<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - iptables-restore may double-lock when using --table"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1271">1271</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>iptables-restore may double-lock when using --table
</td>
</tr>
<tr>
<th>Product</th>
<td>iptables
</td>
</tr>
<tr>
<th>Version</th>
<td>1.6.x
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>Fedora
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>minor
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>iptables-restore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>netfilter-buglog@lists.netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>contact+netfilter@jgoguen.ca
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=541" name="attach_541" title="Path to free the lock when skipping a table">attachment 541</a> <a href="attachment.cgi?id=541&action=edit" title="Path to free the lock when skipping a table">[details]</a></span>
Path to free the lock when skipping a table
Currently, when running `iptables-restore --table=X`, where `X` is not the
first
table in the rules dump, the restore will fail when parsing the second table:
- a lock is acquird when parsing the first table name
- the table name does not match the parameter to `--table` so processing
continues until the next table
- when processing the next table a lock is acquired, which fails because a lock
is already held
This will release the lock as soon as it's decided the current table won't be
used.
With existing code:
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
# iptables-restore <iptables.dump
Another app is currently holding the xtables lock. Perhaps you want to use
the -w option?
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
With the change from the attached patch:
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
# iptables-restore <iptables.dump
# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state
RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- anywhere anywhere tcp
dpt:netbios-ns reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp
dpt:netbios-ns reject-with icmp-port-unreachable
And the test suite:
# ./iptables/tests/shell/run-tests.sh
I: [OK] ././iptables/tests/shell/testcases/chain/0001duplicate_1
I: [OK] ././iptables/tests/shell/testcases/chain/0002newchain_0
I: [OK] ././iptables/tests/shell/testcases/chain/0003rename_1
I: [OK] ././iptables/tests/shell/testcases/ebtables/0001-ebtables-
basic_0
I: [OK] ././iptables/tests/shell/testcases/firewalld-restore/0001-
firewalld_0
I: [OK] ././iptables/tests/shell/testcases/firewalld-restore/0002-
firewalld-restart_0
I: [OK] ././iptables/tests/shell/testcases/ipt-restore/0001load-
specific-table_0
I: [OK] ././iptables/tests/shell/testcases/ipt-save/0001load-
dumps_0
I: [OK] ././iptables/tests/shell/testcases/ipt-save/0002load-
fedora27-firewalld_0
I: legacy results: [OK] 9 [FAILED] 0 [TOTAL] 9
I: [OK] ././iptables/tests/shell/testcases/chain/0001duplicate_1
I: [OK] ././iptables/tests/shell/testcases/chain/0002newchain_0
I: [OK] ././iptables/tests/shell/testcases/chain/0003rename_1
I: [OK] ././iptables/tests/shell/testcases/ebtables/0001-ebtables-
basic_0
I: [OK] ././iptables/tests/shell/testcases/firewalld-restore/0001-
firewalld_0
I: [OK] ././iptables/tests/shell/testcases/firewalld-restore/0002-
firewalld-restart_0
I: [OK] ././iptables/tests/shell/testcases/ipt-restore/0001load-
specific-table_0
I: [OK] ././iptables/tests/shell/testcases/ipt-save/0001load-
dumps_0
I: [OK] ././iptables/tests/shell/testcases/ipt-save/0002load-
fedora27-firewalld_0
I: nft results: [OK] 9 [FAILED] 0 [TOTAL] 9
I: combined results: [OK] 18 [FAILED] 0 [TOTAL] 18</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>