-
Notifications
You must be signed in to change notification settings - Fork 45
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add --no-legacy
parameter
#90
base: master
Are you sure you want to change the base?
Add --no-legacy
parameter
#90
Conversation
Since commit 47b78b6, ferm always uses legacy xtables tools. This commit allows users to revert to the old behaviour.
Apparently, /usr/sbin/iptables-restore refers to the "nft" based tools on some installations, and those are incompatible enough that they sometimes break ferm. To fix this, explicitly, refer to the "legacy" tools. Closes #47
I would also like to have ferm co-exist with other nft-tables based tooling. If you create a iptables-legacy ruleset in the kernal, you can no longer use nft.. I don't mind sacrificing that some ferm idioms won't work. However I would suggest that such failures should be logged as bugs/issues against iptables-nft and friends. |
if (!$option{no_legacy}) { | ||
if ($name =~ /^(.*tables)(.*)$/) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
maybe reduce the diff here with a simpler:
if (!$option{no_legacy}) { | |
if ($name =~ /^(.*tables)(.*)$/) { | |
if (!$option{no_legacy} and $name =~ /^(.*tables)(.*)$/) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
minus cosmetic changes, this LGTM.
@MaxKellermann any plans to get this merged? |
Check out https://gitlab.tuxis.nl/oss_public/ferm. It’s my version with this patch. |
In issue #47, a user reported that "sometimes there are some issues" when using the
iptables-nft
tools. These tools allow users to use the newer nf_tables backend while using the old xtables syntax, and therefore ferm. As a result, legacy xtables tools are now always used (from commit 47b78b6). This makes ferm unusable with nftables.@MaxKellermann argues that ferm should no longer be used in favour of nftables:
However, nftables misses features that ferm has. At the moment, ferm is still useful. I think it should be usable with nftables.
Commit 47b78b6 says that the
iptables-nft
tools are "incompatible enough that they sometimes break ferm". This is only true in specific cases. This PR adds the--no-legacy
parameter. This parameter allows users to revert to the old behaviour at their own risk, i.e. use whatever they've configured as an alternative foriptables
, which isiptables-nft
on Debian by default.