[2.3.3+] Interface groups with a '-' (dash) in name are not handled correctly, breaking firewall rules
- Create an interface group named like
- Try to add some firewall rule there and save.
Alternative way to reproduce:
- Install tinc package
- Try to use the pkg-tinc interface in firewall rules
There were error(s) loading the rules: /tmp/rules.debug:149: macro 'prefix' not defined - The line in question reads : pass in quick on $prefix-test inet from any to any tracker 1485799084 keep state label "USER_RULE" @ 2017-01-30 17:58:07
Affected versions: RELENG_2_3 and master (no proper choice for 2.3.3 in Redmine).
Related forum thread (only linking the only useful post directly): https://forum.pfsense.org/index.php?topic=124622.msg689044#msg689044
(And while there, the GUI should NOT let users delete an interface group with a reserved pkg- prefix in name while the package that created it is still installed.)
@rbgarga - these were your commits IIRC. https://github.com/pfsense/FreeBSD-ports/pull/149
Updated by Kill Bill over 5 years ago
To get this really fixed, it's needed to
1/ revert a bunch of other commits that allowed that stuff specifically for use with packages (the pkg- prefix).
2/ do something about the tinc package
pkg_ instead of
(Plus, can file a separate bug about the last remaining issue, i.e. that users shouldn't be allowed to mess with package-created interface groups, but that depends on 2/ above).
Updated by Phillip Davis over 5 years ago
I guess the package should be responsible for deleting the Interface Group as it uninstalls itself.
So the Interface Groups display and edit pages can always prevent delete/edit of "pkg_*" Interface Groups. From core code there will be no need to try to work out which package made the Interface Group and if that package is installed or not.