summaryrefslogtreecommitdiff
path: root/package/firewall/files
diff options
context:
space:
mode:
authorJo-Philipp Wich <jow@openwrt.org>2010-09-19 15:01:47 +0000
committerJo-Philipp Wich <jow@openwrt.org>2010-09-19 15:01:47 +0000
commitb07620df310e20f2031eb95f4185884eae826d0d (patch)
tree46abd6b296ca227a378390d772a881b808f5792c /package/firewall/files
parenta5d0879de78fb3568344c4ea190cb70e3233587e (diff)
downloadmtk-20170518-b07620df310e20f2031eb95f4185884eae826d0d.zip
mtk-20170518-b07620df310e20f2031eb95f4185884eae826d0d.tar.gz
mtk-20170518-b07620df310e20f2031eb95f4185884eae826d0d.tar.bz2
firewall: protect iptables invocations with locks in interface ops, it might run concurrently due to hotplug invocations on network restart
SVN-Revision: 23090
Diffstat (limited to 'package/firewall/files')
-rw-r--r--package/firewall/files/lib/core_interface.sh4
1 files changed, 4 insertions, 0 deletions
diff --git a/package/firewall/files/lib/core_interface.sh b/package/firewall/files/lib/core_interface.sh
index 1a33cde..f089759 100644
--- a/package/firewall/files/lib/core_interface.sh
+++ b/package/firewall/files/lib/core_interface.sh
@@ -72,6 +72,8 @@ fw_configure_interface() {
*/*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;;
esac
+ lock /var/run/firewall-interface.lock
+
fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -o "$ifname" $onet }
fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -i "$ifname" $inet }
fw $action $mode f ${chain}_DROP DROP $ { -o "$ifname" $onet }
@@ -86,6 +88,8 @@ fw_configure_interface() {
fw $action $mode n PREROUTING ${chain}_prerouting $ { -i "$ifname" $inet }
fw $action $mode r PREROUTING ${chain}_notrack $ { -i "$ifname" $inet }
fw $action $mode n POSTROUTING ${chain}_nat $ { -o "$ifname" $onet }
+
+ lock -u /var/run/firewall-interface.lock
}
local old_zones old_ifname old_subnets