diff options
| author | Jo-Philipp Wich <jow@openwrt.org> | 2010-09-19 15:01:47 +0000 |
|---|---|---|
| committer | Jo-Philipp Wich <jow@openwrt.org> | 2010-09-19 15:01:47 +0000 |
| commit | 45585b87773b056d67c27b3df182038bf4b149ca (patch) | |
| tree | 22a93362a15d5d5d1c35364c493be13bd1739219 /package/firewall/files | |
| parent | 0bff63b005cebd539d109faf3ebc1ea065597cf3 (diff) | |
| download | upstream-45585b87773b056d67c27b3df182038bf4b149ca.tar.gz upstream-45585b87773b056d67c27b3df182038bf4b149ca.tar.bz2 upstream-45585b87773b056d67c27b3df182038bf4b149ca.zip | |
[package] firewall: protect iptables invocations with locks in interface ops, it might run concurrently due to hotplug invocations on network restart
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23090 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package/firewall/files')
| -rw-r--r-- | package/firewall/files/lib/core_interface.sh | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/package/firewall/files/lib/core_interface.sh b/package/firewall/files/lib/core_interface.sh index 1a33cde1ec..f08975952c 100644 --- a/package/firewall/files/lib/core_interface.sh +++ b/package/firewall/files/lib/core_interface.sh @@ -72,6 +72,8 @@ fw_configure_interface() { */*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;; esac + lock /var/run/firewall-interface.lock + fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -o "$ifname" $onet } fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -i "$ifname" $inet } fw $action $mode f ${chain}_DROP DROP $ { -o "$ifname" $onet } @@ -86,6 +88,8 @@ fw_configure_interface() { fw $action $mode n PREROUTING ${chain}_prerouting $ { -i "$ifname" $inet } fw $action $mode r PREROUTING ${chain}_notrack $ { -i "$ifname" $inet } fw $action $mode n POSTROUTING ${chain}_nat $ { -o "$ifname" $onet } + + lock -u /var/run/firewall-interface.lock } local old_zones old_ifname old_subnets |