Merge ~mfo/ufw:lp1946804-debian into ufw:debian/master

[Mauricio Faria de Oliveira]

Add patch from master.
Apparently a couple other patches needed to be refresh in order to apply.

[Jamie Strandboge (jdstrand)]

Thanks for the MP! Unfortunately, the reason why you had trouble with the existing patches was because I forgot to push the 0.36.1 changes to the branch (I only pushed the debian/ directory) when I cut the tag. Because of my mistake, this MP won't apply so I'm going to Disapprove. I fixed all this, then applied your patch on top, add a couple of small changes and uploaded 0.36.1-2 to Debian just now.

review: Disapprove

[Mauricio Faria de Oliveira (mfo)]

Ha, that explains it :) The error with the patches was a bit curious, indeed. Thanks for clarifying and handling that!

Unmerged commits

721c3e2... by Mauricio Faria de Oliveira on 2021-10-13

set default policy after loading rules

Signed-off-by: Mauricio Faria de Oliveira <email address hidden>

cb7ef24... by Mauricio Faria de Oliveira on 2021-10-13

refresh python3-versions.diff

Signed-off-by: Mauricio Faria de Oliveira <email address hidden>

863ebc6... by Mauricio Faria de Oliveira on 2021-10-13

refresh 0002-fix-copyright.patch

Signed-off-by: Mauricio Faria de Oliveira <email address hidden>

673555b... by Jamie Strandboge on 2021-09-19

release 0.36.1-1

* New upstream release (LP: #1808463, LP: #1831186, LP: #1838764,
  LP: #1556419, LP: #1933117). Drop the following (included upstream):
  - 0002-fix-check-requirements.patch
  - 0003-lp1838764.patch
  - 0004-make-root-tests-chain-order-agnostic.patch
  - 0005-use-only-python3.patch
  - 0006-bug921680.patch
  - 0007-bug921680-pt2.patch
  - 0008-fix-check-requirements-again.patch
  - 0009-empty-non-functioning-ipt-modules.patch
  - 0010-add-other-firewall-checks.patch
  - 0011-suppress-legacy-warnings-in-tests.patch
  - 0012-pyflakes3.patch
  - 0013-add-prepend-to-help.patch
* Remaining changes:
  - 0001-optimize-boot.patch
  - python3-versions.diff

[ Jamie Strandboge ]
* ufw.lintian-overrides:
  - remove init.d-script-possible-missing-stop override
  - adjust "allow to" override
  - override spare-manual-page for ufw-framework as it gives additional
    details for the ufw command
* 0002-fix-copyright.patch: src/ufw: update copyright year
* debian/*: use my <email address hidden> email address

[ Debian Janitor ]
* Use secure copyright file specification URI.
* Use set -e rather than passing -e on the shebang-line.
* Set upstream metadata fields: Repository, Repository-Browse.
* Update watch file format version to 4.

[ Bastian Triller ]
* debian/ufw.logrotate: use rsyslog-rotate instead of invoke-rc.d
  (Closes: 993525)

diff --git a/debian/changelog b/debian/changelog
index 72e691f..45c93ca 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+ufw (0.36.1-2) UNRELEASED; urgency=medium
+
+  * d/p/0002-fix-copyright.patch: refresh patch (hunk 2).
+  * d/p/python3-versions.diff: refresh patch.
+  * d/p/set-default-policy-after-loading-rules.patch: fix boot stall on
+    iscsi/network root filesystem when starting ufw (LP: #1946804)
+
+ -- Mauricio Faria de Oliveira <[e-mail]>  Wed, 13 Oct 2021 14:54:25 -0300
+
 ufw (0.36.1-1) unstable; urgency=medium
 
   * New upstream release (LP: #1808463, LP: #1831186, LP: #1838764,
diff --git a/debian/patches/0002-fix-copyright.patch b/debian/patches/0002-fix-copyright.patch
index 544f569..42dc1fa 100644
--- a/debian/patches/0002-fix-copyright.patch
+++ b/debian/patches/0002-fix-copyright.patch
@@ -4,6 +4,7 @@ Date:   Sun Sep 19 01:09:36 2021 -0500
 
     src/ufw: update copyright year
 
+[2021-10-13: refresh hunk 2 with s/2018/2015/]
 diff --git a/src/ufw b/src/ufw
 index 115d294..7d72395 100755
 --- a/src/ufw
@@ -21,7 +22,7 @@ index 115d294..7d72395 100755
          sys.exit(0)
      elif pr.action == "version" or pr.action == "--version":
          msg(ufw.common.programName + " " + version)
--        msg("Copyright 2008-2018 Canonical Ltd.")
+-        msg("Copyright 2008-2015 Canonical Ltd.")
 +        msg("Copyright 2008-2021 Canonical Ltd.")
          sys.exit(0)
  
diff --git a/debian/patches/python3-versions.diff b/debian/patches/python3-versions.diff
index aa479e7..642f442 100644
--- a/debian/patches/python3-versions.diff
+++ b/debian/patches/python3-versions.diff
@@ -2,13 +2,14 @@ Author: Matthias Klose <[e-mail]>
 Description: Fix python version check for Python >= 3.9
 Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=975912
 Forwarded: yes
+Last-Updated: 2021-10-13
 --- a/tests/check-requirements
 +++ b/tests/check-requirements
 @@ -59,7 +59,7 @@ for exe in python3 python2 python ; do
          echo "pass (binary: $exe, version: $v, py2)"
          found_python="yes"
          break
--    elif echo "$v" | grep -q "^3.[2-8]"; then
+-    elif echo "$v" | grep -q "^3.[234]"; then
 +    elif echo "$v" | grep -q "^3.[1-9][0-9]*"; then
          echo "pass (binary: $exe, version: $v, py3)"
          found_python="yes"
diff --git a/debian/patches/series b/debian/patches/series
index 7935c84..cdb7cf1 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,4 @@
 0001-optimize-boot.patch
 0002-fix-copyright.patch
 python3-versions.diff
+set-default-policy-after-load.patch
diff --git a/debian/patches/set-default-policy-after-load.patch b/debian/patches/set-default-policy-after-load.patch
new file mode 100644
index 0000000..899346a
--- /dev/null
+++ b/debian/patches/set-default-policy-after-load.patch
@@ -0,0 +1,93 @@
+Origin: upstream, https://git.launchpad.net/ufw/commit/?id=4d25bd6635a493ae10c1984bfe16fb31e3903198
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1946804
+From: Mauricio Faria de Oliveira <[e-mail]>
+Date: Tue, 12 Oct 2021 18:57:40 -0300
+Subject: [PATCH] src/ufw-init-functions: set default policy after loading
+ rules
+
+If default input policy of DROP (default setting in ufw) is set
+before loading rules to allow a network root filesystem to work,
+it freezes before loading them, and the boot process stalls.
+
+Just set default policy after loading rules, as the snippet for
+ip[6]tables-restore has -n/--noflush, which doesn't flush other
+rules in the builtin chains.
+
+The output of iptables -L is identical before/after.
+
+https://bugs.launchpad.net/bugs/1946804
+
+Signed-off-by: Mauricio Faria de Oliveira <[e-mail]>
+---
+ src/ufw-init-functions | 48 ++++++++++++++++++++++--------------------
+ 1 file changed, 25 insertions(+), 23 deletions(-)
+
+diff --git a/src/ufw-init-functions b/src/ufw-init-functions
+index feac8e203c1d..f0dd7f59f4c2 100755
+--- a/src/ufw-init-functions
++++ b/src/ufw-init-functions
+@@ -168,29 +168,6 @@ ufw_start() {
+             AFTER_RULES="$RULES_PATH/after${type}.rules"
+             USER_RULES="$USER_PATH/user${type}.rules"
+ 
+-            # set the default policy
+-            input_pol="$DEFAULT_INPUT_POLICY"
+-            if [ "$DEFAULT_INPUT_POLICY" = "REJECT" ]; then
+-                input_pol="DROP"
+-            fi
+-
+-            output_pol="$DEFAULT_OUTPUT_POLICY"
+-            if [ "$DEFAULT_OUTPUT_POLICY" = "REJECT" ]; then
+-                output_pol="DROP"
+-            fi
+-
+-            forward_pol="$DEFAULT_FORWARD_POLICY"
+-            if [ "$DEFAULT_FORWARD_POLICY" = "REJECT" ]; then
+-                forward_pol="DROP"
+-            fi
+-
+-            printf "*filter\n"\
+-"# builtin chains\n"\
+-":INPUT %s [0:0]\n"\
+-":FORWARD %s [0:0]\n"\
+-":OUTPUT %s [0:0]\n"\
+-"COMMIT\n" $input_pol $forward_pol $output_pol | $exe-restore -n || error="yes"
+-
+             # flush the chains (if they exist)
+             if $exe -L ufw${type}-before-logging-input -n >/dev/null 2>&1 ; then
+                 delete_chains $type || error="yes"
+@@ -378,6 +355,31 @@ ufw_start() {
+                 out="${out}\nCouldn't find '$USER_RULES'"
+                 error="yes"
+             fi
++
++            # set the default policy
++            # (do this after loading rules so not to break
++            # network rootfs w/ INPUT DROP during ufw init.)
++            input_pol="$DEFAULT_INPUT_POLICY"
++            if [ "$DEFAULT_INPUT_POLICY" = "REJECT" ]; then
++                input_pol="DROP"
++            fi
++
++            output_pol="$DEFAULT_OUTPUT_POLICY"
++            if [ "$DEFAULT_OUTPUT_POLICY" = "REJECT" ]; then
++                output_pol="DROP"
++            fi
++
++            forward_pol="$DEFAULT_FORWARD_POLICY"
++            if [ "$DEFAULT_FORWARD_POLICY" = "REJECT" ]; then
++                forward_pol="DROP"
++            fi
++
++            printf "*filter\n"\
++"# builtin chains\n"\
++":INPUT %s [0:0]\n"\
++":FORWARD %s [0:0]\n"\
++":OUTPUT %s [0:0]\n"\
++"COMMIT\n" $input_pol $forward_pol $output_pol | $exe-restore -n || error="yes"
+         done
+ 
+         if [ ! -z "$IPT_SYSCTL" ] && [ -s "$IPT_SYSCTL" ]; then
+-- 
+2.30.2
+