silent failure if app is edited after adding

[Leonard Lausen]

Hello,

First, I'm using ufw 0.31.1-2 (debian wheezy).

Suppose you have an app APPNAME:

   Profile: APPNAME
   Title: Appname
   Description: sample app

   Port:
     60000

If you create a rule for that application:

   ufw allow APPNAME

And than at some point later decide to change the APPNAME profile to something containing multiple ports (which is not supported by ufw without specifying a protocol) like:

   Profile: APPNAME
   Title: Appname
   Description: sample app

   Port:
     60000:61000

After that you'll have to update the app with either

   ufw app update APPNAME

or do a

   service ufw restart

Now there should be an error message indication that having multiple ports without specifying a protocol is not supported. (ERROR: Must specify 'tcp' or 'udp' with multiple ports) But there is NOT.

Instead of showing such an error, ufw not only silently fails to add this rule but it corrupts the whole firewall. So none of the rules, not even the default policy is enforced anymore and the server admin is not even told that anything has gone wrong.

Furthermore it is not anymore possible to remove the rule.

   ufw delete APPNAME

fails silently and

   ufw delete NUMBER

gives: ERROR: Must specify 'tcp' or 'udp' with multiple ports

The admin first has to manually edit the APPNAME profile to something supported before he can remove the rule.

If he does so, the following error is shown:

   iptables: Bad rule (does a matching rule exist in that chain?).

I think that this is a really critical issue, as it breaks the whole firewall without the admin noticing..