Your message dated Wed, 21 Jul 2021 14:48:38 +0000
with message-id <[email protected]>
and subject line Bug#991309: fixed in nftables 0.9.8-3.1
has caused the Debian Bug report #991309,
regarding nftables 0.9.8 regresses icmp rule deletion
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
991309: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991309
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: nftables
Version: 0.9.8-3
Tags: fixed-in-experimental
Hi,
I wanted to raise awareness for an issue [1] that was originally filed
by Michael Biebl but not further pursued in the nftables package AFAICS.
In Debian CI that isn't obvious as the tests are all skipped
https://ci.debian.net/data/autopkgtest/testing/amd64/f/firewalld/13738304/log.gz
But the Ubuntu CI flags the issue
https://autopkgtest.ubuntu.com/results/autopkgtest-impish/impish/amd64/f/firewalld/20210510_135128_36f9c@/log.gz
I was looking into the case in [2] and found that in the meantime
there is a fix for that [3] available upstream.
I see that there is nftables 0.9.9-1~exp1 in experimental and I have
tagged this bug as fixed there.
Surely we would not want to move to 0.9.9 in the current release while
in the final freeze.
But given that it would be a regression for upgraders buster->bullseye
I wonder if the isolated patch [3] should maybe be applied.
I have done so in an Ubuntu PPA [4] and re-run the firewalld tests against it.
Those tests - and in general the issue of deleting too many icmp rules
- is fixed by that.
[1]: https://github.com/firewalld/firewalld/issues/752
[2]: https://bugs.launchpad.net/ubuntu/+source/nftables/+bug/1936902
[3]:
https://git.netfilter.org/nftables/commit/?id=533565244d88a818d8828ebabd7625e5a8a4c374
[4]: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4626/+packages
--
Christian Ehrhardt
Staff Engineer, Ubuntu Server
Canonical Ltd
--- End Message ---
--- Begin Message ---
Source: nftables
Source-Version: 0.9.8-3.1
Done: Christian Ehrhardt <[email protected]>
We believe that the bug you reported is fixed in the latest version of
nftables, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Christian Ehrhardt <[email protected]> (supplier of updated
nftables package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 20 Jul 2021 10:01:47 +0200
Source: nftables
Architecture: source
Version: 0.9.8-3.1
Distribution: unstable
Urgency: medium
Maintainer: Debian Netfilter Packaging Team
<[email protected]>
Changed-By: Christian Ehrhardt <[email protected]>
Closes: 991309
Changes:
nftables (0.9.8-3.1) unstable; urgency=medium
.
* Non-maintainer upload.
* d/p/payload-check-icmp-dependency-before-removing-previo.patch
Fix a regression in nftables 0.9.8 that made nftables too greedy
in removing icmp dependencies (Closes: #991309).
Checksums-Sha1:
91d8d8f46e4323be697a4624aa5ee88a5359fc24 2698 nftables_0.9.8-3.1.dsc
dec1d45d7335b391800fa3ee0fe3bedd688b9d46 21964 nftables_0.9.8-3.1.debian.tar.xz
a560ee38e79034deb5fdf0ffb859ea1cdf17ba6e 7424
nftables_0.9.8-3.1_source.buildinfo
Checksums-Sha256:
2ebdc65c6123e0a637f2050a0de856816d1dc28bad6a3145a18ec15ced4b086e 2698
nftables_0.9.8-3.1.dsc
d555c50ef9f8112f0344cb4364c2ccf6d73a0a9c3a3b1e7daa62020cea565601 21964
nftables_0.9.8-3.1.debian.tar.xz
bf6a24044f52ca6fe3f14a048fe5c12e4a82bd0e853f0488258e303fb0804b70 7424
nftables_0.9.8-3.1_source.buildinfo
Files:
24511038d8932f33e4d3a709288b7043 2698 net important nftables_0.9.8-3.1.dsc
973ff701ae8ba5350f84b3fd2dead4b7 21964 net important
nftables_0.9.8-3.1.debian.tar.xz
766d64d11da1f6da206b5e382c397b02 7424 net important
nftables_0.9.8-3.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEktYY9mjyL47YC+71uj4pM4KAskIFAmD4LJ4ACgkQuj4pM4KA
skI6dg//RBe8Cx8EP/HHJkc9fKSnLa7A8VEUHvtaWPOXgWWHrfMLox+0cJcCGBVy
6tjj+Jkz034n0grbmLTWl/cQljYQkIwhb9Bxzg5LK9IJQaJq+y5ALO7MgM7t07DS
wWEEuI1UlFFGWKrPrPo9UQTAUJGGFgKZFwYP/8H9mFlWapbBKIwRz8tK++6Ag0G9
PpX3wG9S9mbRh0gO38q+PhyIU5V1zKAR4m0h672+Pwx+39HoBsND9DHPr78oWyVx
P4lt3SRkh0hU1YUIre9FFiiijTNzxVmvyiKg1ND7J4MsZv/puMR0m0RPWI1dQkdH
F2dB9D9MkSE+/ucswiVwWuPX30JU11o0Hgx9HAar+qv5bkkLJRqD6gmiS4ZzhR/J
EW4dqpfwa17bxKo8dwfGr/9o49vPM+2BgRxXo1dMlrlTDtIQ2toO3fPwj7JPQDbb
T+hq34tQpwKPT6UK2IS2dPC02HhM1SOllRC82+GUeWf+VaenZ5o/6jyeqhr7QQNB
rrPnOm5uwqf5KB+64f74Sbzj3kFGbS68CsRM6b9shCWA0q7B+1VkLrnnwHJOYU2n
tBZhVK5yqzkFbkBPnQbIriH/C3+QvAGe9fVZ1yw4VQ6kwiaGuikCNj9NxJeNSKta
5JivP0TSCmNcMohiFefkdk2x95TQFYhK6/kZU7DiubFoeqzFQGQ=
=+tCg
-----END PGP SIGNATURE-----
--- End Message ---
