{"record":{"id":"f007a20f57df3869","repo":"jdx/mise","slug":"firewall-interface-interface-is-invalid","errorCode":null,"errorMessage":"firewall interface '{interface}' is invalid","messagePattern":"firewall interface '(.+?)' is invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/firewall.rs","lineNumber":1975,"sourceCode":"    if name.is_empty()\n        || name.len() > 64\n        || !name\n            .bytes()\n            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))\n    {\n        bail!(\"firewall rule name '{name}' must contain only ASCII letters, numbers, '-' or '_'\");\n    }\n    Ok(())\n}\n\nfn validate_interface(interface: &str) -> Result<String> {\n    if interface.is_empty()\n        || interface.len() > 15\n        || !interface\n            .bytes()\n            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b':'))\n    {\n        bail!(\"firewall interface '{interface}' is invalid\");\n    }\n    Ok(interface.to_string())\n}\n\nfn parse_ssh_connection(value: &str) -> Result<SshConnection> {\n    let fields = value.split_ascii_whitespace().collect::<Vec<_>>();\n    if fields.len() != 4 {\n        bail!(\"SSH_CONNECTION must contain client address/port and server address/port\");\n    }\n    Ok(SshConnection {\n        peer: fields[0].parse()?,\n        server: fields[2].parse()?,\n        server_port: fields[3].parse()?,\n    })\n}\n\n/// Detect an sshd ancestor when SSH_CONNECTION was stripped by sudo, env -i,\n/// or a wrapper. `None` fails closed because ancestry could not be inspected.","sourceCodeStart":1957,"sourceCodeEnd":1993,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/system/firewall.rs#L1957-L1993","documentation":"Thrown by validate_interface (src/system/firewall.rs) for the interface field of a [bootstrap.linux.firewall] rule. The value must be non-empty, at most 15 bytes, and use only ASCII letters, digits, '-', '_', '.', ':'. 15 bytes is the Linux kernel IFNAMSIZ-1 limit for interface names; anything longer or with other characters would be rejected or mangled by iptables/nftables, so mise fails at config parse time.","triggerScenarios":"Setting interface = \"Management VLAN\" (space), interface = \"eth0;rm -rf\" (shell metachar), a 16+ byte name such as \"br-mgmt-cluster0\", or an empty string. Fires while parsing firewall rules during mise bootstrap.","commonSituations":"Long bridge/VLAN/tunnel names copied from systemd-networkd or NetworkManager setups; Windows-style adapter names (\"Ethernet 2\") pasted into Linux config; trailing whitespace introduced by templating.","solutions":["Shorten the interface name to at most 15 characters (kernel IFNAMSIZ limit)","Strip spaces and any character outside alnum, '-', '_', '.', ':'","Verify the interface exists with `ip link show <iface>` before re-running bootstrap"],"exampleFix":"# before\ninterface = \"br-mgmt-cluster0\"  # 16 chars, over IFNAMSIZ-1\n\n# after\ninterface = \"br-mgmt\"","handlingStrategy":"validation","validationCode":"iface=\"br-mgmt\"\n[ ${#iface} -le 15 ] && echo \"$iface\" | grep -qE '^[A-Za-z0-9_.:-]+$' && echo ok || echo \"invalid interface name\"\n# also confirm it exists: ip link show \"$iface\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep interface names at or under 15 characters (kernel IFNAMSIZ limit) from the start","Verify names against `ip link` output before committing firewall config","Avoid Windows-style adapter labels and spaces in Linux interface fields"],"tags":["mise","firewall","linux","network-interface","config-validation"],"backgroundTag":"invalid-interface-name","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}