ip{6}tables-restore: fix breakage due to new locking approach

Since (93587a0 ip[6]tables: Add locking to prevent concurrent instances),
ip{6}tables-restore does not work anymore:

iptables-restore < x
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

do_command{6}(...) is called from ip{6}tables-restore for every iptables
command contained in the rule-set file. Thus, hitting the lock error
after the second command.

Fix it by bypassing the locking in the ip{6}tables-restore path.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/ip6tables.h b/include/ip6tables.h
index 37d2e0a30887b3a4b543ec228746293d81c86e9f..5f1c5b65e8c404221bee220123a6ff24d1b79d34 100644 (file)
--- a/include/ip6tables.h
+++ b/include/ip6tables.h
@@ -8,7 +8,7 @@
 
 /* Your shared library should call one of these. */
 extern int do_command6(int argc, char *argv[], char **table,
-                      struct xtc_handle **handle);
+                      struct xtc_handle **handle, bool restore);
 
 extern int for_each_chain6(int (*fn)(const xt_chainlabel, int, struct xtc_handle *), int verbose, int builtinstoo, struct xtc_handle *handle);
 extern int flush_entries6(const xt_chainlabel chain, int verbose, struct xtc_handle *handle);

diff --git a/include/iptables.h b/include/iptables.h
index c42613c956b12115f1aecceced984e2324f5d1aa..ac9dc0e556b2d9b941957b27d22949db167eb696 100644 (file)
--- a/include/iptables.h
+++ b/include/iptables.h
@@ -8,7 +8,7 @@
 
 /* Your shared library should call one of these. */
 extern int do_command4(int argc, char *argv[], char **table,
-                     struct xtc_handle **handle);
+                     struct xtc_handle **handle, bool restore);
 extern int delete_chain4(const xt_chainlabel chain, int verbose,
                        struct xtc_handle *handle);
 extern int flush_entries4(const xt_chainlabel chain, int verbose, 

diff --git a/iptables/ip6tables-restore.c b/iptables/ip6tables-restore.c
index 0e8252f4133c82e2b263ca6c693c3ce3c66a895a..b8b9e0dd0abd1d7b64dfb60414fdde91b26a13c1 100644 (file)
--- a/iptables/ip6tables-restore.c
+++ b/iptables/ip6tables-restore.c
@@ -438,7 +438,7 @@ int ip6tables_restore_main(int argc, char *argv[])
                                DEBUGP("argv[%u]: %s\n", a, newargv[a]);
 
                        ret = do_command6(newargc, newargv,
-                                        &newargv[2], &handle);
+                                        &newargv[2], &handle, true);
 
                        free_argv();
                        fflush(stdout);

diff --git a/iptables/ip6tables-standalone.c b/iptables/ip6tables-standalone.c
index 21b58116a3cf6e0539c8d29abcbf45b0ae236583..656e08d551aa2460365f8ec16412efe5b3945e5e 100644 (file)
--- a/iptables/ip6tables-standalone.c
+++ b/iptables/ip6tables-standalone.c
@@ -58,7 +58,7 @@ ip6tables_main(int argc, char *argv[])
        init_extensions6();
 #endif
 
-       ret = do_command6(argc, argv, &table, &handle);
+       ret = do_command6(argc, argv, &table, &handle, false);
        if (ret) {
                ret = ip6tc_commit(handle);
                ip6tc_free(handle);

diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
index eededee113ae3be99b7329c2e9404aa73786c759..1fb33f6d3b8b419a68e385f1256e8581586a2e79 100644 (file)
--- a/iptables/ip6tables.c
+++ b/iptables/ip6tables.c
@@ -1286,7 +1286,8 @@ static void command_match(struct iptables_command_state *cs)
                                             m->extra_opts, &m->option_offset);
 }
 
-int do_command6(int argc, char *argv[], char **table, struct xtc_handle **handle)
+int do_command6(int argc, char *argv[], char **table,
+               struct xtc_handle **handle, bool restore)
 {
        struct iptables_command_state cs;
        struct ip6t_entry *e = NULL;
@@ -1577,6 +1578,11 @@ int do_command6(int argc, char *argv[], char **table, struct xtc_handle **handle
                        break;
 
                case 'w':
+                       if (restore) {
+                               xtables_error(PARAMETER_PROBLEM,
+                                             "You cannot use `-w' from "
+                                             "ip6tables-restore");
+                       }
                        wait = true;
                        break;
 
@@ -1732,7 +1738,7 @@ int do_command6(int argc, char *argv[], char **table, struct xtc_handle **handle
                           chain, XT_EXTENSION_MAXNAMELEN);
 
        /* Attempt to acquire the xtables lock */
-       if (!xtables_lock(wait)) {
+       if (!restore && !xtables_lock(wait)) {
                fprintf(stderr, "Another app is currently holding the xtables lock. "
                        "Perhaps you want to use the -w option?\n");
                xtables_free_opts(1);

diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c
index 082251390bf43d46ab9c22960a8bcd09f3bd1e62..8c942ff618df64330b199d8729cdf240bcfbc3b3 100644 (file)
--- a/iptables/iptables-restore.c
+++ b/iptables/iptables-restore.c
@@ -438,7 +438,7 @@ iptables_restore_main(int argc, char *argv[])
                                DEBUGP("argv[%u]: %s\n", a, newargv[a]);
 
                        ret = do_command4(newargc, newargv,
-                                        &newargv[2], &handle);
+                                        &newargv[2], &handle, true);
 
                        free_argv();
                        fflush(stdout);

diff --git a/iptables/iptables-standalone.c b/iptables/iptables-standalone.c
index 683a44a5b0908a060692eb5e26cb01ce4b14cc09..4da1d7f8b28edafb49a0340a9abff05a57c8d7ba 100644 (file)
--- a/iptables/iptables-standalone.c
+++ b/iptables/iptables-standalone.c
@@ -58,7 +58,7 @@ iptables_main(int argc, char *argv[])
        init_extensions4();
 #endif
 
-       ret = do_command4(argc, argv, &table, &handle);
+       ret = do_command4(argc, argv, &table, &handle, false);
        if (ret) {
                ret = iptc_commit(handle);
                iptc_free(handle);

diff --git a/iptables/iptables.c b/iptables/iptables.c
index f857bebc9468d8eec1a675ea786caaa5308a224b..fe18e1cce58471b4e2fb197f3383c5afba0da25b 100644 (file)
--- a/iptables/iptables.c
+++ b/iptables/iptables.c
@@ -1282,7 +1282,8 @@ static void command_match(struct iptables_command_state *cs)
                xtables_error(OTHER_PROBLEM, "can't alloc memory!");
 }
 
-int do_command4(int argc, char *argv[], char **table, struct xtc_handle **handle)
+int do_command4(int argc, char *argv[], char **table,
+               struct xtc_handle **handle, bool restore)
 {
        struct iptables_command_state cs;
        struct ipt_entry *e = NULL;
@@ -1571,6 +1572,11 @@ int do_command4(int argc, char *argv[], char **table, struct xtc_handle **handle
                        break;
 
                case 'w':
+                       if (restore) {
+                               xtables_error(PARAMETER_PROBLEM,
+                                             "You cannot use `-w' from "
+                                             "iptables-restore");
+                       }
                        wait = true;
                        break;
 
@@ -1729,7 +1735,7 @@ int do_command4(int argc, char *argv[], char **table, struct xtc_handle **handle
                           chain, XT_EXTENSION_MAXNAMELEN);
 
        /* Attempt to acquire the xtables lock */
-       if (!xtables_lock(wait)) {
+       if (!restore && !xtables_lock(wait)) {
                fprintf(stderr, "Another app is currently holding the xtables lock. "
                        "Perhaps you want to use the -w option?\n");
                xtables_free_opts(1);