+nUcp94MjWhPBMEy93O+/mdSTpsHehhOkyyCKPQV4LtZWvZ?= =?us-ascii?Q?M9ekbKRNHQgAgXi/UzZ+5r/0B/QknTJyn/vIrJGTZPxiV2GjI6bT4u/+xnOR?= =?us-ascii?Q?xNlfVFTFMzPH33Lwew3xEISYSdfjomRJiyrAP8n8OEqZJCFvj3cnX4a8GMwI?= =?us-ascii?Q?k9I7wDcTo37hg7gC4Vq7shzT90RBaotEseccPuxeO4H4qeFjIe6EONPMLsmS?= =?us-ascii?Q?iQOT4Rz0ssAuVqPULHw8hOwtDpufrFqZLAG+8PSQMzzsjsQYcQp/dYX8aVy+?= =?us-ascii?Q?35ViyK67F9K2d/veKO6NVCVdPnFY2LcrZPsg4kO0SufFX8nenfRqQCxuHn4V?= =?us-ascii?Q?4uxufnYfJSEsDcN32eGmnaK2IBdR0mTLip6JO+vOjU0OLDZR9uzD2Dz3lfn7?= =?us-ascii?Q?A12QVuzsLkvzEEgEd3l/yhHFoV+Gl2adGL8QqCi7DXQasLC7zNEPQghRrT2A?= =?us-ascii?Q?Mluj06G90SfDlxo8M7hVTj2nDW37?= X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e07f34ff-69c5-4fd5-a7ff-08de69aa99b6 X-MS-Exchange-CrossTenant-AuthSource: SY0P300MB0609.AUSP300.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Feb 2026 20:17:38.1219 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SY7P300MB0526 X-SPAM-LEVEL: Spam detection results: 0 ARC_SIGNED 0.001 Message has a ARC signature ARC_VALID 0.001 Message has a valid ARC signature BAYES_00 -1.9 Bayes spam probability is 0 to 1% DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy FREEMAIL_FROM 0.001 Sender email is commonly abused enduser mail provider SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record X-MailFrom: yuxuan.zuo@outlook.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation Message-ID-Hash: GZNZ53JJCTY725L7NNWROCEEJPCVZG4Z X-Message-ID-Hash: GZNZ53JJCTY725L7NNWROCEEJPCVZG4Z X-Mailman-Approved-At: Thu, 12 Feb 2026 08:02:48 +0100 CC: Ethan Zuo X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This reverts commit c743e671dad7a36871b6ab8e061e4200e64a4f54. The original commit introduced a workaround forcing the use of legacy iptables and ebtables backends via `update-alternatives` in the systemd service unit. This was originally required due to critical bugs in the nftables-based variants. As these upstream issues have been fixed and the nftables backend is now stable and preferred in Debian, this workaround is no longer necessary. Signed-off-by: Ethan Zuo --- debian/pve-firewall.service | 3 --- 1 file changed, 3 deletions(-) diff --git a/debian/pve-firewall.service b/debian/pve-firewall.service index f95ce6d..63fc57f 100644 --- a/debian/pve-firewall.service +++ b/debian/pve-firewall.service @@ -8,9 +8,6 @@ Before=shutdown.target Conflicts=shutdown.target [Service] -ExecStartPre=-/usr/bin/update-alternatives --set ebtables /usr/sbin/ebtables-legacy -ExecStartPre=-/usr/bin/update-alternatives --set iptables /usr/sbin/iptables-legacy -ExecStartPre=-/usr/bin/update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy ExecStart=/usr/sbin/pve-firewall start ExecStop=/usr/sbin/pve-firewall stop ExecReload=/usr/sbin/pve-firewall restart -- 2.51.0