jdx/mise · error

firewall interface '{interface}' is invalid

Error message

firewall interface '{interface}' is invalid

What it means

Thrown by validate_interface (src/system/firewall.rs) for the interface field of a [bootstrap.linux.firewall] rule. The value must be non-empty, at most 15 bytes, and use only ASCII letters, digits, '-', '_', '.', ':'. 15 bytes is the Linux kernel IFNAMSIZ-1 limit for interface names; anything longer or with other characters would be rejected or mangled by iptables/nftables, so mise fails at config parse time.

Source

Thrown at src/system/firewall.rs:1975

    if name.is_empty()
        || name.len() > 64
        || !name
            .bytes()
            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
    {
        bail!("firewall rule name '{name}' must contain only ASCII letters, numbers, '-' or '_'");
    }
    Ok(())
}

fn validate_interface(interface: &str) -> Result<String> {
    if interface.is_empty()
        || interface.len() > 15
        || !interface
            .bytes()
            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b':'))
    {
        bail!("firewall interface '{interface}' is invalid");
    }
    Ok(interface.to_string())
}

fn parse_ssh_connection(value: &str) -> Result<SshConnection> {
    let fields = value.split_ascii_whitespace().collect::<Vec<_>>();
    if fields.len() != 4 {
        bail!("SSH_CONNECTION must contain client address/port and server address/port");
    }
    Ok(SshConnection {
        peer: fields[0].parse()?,
        server: fields[2].parse()?,
        server_port: fields[3].parse()?,
    })
}

/// Detect an sshd ancestor when SSH_CONNECTION was stripped by sudo, env -i,
/// or a wrapper. `None` fails closed because ancestry could not be inspected.

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

1. Shorten the interface name to at most 15 characters (kernel IFNAMSIZ limit)
2. Strip spaces and any character outside alnum, '-', '_', '.', ':'
3. Verify the interface exists with `ip link show <iface>` before re-running bootstrap

Example fix

# before
interface = "br-mgmt-cluster0"  # 16 chars, over IFNAMSIZ-1

# after
interface = "br-mgmt"

iface="br-mgmt"
[ ${#iface} -le 15 ] && echo "$iface" | grep -qE '^[A-Za-z0-9_.:-]+$' && echo ok || echo "invalid interface name"
# also confirm it exists: ip link show "$iface"

When it happens

Trigger: Setting interface = "Management VLAN" (space), interface = "eth0;rm -rf" (shell metachar), a 16+ byte name such as "br-mgmt-cluster0", or an empty string. Fires while parsing firewall rules during mise bootstrap.

Common situations: Long bridge/VLAN/tunnel names copied from systemd-networkd or NetworkManager setups; Windows-style adapter names ("Ethernet 2") pasted into Linux config; trailing whitespace introduced by templating.

Related errors

• firewall rule name '{name}' must contain only ASCII letters,
• refusing unsafe firewall change; inspect `mise bootstrap fir
• no supported firewall backend found (tried nft, firewall-cmd
• bootstrap firewall management is only supported on Linux
• cli feature is not enabled

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/f007a20f57df3869. Report an issue: GitHub.