Merge ~mfo/ufw:lp1946804 into ufw:master

[Mauricio Faria de Oliveira]

[Mauricio Faria de Oliveira (mfo)]

The comparison of `iptables -L` before/after shows no differences (verified on a local rootfs).

`run_tests.sh` has 0 skipped/errors.

------------------------
Functional tests summary
------------------------
Attempted: 22 (3339 individual tests)
Skipped: 0
Errors: 0

[Jamie Strandboge (jdstrand)]

I'm away from my computer, but this looks ok to me. I'll work through this more fully and commit tomorrow, but I think you're good for Ubuntu uploads if this is urgent.

Thanks!

review: Approve

[Mauricio Faria de Oliveira (mfo)]

Thanks for the quick response!

This is not urgent, so it can wait a full review + commit.

If this is merged into master, should I send PRs for the
ubuntu/master and debian/master branches? (for the devel
release.)

I can handle the SRUs for Ubuntu, and ask a core-dev for
sponsoring to the devel release (or let you handle it if
you prefer -- just let me know! :)

Thanks!

[Jamie Strandboge (jdstrand)]

If you send up a PR for debian/master, then I'll upload to Debian and sync to the devel release. Don't worry about ubuntu/master (I only update that if the latest release is different from debian/master, so it is a little out of date atm).

For the Ubuntu SRUs, if you were feeling (even more) industrious, it would be nice to pull in 632cda034f7b96d07667b06d39b6eb396c0e611f to fix https://launchpad.net/bugs/1933117 for 18.04 and later. By all means don't feel that this is required, but the fix is in Debian, impish and the snap already, so if this sounds like something you'd like to do, it just needs the SRU paperwork and processing.

[Mauricio Faria de Oliveira (mfo)]

Ok, I just submitted a PR for debian/master. [1]

Sure, I'll take a look at adding that commit.

cheers.

[1] https://code.launchpad.net/~mfo/ufw/+git/ufw/+merge/410152

diff --git a/src/ufw-init-functions b/src/ufw-init-functions
index feac8e2..f0dd7f5 100755
--- a/src/ufw-init-functions
+++ b/src/ufw-init-functions
@@ -168,29 +168,6 @@ ufw_start() {
             AFTER_RULES="$RULES_PATH/after${type}.rules"
             USER_RULES="$USER_PATH/user${type}.rules"
 
-            # set the default policy
-            input_pol="$DEFAULT_INPUT_POLICY"
-            if [ "$DEFAULT_INPUT_POLICY" = "REJECT" ]; then
-                input_pol="DROP"
-            fi
-
-            output_pol="$DEFAULT_OUTPUT_POLICY"
-            if [ "$DEFAULT_OUTPUT_POLICY" = "REJECT" ]; then
-                output_pol="DROP"
-            fi
-
-            forward_pol="$DEFAULT_FORWARD_POLICY"
-            if [ "$DEFAULT_FORWARD_POLICY" = "REJECT" ]; then
-                forward_pol="DROP"
-            fi
-
-            printf "*filter\n"\
-"# builtin chains\n"\
-":INPUT %s [0:0]\n"\
-":FORWARD %s [0:0]\n"\
-":OUTPUT %s [0:0]\n"\
-"COMMIT\n" $input_pol $forward_pol $output_pol | $exe-restore -n || error="yes"
-
             # flush the chains (if they exist)
             if $exe -L ufw${type}-before-logging-input -n >/dev/null 2>&1 ; then
                 delete_chains $type || error="yes"
@@ -378,6 +355,31 @@ ufw_start() {
                 out="${out}\nCouldn't find '$USER_RULES'"
                 error="yes"
             fi
+
+            # set the default policy
+            # (do this after loading rules so not to break
+            # network rootfs w/ INPUT DROP during ufw init.)
+            input_pol="$DEFAULT_INPUT_POLICY"
+            if [ "$DEFAULT_INPUT_POLICY" = "REJECT" ]; then
+                input_pol="DROP"
+            fi
+
+            output_pol="$DEFAULT_OUTPUT_POLICY"
+            if [ "$DEFAULT_OUTPUT_POLICY" = "REJECT" ]; then
+                output_pol="DROP"
+            fi
+
+            forward_pol="$DEFAULT_FORWARD_POLICY"
+            if [ "$DEFAULT_FORWARD_POLICY" = "REJECT" ]; then
+                forward_pol="DROP"
+            fi
+
+            printf "*filter\n"\
+"# builtin chains\n"\
+":INPUT %s [0:0]\n"\
+":FORWARD %s [0:0]\n"\
+":OUTPUT %s [0:0]\n"\
+"COMMIT\n" $input_pol $forward_pol $output_pol | $exe-restore -n || error="yes"
         done
 
         if [ ! -z "$IPT_SYSCTL" ] && [ -s "$IPT_SYSCTL" ]; then