summaryrefslogtreecommitdiffstats
path: root/package/firewall
diff options
context:
space:
mode:
authorjow <jow@3c298f89-4303-0410-b956-a3cf2f4a3e73>2010-09-19 15:01:47 +0000
committerjow <jow@3c298f89-4303-0410-b956-a3cf2f4a3e73>2010-09-19 15:01:47 +0000
commit3d98699ef3197971484bd990d15e8b9eb0c506ce (patch)
tree22a93362a15d5d5d1c35364c493be13bd1739219 /package/firewall
parent9bfe6969387b0dff86c55291bb524af5c4e8a0d4 (diff)
[package] firewall: protect iptables invocations with locks in interface ops, it might run concurrently due to hotplug invocations on network restart
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23090 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package/firewall')
-rw-r--r--package/firewall/Makefile2
-rw-r--r--package/firewall/files/lib/core_interface.sh4
2 files changed, 5 insertions, 1 deletions
diff --git a/package/firewall/Makefile b/package/firewall/Makefile
index 93e41bf58..511fbe9ae 100644
--- a/package/firewall/Makefile
+++ b/package/firewall/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=firewall
PKG_VERSION:=2
-PKG_RELEASE:=16
+PKG_RELEASE:=17
include $(INCLUDE_DIR)/package.mk
diff --git a/package/firewall/files/lib/core_interface.sh b/package/firewall/files/lib/core_interface.sh
index 1a33cde1e..f08975952 100644
--- a/package/firewall/files/lib/core_interface.sh
+++ b/package/firewall/files/lib/core_interface.sh
@@ -72,6 +72,8 @@ fw_configure_interface() {
*/*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;;
esac
+ lock /var/run/firewall-interface.lock
+
fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -o "$ifname" $onet }
fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -i "$ifname" $inet }
fw $action $mode f ${chain}_DROP DROP $ { -o "$ifname" $onet }
@@ -86,6 +88,8 @@ fw_configure_interface() {
fw $action $mode n PREROUTING ${chain}_prerouting $ { -i "$ifname" $inet }
fw $action $mode r PREROUTING ${chain}_notrack $ { -i "$ifname" $inet }
fw $action $mode n POSTROUTING ${chain}_nat $ { -o "$ifname" $onet }
+
+ lock -u /var/run/firewall-interface.lock
}
local old_zones old_ifname old_subnets