From b07620df310e20f2031eb95f4185884eae826d0d Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Sun, 19 Sep 2010 15:01:47 +0000 Subject: firewall: protect iptables invocations with locks in interface ops, it might run concurrently due to hotplug invocations on network restart SVN-Revision: 23090 --- package/firewall/files/lib/core_interface.sh | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'package/firewall/files') diff --git a/package/firewall/files/lib/core_interface.sh b/package/firewall/files/lib/core_interface.sh index 1a33cde..f089759 100644 --- a/package/firewall/files/lib/core_interface.sh +++ b/package/firewall/files/lib/core_interface.sh @@ -72,6 +72,8 @@ fw_configure_interface() { */*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;; esac + lock /var/run/firewall-interface.lock + fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -o "$ifname" $onet } fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -i "$ifname" $inet } fw $action $mode f ${chain}_DROP DROP $ { -o "$ifname" $onet } @@ -86,6 +88,8 @@ fw_configure_interface() { fw $action $mode n PREROUTING ${chain}_prerouting $ { -i "$ifname" $inet } fw $action $mode r PREROUTING ${chain}_notrack $ { -i "$ifname" $inet } fw $action $mode n POSTROUTING ${chain}_nat $ { -o "$ifname" $onet } + + lock -u /var/run/firewall-interface.lock } local old_zones old_ifname old_subnets -- cgit v1.1