ufw loglevels don't log after reboot

[Jamie Strandboge]

Binary package hint: ufw

ufw performs per-rule logging just fine, and it will perform logging after performing a 'ufw disable ; ufw enable', but does not add the necessary logging rules with ufw-init after a reboot. Eg:

$ diff ./save_after_start ./save_after_enable
...
73a74,75
> -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
> -A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
91a94,95
> -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
> -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "

ProblemType: Bug
Architecture: amd64
Date: Sat Oct 24 13:07:22 2009
DistroRelease: Ubuntu 9.10
Package: ufw 0.29-4ubuntu1 [modified: lib/ufw/ufw-init]
PackageArchitecture: all
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-14.48-generic
SourcePackage: ufw
Uname: Linux 2.6.31-14-generic x86_64

[Jamie Strandboge (jdstrand)]

TEST CASE

$ sudo iptables-save|grep '^-.*logging' | wc -l
12
$ sudo ufw disable
$ sudo sed -i "s/^ENABLED=.*/ENABLED=yes/" /etc/ufw/ufw.conf
$ sudo /lib/ufw/ufw-init start
8

While the number of lines given by 'wc' will differ depending on the firewall configuration, the important thing is they should be the same. The above shows an unpatched ufw.

[Jamie Strandboge (jdstrand)]

UPDATED TEST CASE

I forgot to enable the firewall initially and left out the 2nd iptables-save command. Please use this test case instead:
$ sudo ufw enable
$ sudo iptables-save|grep '^-.*logging' | wc -l
12
$ sudo ufw disable
$ sudo sed -i "s/^ENABLED=.*/ENABLED=yes/" /etc/ufw/ufw.conf
$ sudo /lib/ufw/ufw-init start
$ sudo iptables-save|grep '^-.*logging' | wc -l
8

The output of the two iptables-save commands should be identical.

[Jamie Strandboge (jdstrand)]

Fixed in 0.29.1

[Jamie Strandboge (jdstrand)]

Lucid will be updated via a sync of 0.29.1-1 from Debian, once it is available.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ufw - 0.29.1-1

---------------
ufw (0.29.1-1) unstable; urgency=low

  * new upstream release, fixing LP: #459925 and LP: #480789
  * debian/postinst: run 'ufw logging <log level>' to update the user
    rules for logging (this action does nothing when ufw is not enabled)
  * debian/ufw.upstart.ubuntu: don't use 'quiet' since we also now look for
    QUIET
  * debian/rules:
    - only install upstart on Ubuntu 9.10 and later
    - use $(PYTHON) with setup.py

ufw (0.29-5) unstable; urgency=low

  * reduce console output when using Upstart so that ufw is quiet when
    ufw is disabled or enabled and no errors
    - src/ufw-init: add add 'quiet' option on start
    - debian/ufw.upstart.ubuntu: use 'quiet' option on start
  * Debconf translation updates:
    - Vietnamese (thanks to Clytie Siddall. closes: #547919)
 -- Jamie Strandboge <email address hidden> Mon, 30 Nov 2009 21:31:38 +0000

[Jamie Strandboge (jdstrand)]

Jaunty has been EOLd.