suzanne.soy/qubes-core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qubes-firewall: use iptables-restore --wait if supported

Browse Source 
Fixes QubesOS/qubes-issues#4250
Related to fix QubesOS/qubes-issues#3939
This commit is contained in:
Marek Marczykowski-Górecki 2018-10-15 06:22:52 +02:00
parent a121c1f681
commit 6e038dd72d
No known key found for this signature in database
GPG Key ID: 063938BA42CFA724
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
network/qubes-firewall
View File

@ -12,6 +12,12 @@ echo $$ >$PIDFILE
trap 'exit 0' TERM
IPT_ARGS=
if "iptables-restore" --help 2>&1 | grep -q wait=; then
# 'wait' must be last on command line if secs not specified
IPT_ARGS=--wait
fi
FIRST_TIME=yes
while true; do
@ -36,11 +42,11 @@ while true; do
RULES=$(qubesdb-read $XENSTORE_IPTABLES_HEADER)
IPTABLES_SAVE=$(iptables-save | sed '/^\*filter/,/^COMMIT/d')
OUT=$(printf '%s\n%s\n' "$RULES" "$IPTABLES_SAVE" | sed 's/\\n\|\\x0a/\n/g' | iptables-restore 2>&1 || true)
OUT=$(printf '%s\n%s\n' "$RULES" "$IPTABLES_SAVE" | sed 's/\\n\|\\x0a/\n/g' | iptables-restore $IPT_ARGS 2>&1 || true)
for i in $(qubesdb-list -f /qubes-iptables-domainrules) ; do
RULES=$(qubesdb-read "$i")
ERRS=$(printf '%s\n' "$RULES" | sed 's/\\n\|\\x0a/\n/g' | /sbin/iptables-restore -n 2>&1 || true)
ERRS=$(printf '%s\n' "$RULES" | sed 's/\\n\|\\x0a/\n/g' | /sbin/iptables-restore -n $IPT_ARGS 2>&1 || true)
if [ -n "$ERRS" ]; then
echo "Failed applying rules for $i: $ERRS" >&2
OUT="$OUT$ERRS"