4

It is a fresh install of Ubuntu 20.4 or Ubuntu 22.04 but they all failed when I tried to enable ufw with errors as below from a Ubuntu console.

 sudo ufw enable
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/ufw/util.py", line 427, in under_ssh
    ppid = get_ppid(pid)
  File "/usr/lib/python3/dist-packages/ufw/util.py", line 419, in get_ppid
    ppid = open(name).readlines()[0].split(')')[1].split()[1]
IndexError: list index out of range

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/sbin/ufw", line 138, in <module>
    not ui.continue_under_ssh():
  File "/usr/lib/python3/dist-packages/ufw/frontend.py", line 901, in continue_under_ssh
    if self.backend.do_checks and ufw.util.under_ssh(): # pragma: no cover
  File "/usr/lib/python3/dist-packages/ufw/util.py", line 457, in under_ssh
    return under_ssh(ppid)
  File "/usr/lib/python3/dist-packages/ufw/util.py", line 457, in under_ssh
    return under_ssh(ppid)

My WSL2 has the following ...

 wsl -l -v
  NAME            STATE           VERSION
* Ubuntu-22.04    Running         2
  Ubuntu-20.04    Stopped         2

I have similar configuration in another PC but do not have this issue. I have shutdown, updated WSL, reinstalled different versions of Ubuntu but got same result. I have searched around but could not find any match. Hopefully some experts with ufw experience can help me out. Thanks,

zung nguyen
  • 43
  • 1
  • 5
  • What is your aim with enabling UFW? It is quite pointless with WSL2’s NAT networking. – Daniel B Mar 26 '23 at 16:09
  • 2
    Does this answer your question? [Can I use WSL's ufw as a firewall for Windows 10?](https://superuser.com/questions/1626459/can-i-use-wsls-ufw-as-a-firewall-for-windows-10) – harrymc Mar 26 '23 at 17:47
  • I would allow SSH in ufw and can SSH into WSL Ubuntu from another PC using tailscale – zung nguyen Mar 28 '23 at 01:01
  • 1
    @harrymc This is not a duplicate. It's entirely possible to run `ufw` under WSL, or at least it used to be before this bug. It's not entirely *useful*, but the dupe question you linked to is about how to use `ufw` as the *Windows* firewall. This question isn't about that. – NotTheDr01ds Mar 28 '23 at 02:07
  • 1
    @NotTheDr01ds: I'm convinced and I retracted my close vote. – harrymc Mar 28 '23 at 08:23

2 Answers2

6

This is a bug, like @NotTheDr01ds said. I filed a bug report here.

Update: It's fixed in version 0.36.2. However, 0.36.2 may not be available for your Ubuntu version yet. You can check what versions are available by running sudo apt update;apt policy ufw

You can fix this issue by going to the get_ppid function in util.py and replacing the first split with rsplit(')', 1) so it splits based on the last parenthesis instead of the all parenthesis.

Before: ppid = open(name).readlines()[0].split(')')[1].split()[1]

After: ppid = open(name).readlines()[0].rsplit(')',1)[1].split()[1]

Almenon
  • 326
  • 1
  • 3
  • 12
2

You are definitely hitting a bug, which I can reproduce. I'm not sure yet whether the bug was introduced in Ubuntu 22.04 or a recent WSL version (I'll update when I narrow that down, but it appears from your question that you are saying it occurs in 20.04 as well). And it's a subtle bug - I actually had to break out the Python debugger (pdb) to step through the UFW code in order to find out why this is happening.

Ultimately, it's a parsing problem in the UFW code that is walking the process tree to see if any of the parent processes are the SSH daemon (sshd). In WSL, one of the init processes returns an "odd" result in its /proc/<pid>/stat. Instead of being named init there, it's something like Relay(<PPID>) (where the PPID is the parent Init process PID). The UFW code's parsing function:

ppid = open(name).readlines()[0].split(')')[1].split()[1]

... isn't anticipating a process name with parenthesis inside it. It expects the proc name to be surrounded by parenthesis. When it tries to split this particular /proc/<pid>/stat, the extra parenthesis causes it to return an empty string rather than the expected parent PID, and thus fails.

Ultimately, this is going to require an upstream fix. I'm sure there are workarounds, but patching the system ufw isn't one that I recommend. I'll update this answer as I learn more, though.

NotTheDr01ds
  • 17,574
  • 4
  • 44
  • 81