#985561 Please re-add nftables.service dependency in fail2ban.service

Package:
fail2ban
Source:
fail2ban
Submitter:
Laurent Bigonville
Date:
2021-03-20 10:18:03 UTC
Severity:
normal
#985561#5
Date:
2021-03-19 22:53:49 UTC
From:
To:
Hello,

Making this RC as this could cause ordering issue during boot and
firewalling rules not being properly applied, feel free to donwgrade

It seem that the deb_no_iptables_service patch removes nftables.service
from PartOf=, but recent nftables is shipping this service and the
bullseye defaults to nft as well

Shouldn't nftables.service be readded?

Kind regards,
Laurent Bigonville
#985561#10
Date:
2021-03-20 08:58:59 UTC
From:
To:
control: severity -1 normal
control: thanks


Le 19/03/2021 à 23:53, Laurent Bigonville a écrit :

Not sure I understand why you think this was serious ?

AFAIK, it has been this way for a long time and didn't cause significant
issues?!

Thanks

S
#985561#17
Date:
2021-03-20 10:06:05 UTC
From:
To:
Le 20/03/21 à 09:58, Sylvestre Ledru a écrit :
Bullseye will use nftables by default instead of iptables for what I
understand.

PartOf=nftables.service means that if nftables.service is
restarted/stopped, fail2ban.service will be restarted/stopped too.

So if the user uses nftables.service to restore nftables rules, it's
possible that fail2ban still think that its rules are still present in
the firewall and it will not readd them as it's not being restarted.
#985561#22
Date:
2021-03-20 10:14:44 UTC
From:
To:
Le 20/03/21 à 11:06, Laurent Bigonville a écrit :
OK, i see. The problem is that firewalld is adding
"Conflicts=iptables.service ip6tables.service ebtables.service
ipset.service nftables.service" meaning that it would create a
dependency issue between the fail2ban.service, firewalld.service and
nftables.service

But that still mean that the integration with nftables is not perfect