firewall: protect iptables invocations with locks in interface ops, it might run...

SVN-Revision: 23090

diff --git a/package/firewall/Makefile b/package/firewall/Makefile
index 93e41bf58f1d54f0c972d16b9c09f4ff5af154b5..511fbe9aeb63ca3a7709d03f6ccf034d1b057e2f 100644 (file)
--- a/package/firewall/Makefile
+++ b/package/firewall/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=firewall
 
 PKG_VERSION:=2
-PKG_RELEASE:=16
+PKG_RELEASE:=17
 
 include $(INCLUDE_DIR)/package.mk
 

diff --git a/package/firewall/files/lib/core_interface.sh b/package/firewall/files/lib/core_interface.sh
index 1a33cde1ec3662417412aac8d31f9c2b212b1345..f08975952cd7f3931bece4b9ed1f9167263730a4 100644 (file)
--- a/package/firewall/files/lib/core_interface.sh
+++ b/package/firewall/files/lib/core_interface.sh
@@ -72,6 +72,8 @@ fw_configure_interface() {
                        */*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;;
                esac
 
+               lock /var/run/firewall-interface.lock
+
                fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -o "$ifname" $onet }
                fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -i "$ifname" $inet }
                fw $action $mode f ${chain}_DROP   DROP   $ { -o "$ifname" $onet }
@@ -86,6 +88,8 @@ fw_configure_interface() {
                fw $action $mode n PREROUTING ${chain}_prerouting $ { -i "$ifname" $inet }
                fw $action $mode r PREROUTING ${chain}_notrack    $ { -i "$ifname" $inet }
                fw $action $mode n POSTROUTING ${chain}_nat       $ { -o "$ifname" $onet }
+
+               lock -u /var/run/firewall-interface.lock
        }
 
        local old_zones old_ifname old_subnets