Bug#935640: running 'firehol restart' does not always reproduce ruleset

2019-08-24 Thread Jerome BENOIT
Hello Toni,

I guess that your issue is related to FireHOL issue #352:
https://github.com/firehol/firehol/issues/352

This issue seems to cause a lot of trouble.
It is related to the new iptable-{legacy,nft}.
FireHOL does not yet support iptable-nft.
In the last Debian package, FireHOL is forced to use the -legacy tools.
See the comment by FabioPedretti on Nov 8, 2018.

The issue seems to appear on at upgrade stage: on my own box, rebooting was 
sufficient.
I agree to say that the upgrade should be smoother.
Any idea on how to deal with this issue is welcome.

Cheers,
Jerome


-- 
Jerome BENOIT | calculus+at-rezozer^dot*net
https://qa.debian.org/developer.php?login=calcu...@rezozer.net
AE28 AE15 710D FF1D 87E5  A762 3F92 19A6 7F36 C68B



signature.asc
Description: OpenPGP digital signature


Bug#935640: running 'firehol restart' does not always reproduce ruleset

2019-08-24 Thread Toni
Package: firehol
Version: 3.1.6+ds-8
Severity: normal


Hi,

I am fiddling with my firehol rules, but am encountering a very
confusing behaviour. Initially, after system boot, the rules are created
with 'iptables'. When I run 'firehol restart', 'firehol' shows that all
chains are having only an "ACCEPT" policy and no rules, while all rules
are now only visible using 'iptables-legacy', which did not show any
rules earlier. This is very confusing, as the rules are also entirely
not the same.

In my opinion, firehol should only the 'iptables' command and not the
'iptables-legacy' command, if possible, but not change horses midway.


Cheers,
Toni


-- System Information:
Debian Release: 10.0
  APT prefers stable
  APT policy: (990, 'stable'), (500, 'proposed-updates'), (90, 'testing'), (70, 
'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-5-amd64 (SMP w/12 CPU cores)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, 
TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.utf8 (charmap=UTF-8), 
LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages firehol depends on:
ii  firehol-common  3.1.6+ds-8
ii  lsb-base10.2019051400

Versions of packages firehol recommends:
ii  fireqos  3.1.6+ds-8

Versions of packages firehol suggests:
pn  firehol-doc
pn  firehol-tools  
pn  ulogd2 

-- Configuration Files:
/etc/firehol/firehol.conf changed [not included]

-- no debconf information