qi-hardware/openwrt-xburst
1
0
Fork 0
mirror of git://projects.qi-hardware.com/openwrt-xburst.git synced 2025-01-27 16:11:06 +02:00
Code

[package] firewall: protect iptables invocations with locks in interface ops, it might run concurrently due to hotplug invocations on network restart

Browse Source 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23090 3c298f89-4303-0410-b956-a3cf2f4a3e73
This commit is contained in:
jow 2010-09-19 15:01:47 +00:00
parent 9bfe696938
commit 3d98699ef3
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
package/firewall/Makefile
View File

@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=firewall PKG_NAME:=firewall
PKG_VERSION:=2 PKG_VERSION:=2
PKG_RELEASE:=16 PKG_RELEASE:=17
include $(INCLUDE_DIR)/package.mk include $(INCLUDE_DIR)/package.mk

4
package/firewall/files/lib/core_interface.sh
View File

@ -72,6 +72,8 @@ fw_configure_interface() {
*/*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;; */*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;;
esac esac
lock /var/run/firewall-interface.lock
fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -o "$ifname" $onet } fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -o "$ifname" $onet }
fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -i "$ifname" $inet } fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -i "$ifname" $inet }
fw $action $mode f ${chain}_DROP DROP $ { -o "$ifname" $onet } fw $action $mode f ${chain}_DROP DROP $ { -o "$ifname" $onet }
@ -86,6 +88,8 @@ fw_configure_interface() {
fw $action $mode n PREROUTING ${chain}_prerouting $ { -i "$ifname" $inet } fw $action $mode n PREROUTING ${chain}_prerouting $ { -i "$ifname" $inet }
fw $action $mode r PREROUTING ${chain}_notrack $ { -i "$ifname" $inet } fw $action $mode r PREROUTING ${chain}_notrack $ { -i "$ifname" $inet }
fw $action $mode n POSTROUTING ${chain}_nat $ { -o "$ifname" $onet } fw $action $mode n POSTROUTING ${chain}_nat $ { -o "$ifname" $onet }
lock -u /var/run/firewall-interface.lock
} }
local old_zones old_ifname old_subnets local old_zones old_ifname old_subnets