shorewall does not handle non-resolvable hostname gracefully
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| shorewall (Ubuntu) |
New
|
Undecided
|
Unassigned | ||
Bug Description
Binary package hint: iptables
version: Ubuntu 8.04.4 LTS
component: iptables
it seems that a null/non-valid IP (dyndns error, not instancied on World by a syntaxic error on domain names) crash iptables frozing the ubuntu server.
example:
- rightaddress.
- badaddress.
then on booting, we see in shorewall-init.log
17:57:30 Rule "ACCEPT net:rightaddres
added.
iptables v1.3.8: host/network `badaddress.
Try `iptables -h' or 'iptables --help' for more information.
ERROR: Command "/sbin/iptables -A net2fw -p tcp -s
badaddress.
then the Ubuntu server has frozen!
I had to:
- switch in rescue mode and comment the faulting line in /etc/shorewall/
- reboot in standard mode
to recover control of the system.
because badaddress.
| security vulnerability: | yes → no |
| visibility: | private → public |
| affects: | iptables (Ubuntu) → shorewall (Ubuntu) |
| summary: |
- it seems that a null/non-valid IP (dns error, not instancied on World) - crash iptables frozing the ubuntu server + shorewall does not handle non-resolvable hostname gracefully |
| Jamie Strandboge (jdstrand) wrote | #1 |
Trying to reproduce this, I have:
$ sudo iptables -A INPUT -p tcp -s badaddress.
iptables v1.3.8: host/network `badaddress.
Try `iptables -h' or 'iptables --help' for more information.
iptables is not crashing, but instead is letting you know that you can't use 'badaddress.
PS -- In the vast majority of cases, you do not want to use a hostname in your firewall rules because of things like this and because if someone controls the DNS server on the network your computer is using, then he/she can control access to your firewall.