Compare commits

...

3 Commits

Author SHA1 Message Date
Marek Marczykowski-Górecki
e3db225aab
vif-route-qubes: \n -> \\n
Make shellcheck happy.
2018-10-15 06:20:32 +02:00
Marek Marczykowski-Górecki
336754426b
Fix iptables-restore race condition in vif-route-qubes
In rare cases when vif-route-qubes is called simultaneously with some
other iptables-restore instance, it fails because of missing --wait (and
recent iptables-restore defaults to aborting instead of waiting
for lock). That other call may be from qubes-firewall or user script.

Related to QubesOS/qubes-issues#3665
2018-10-15 06:20:25 +02:00
Marek Marczykowski-Górecki
5ff462004a
debian: don't create orig.tar.gz manually
Rely on builder-debian doing it. This way it will be reproducible.

QubesOS/qubes-issues#2775
2018-10-13 03:33:18 +02:00
2 changed files with 10 additions and 6 deletions

View File

@ -16,6 +16,5 @@ source-debian-quilt-copy-in:
sed -i /initscripts/d $(CHROOT_DIR)/$(DIST_SRC)/debian/control ;\
fi
-$(shell $(ORIG_SRC)/debian-quilt $(ORIG_SRC)/series-debian-vm.conf $(CHROOT_DIR)/$(DIST_SRC)/debian/patches)
tar cfz $(ORIG_FILE) --exclude-vcs --exclude=rpm --exclude=pkgs --exclude=deb --exclude=debian -C $(CHROOT_DIR)/$(DIST_SRC) .
# vim: filetype=make

View File

@ -25,7 +25,12 @@ dir=$(dirname "$0")
. "$dir/vif-common.sh"
#main_ip=$(dom0_ip)
lockfile=/var/run/xen-hotplug/vif-lock
ipt_arg=
if "iptables-restore" --help 2>&1 | grep -q wait=; then
# 'wait' must be last on command line if secs not specified
ipt_arg=--wait
fi
# shellcheck disable=SC2154
if [ "${ip}" ]; then
@ -100,13 +105,13 @@ if [ "${ip}" ] ; then
else
ipt=iptables-restore
fi
echo -e "*raw\n$iptables_cmd -i ${vif} ! -s ${addr} -j DROP\nCOMMIT" | \
${cmdprefix} flock $lockfile $ipt --noflush
echo -e "*raw\\n$iptables_cmd -i ${vif} ! -s ${addr} -j DROP\\nCOMMIT" | \
${cmdprefix} $ipt --noflush $ipt_arg
done
# if no IPv6 is assigned, block all IPv6 traffic on that interface
if ! [[ "$ip" = *:* ]]; then
echo -e "*raw\n$iptables_cmd -i ${vif} -j DROP\nCOMMIT" | \
${cmdprefix} flock $lockfile ip6tables-restore --noflush
echo -e "*raw\\n$iptables_cmd -i ${vif} -j DROP\\nCOMMIT" | \
${cmdprefix} ip6tables-restore --noflush $ipt_arg
fi
${cmdprefix} ip addr "${ipcmd}" "${back_ip}/32" dev "${vif}"
if [ "${back_ip6}" ] && [[ "${back_ip6}" != "fe80:"* ]]; then