[SRU] ufw adds rules to chains when --dry-run is specified

[Jamie Strandboge]

Binary package hint: ufw

When testing rules with '--dry-run', ufw will add the rule to the running firewall (but not it's rules files in /var/lib/ufw). Eg:

$ sudo ufw status
Firewall loaded
$ sudo ufw --dry-run allow http*filter
:ufw-user-input - [0:0]
:ufw-user-output - [0:0]
:ufw-user-forward - [0:0]
### RULES ###

### tuple ### allow tcp 80 0.0.0.0/0 any 0.0.0.0/0
-A ufw-user-input -p tcp --dport 80 -j ACCEPT

### END RULES ###
-A ufw-user-input -j RETURN
-A ufw-user-output -j RETURN
-A ufw-user-forward -j RETURN
COMMIT
Rule added
$ sudo ufw status
Firewall loaded

To Action From
-- ------ ----
80:tcp ALLOW Anywhere

This is problematic because 'delete' doesn't work anymore (however, disabling/enabling the firewall or forcing a reload removes the rule).

This fix is simple, and will be uploaded to -proposed soon:
=== modified file 'src/ufw'
--- src/ufw 2008-05-10 12:28:11 +0000
+++ src/ufw 2008-07-09 19:25:18 +0000
@@ -1220,7 +1220,7 @@
             rstr = "Rules updated (v6)"

         # Operate on the chains
- if self._is_enabled():
+ if self._is_enabled() and not self.dryrun:
             flag = ""
             if modified:
                 # Reload the chain

[Jamie Strandboge (jdstrand)]

SRU Request

Impact: rules are added when explicitly not intended to be. Requires reloading the firewall to flush the mistakenly added rule out

Bug is trivially fixed by checking for the dryrun status before operating on the chains.

TEST CASE:
1. Enable the firewall:
$ sudo ufw enable

2. Check status of firewall (should have no rules):
$ sudo ufw status
Firewall loaded

3. Perform a dry-run:
$ sudo ufw --dry-run allow http
...
Rule added

4. Check status of firewall (should have no rules, but does in 0.16.2.1):
$ sudo ufw status
Firewall loaded

To Action From
-- ------ ----
80:tcp ALLOW Anywhere

After the applying the debdiff (package in -proposed), step '4' shows no rules were added.

Regression potential: it is believed there is no regression potential

[Launchpad Janitor (janitor)]

This bug was fixed in the package ufw - 0.18.1

---------------
ufw (0.18.1) intrepid; urgency=low

  * src/ufw: don't modify the chains when --dry-run is specified. Fixes
    LP: #247352
  * bump version

 -- Jamie Strandboge <email address hidden> Mon, 07 Jul 2008 16:26:08 -0400

[Martin Pitt (pitti)]

Accepted into -proposed, please test and give feedback here. Please see https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

[Jamie Strandboge (jdstrand)]

Using the above test case fixed the bug. Additionally, I tested adding and deleting rules with and without --dry-run enabled and it works as expected.

[Martin Pitt (pitti)]

Copied to hardy-updates.