Bad interface name

Bug #1719211 reported by les on 2017-09-24
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ufw (Ubuntu)
Status tracked in Disco
Bionic
Medium
Jamie Strandboge
Cosmic
Medium
Jamie Strandboge
Disco
Medium
Jamie Strandboge

Bug Description

[Impact]

ufw's interface name's or both too strict (this bug) and too loose (iptables has its own limits). Adjust the interface name checks to match those of the kernel.

[Test Case]

$ sudo ufw --dry-run allow in on i-1|grep i-1
### tuple ### allow any any 0.0.0.0/0 any 0.0.0.0/0 in_i-1
-A ufw-user-input -i i-1 -j ACCEPT
### tuple ### allow any any ::/0 any ::/0 in_i-1
-A ufw6-user-input -i i-1 -j ACCEPT

With an unpatched ufw, the above results in:

$ sudo ufw --dry-run allow in on i-1|grep i-1
ERROR: Bad interface name

[Regression Potential]

Risk of regression is considered low since the updated allow more than what is currently allowed, but not more than what iptables allows. See:

https://git.launchpad.net/ufw/tree/src/common.py?h=release/0.36#n295

= Original description =

Is there a reason to restrict interface's name in ufw?
Should ufw accept what iptables accept as iface name?

I've a vpn with lot of nodes, its iface name contain a '-' so cannot use ufw on it.

I've found the check here and cannot found a reason for it:
http://bazaar.launchpad.net/~jdstrand/ufw/trunk/view/head:/src/common.py#L300

thanks

Jamie Strandboge (jdstrand) wrote :

Thank you for using Ubuntu and reporting a bug. We restrict the interface name simply for input validation and after doing a bit of research, I see no reason why we can't allow '-' and '_' in the interface name. I'll adjust trunk for that, but it may be expanded further.

Changed in ufw (Ubuntu):
assignee: nobody → Jamie Strandboge (jdstrand)
importance: Undecided → Medium
status: New → Triaged
Changed in ufw (Ubuntu):
status: Triaged → In Progress
Changed in ufw (Ubuntu Cosmic):
status: New → Triaged
Changed in ufw (Ubuntu Bionic):
status: New → Triaged
importance: Undecided → Medium
Changed in ufw (Ubuntu Cosmic):
importance: Undecided → Medium
Changed in ufw (Ubuntu Bionic):
assignee: nobody → Jamie Strandboge (jdstrand)
Changed in ufw (Ubuntu Cosmic):
assignee: nobody → Jamie Strandboge (jdstrand)
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ufw - 0.36-1

---------------
ufw (0.36-1) unstable; urgency=medium

  * New upstream release (LP: #1782384, LP: #1664133, LP: #1509725,
    LP: #1695718, LP: #1719211, LP: #1775043, LP: #1204579, LP: #1652163,
    LP: #1377600, Closes: 686248, LP: #1368411, LP: #1586258, Closes: 909163,
    Closes: 884932, LP: #1558068)
    - drop 0002-bug849628.patch (included upstream)
    - drop 0003-use-default-tcp-syncookies.patch (included upstream)
    - drop 0004-lp1633698.patch (included upstream)
  * Remaining changes:
    - 0001-optimize-boot.patch
  * debian/ufw.maintscript: remove /etc/bash_completion.d/ufw on upgrade
    (LP: #1602834)
  * debian/control: remove no longer needed xs-python-version and
    x-python3-version fields
  * update debian/before6.rules.md5sum for file shipped in 0.35-6. While both
    before.rules and before6.rules were updated in this new upstream release,
    0.35-6 mistakenly already had its own md5sum for before.rules, so we don't
    need to add it now.

 -- Jamie Strandboge <email address hidden> Fri, 14 Dec 2018 17:50:47 +0000

Changed in ufw (Ubuntu Disco):
status: In Progress → Fix Released
description: updated
Changed in ufw (Ubuntu Bionic):
status: Triaged → In Progress
Changed in ufw (Ubuntu Cosmic):
status: Triaged → In Progress

An upload of ufw to cosmic-proposed has been rejected from the upload queue for the following reason: "All bugs mentioned in the .changes file (so therefore also in the new debian/changelog entries) need to comply with SRU standards (test-case, regression potential). Please re-upload after filling out the required info or modify changelog to exclude irrelevant bug numbers.".

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers