[gentoo-commits] repo/gentoo:master commit in: net-firewall/iptables/files/

["Mike Frysinger" <vapier@gentoo.org>]

commit:     27a2f5aa3b111e62f52fcd3f66f763293f24871b
Author:     Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 14 09:12:11 2015 +0000
Commit:     Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Fri Aug 14 09:28:26 2015 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=27a2f5aa

net-firewall/iptables: init: use -w when running iptables #501710

Newer iptables versions have an internal lock to keep multiple instances
from trampling on each other, but you have to use the -w flag.  Normally
this doesn't come up, but when you run iptables & ip6tables in parallel,
things can get a bit racy wrt state (even though they're updating diff
sets of chains).

 net-firewall/iptables/files/iptables.init | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/net-firewall/iptables/files/iptables.init b/net-firewall/iptables/files/iptables.init
index 440e840..f396ea2 100755
--- a/net-firewall/iptables/files/iptables.init
+++ b/net-firewall/iptables/files/iptables.init
@@ -35,7 +35,7 @@ set_table_policy() {
 	esac
 	local chain
 	for chain in ${chains} ; do
-		${iptables_bin} -t ${table} -P ${chain} ${policy}
+		${iptables_bin} -w -t ${table} -P ${chain} ${policy}
 	done
 }
 
@@ -73,8 +73,8 @@ stop() {
 	for a in $(cat ${iptables_proc}) ; do
 		set_table_policy $a ACCEPT
 
-		${iptables_bin} -F -t $a
-		${iptables_bin} -X -t $a
+		${iptables_bin} -w -F -t $a
+		${iptables_bin} -w -X -t $a
 	done
 	eend $?
 }
@@ -85,8 +85,8 @@ reload() {
 	ebegin "Flushing firewall"
 	local a
 	for a in $(cat ${iptables_proc}) ; do
-		${iptables_bin} -F -t $a
-		${iptables_bin} -X -t $a
+		${iptables_bin} -w -F -t $a
+		${iptables_bin} -w -X -t $a
 	done
 	eend $?
 
@@ -121,8 +121,8 @@ panic() {
 	local a
 	ebegin "Dropping all packets"
 	for a in $(cat ${iptables_proc}) ; do
-		${iptables_bin} -F -t $a
-		${iptables_bin} -X -t $a
+		${iptables_bin} -w -F -t $a
+		${iptables_bin} -w -X -t $a
 
 		set_table_policy $a DROP
 	done