From 1926c173b50ca7c5382622005ef9dc6f66ffd41402c8de66ad5602c63b7da318 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 29 Jun 2017 11:37:40 +0000 Subject: [PATCH 1/3] Accepting request 506228 from home:mgerstner:branches:security:netfilter - fix a locking issue of iptables-batch which can cause it to spuriously fail when other programs modify the iptables rules in parallel (bnc#1045130). This can especially affect SuSEfirewall2 during startup. OBS-URL: https://build.opensuse.org/request/show/506228 OBS-URL: https://build.opensuse.org/package/show/security:netfilter/iptables?expand=0&rev=93 --- iptables-batch-lock.patch | 70 +++++++++++++++++++++++++++++++++++++++ iptables.changes | 7 ++++ iptables.spec | 3 +- 3 files changed, 79 insertions(+), 1 deletion(-) create mode 100644 iptables-batch-lock.patch diff --git a/iptables-batch-lock.patch b/iptables-batch-lock.patch new file mode 100644 index 0000000..f99ade5 --- /dev/null +++ b/iptables-batch-lock.patch @@ -0,0 +1,70 @@ +Index: iptables-1.6.1/iptables/iptables-batch.c +=================================================================== +--- iptables-1.6.1.orig/iptables/iptables-batch.c ++++ iptables-1.6.1/iptables/iptables-batch.c +@@ -404,6 +404,34 @@ main(int argc, char *argv[]) + tables[3].handle = NULL; + current_table = &tables[0]; + ++ /* ++ * we need to lock the complete batch processing against parallel ++ * modification by other processes. Otherwise we can end up with ++ * EAGAIN errors. ++ * ++ * the do_command{4,6} function already locks itself, but the ++ * complete call sequence needs to be locked until the commit is ++ * performed. ++ * ++ * sadly the xtables_lock() implementation is not very cooperative. ++ * There's no unlock() equivalent. The lock file descriptor is smiply ++ * left open until the process exits. Thus we'd have deadlocks when ++ * calling do_command{4,6} the second time. ++ * ++ * To prevent this, part of this patch adds logic to avoid taking the ++ * lock a second time in the same process in xtables_lock() ++ */ ++ ++ const struct timeval wait_interval = { ++ .tv_sec = 1, ++ }; ++ ++ if( xtables_lock(-1, &wait_interval) != true ) ++ { ++ fprintf(stderr, "failed to acquire the xtables lock\n"); ++ exit(1); ++ } ++ + while((r = getline(&iline, &llen, fp)) != -1) + { + if(llen < 1 || !*iline) +Index: iptables-1.6.1/iptables/xshared.c +=================================================================== +--- iptables-1.6.1.orig/iptables/xshared.c ++++ iptables-1.6.1/iptables/xshared.c +@@ -250,8 +250,14 @@ void xs_init_match(struct xtables_match + bool xtables_lock(int wait, struct timeval *wait_interval) + { + struct timeval time_left, wait_time, waited_time; ++ static bool already_locked = false; + int fd, i = 0; + ++ if( already_locked ) { ++ // avoid dead-locks, see iptables-batch.c ++ return true; ++ } ++ + time_left.tv_sec = wait; + time_left.tv_usec = 0; + waited_time.tv_sec = 0; +@@ -262,8 +268,10 @@ bool xtables_lock(int wait, struct timev + return true; + + while (1) { +- if (flock(fd, LOCK_EX | LOCK_NB) == 0) ++ if (flock(fd, LOCK_EX | LOCK_NB) == 0) { ++ already_locked = true; + return true; ++ } + if (++i % 10 == 0) { + if (wait != -1) + fprintf(stderr, "Another app is currently holding the xtables lock; " diff --git a/iptables.changes b/iptables.changes index 9ea32a1..410856d 100644 --- a/iptables.changes +++ b/iptables.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Thu Jun 22 15:34:40 UTC 2017 - matthias.gerstner@suse.com + +- fix a locking issue of iptables-batch which can cause it to spuriously fail + when other programs modify the iptables rules in parallel (bnc#1045130). + This can especially affect SuSEfirewall2 during startup. + ------------------------------------------------------------------- Fri Jan 27 22:53:14 UTC 2017 - jengelh@inai.de diff --git a/iptables.spec b/iptables.spec index 106955b..24c9158 100644 --- a/iptables.spec +++ b/iptables.spec @@ -28,6 +28,7 @@ Source2: http://netfilter.org/projects/iptables/files/%name-%version.tar. Source3: %name.keyring Patch3: iptables-batch.patch Patch4: iptables-apply-mktemp-fix.patch +Patch5: iptables-batch-lock.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build %if 0%{?fedora_version} || 0%{?centos_version} @@ -141,7 +142,7 @@ xtables --variable=xtlibdir). %prep %setup -q -%patch -P 3 -P 4 -p1 +%patch -P 3 -P 4 -P 5 -p1 %build # We have the iptables-batch patch, so always regenerate. From 9ebef7d7fe477a78bb603a7b68882968629ba9dfe84fbc2dd59d7d43ab70b7b7 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Sat, 3 Feb 2018 14:28:48 +0000 Subject: [PATCH 2/3] iptables-1.6.2 OBS-URL: https://build.opensuse.org/package/show/security:netfilter/iptables?expand=0&rev=94 --- iptables-1.6.1.tar.bz2 | 3 -- iptables-1.6.1.tar.bz2.sig | Bin 543 -> 0 bytes iptables-1.6.2.tar.bz2 | 3 ++ iptables-1.6.2.tar.bz2.sig | Bin 0 -> 543 bytes iptables-batch-lock.patch | 83 ++++++++++++++++++------------------- iptables.changes | 8 ++++ iptables.spec | 22 +++++----- 7 files changed, 63 insertions(+), 56 deletions(-) delete mode 100644 iptables-1.6.1.tar.bz2 delete mode 100644 iptables-1.6.1.tar.bz2.sig create mode 100644 iptables-1.6.2.tar.bz2 create mode 100644 iptables-1.6.2.tar.bz2.sig diff --git a/iptables-1.6.1.tar.bz2 b/iptables-1.6.1.tar.bz2 deleted file mode 100644 index 7a5ad4c..0000000 --- a/iptables-1.6.1.tar.bz2 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:0fc2d7bd5d7be11311726466789d4c65fb4c8e096c9182b56ce97440864f0cf5 -size 620890 diff --git a/iptables-1.6.1.tar.bz2.sig b/iptables-1.6.1.tar.bz2.sig deleted file mode 100644 index 4fd55987854a64d8189415748a175b224e7706d2d2854d3fc7988356501ef5da..0000000000000000000000000000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 543 zcmV+)0^t3L0vrSY0RjL91p-)$tNZ{82@tDBRiP%*lH_&g5C2+Hc$X`!TtL;aN)nge z{92#H)+ih~r~n}=93U}vTW-OtTZ7bZDvc23R_8A4y zP8MM#OY^k<65xF`;GI15x-GT4h|bk@;Q^y6*Gz}@2Z?zz$|v_}h%OGP(9e%_iZHG> z_cgIEHiBSmA$tx(FwV$=EVPMn)m5Tu3C*(Q-gj7A9~{Qfey>K+Q7iPqc>##o>a3bG z$*omukWkNN^S6sgj-FgZf&JDR`kE4`3AmS4H;8~(Gh#ZM-Xe|@!(T!}mDEUj0mO!pZ* zPs3oTL4FH_G5AngWdE#kjRPIs!_*hRgH%9eJ3AGggWRt3d?4|pN!nVqBXa6Ys4xZ% zdxj7ltC*DC(L(>t679|gHC)c|rt*N>wz=Jg zPf~^>v_T?y*yh{P>9x8MS7s`f(3p+ik*6mG`7 zW%A7)fbfqqL&1c1eUd*1?zOFuL2e$e0F**c?*yiXJ-p=akdI)L$j1&onBStnd-7y zN?m$HLu4$BQSR~8EA2YW+cujj4)-Q~-JU*V>^RGfHur6Hd;ev2Dr6Wft~mKERpv>WPbC1yGMz}P^jXIUYJ zIGJtF^G@TKsIIDXYYTy~Lai`8rId)fOOo9uQ?}etfJo!!P4o60J}dZ^FdR7m|FYXN zZ7u?$dUBLA0R+U+?i!!28`b)0TP@xok^*>)tC1G2kWsCcuDl3GNsI? h!@D_Im^GH&bVaDFcV0Pzjzz%P0+`~8ctE7ze1?tG4R` Date: Sat, 3 Feb 2018 15:01:47 +0000 Subject: [PATCH 3/3] OBS-URL: https://build.opensuse.org/package/show/security:netfilter/iptables?expand=0&rev=95 --- iptables-batch-lock.patch | 7 +++++++ iptables.changes | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/iptables-batch-lock.patch b/iptables-batch-lock.patch index 588c667..4f3b0c7 100644 --- a/iptables-batch-lock.patch +++ b/iptables-batch-lock.patch @@ -1,3 +1,10 @@ +From: Matthias Gerstner +Date: 2017-06-26T10:53:24+0000 + +- fix a locking issue of iptables-batch which can cause it to spuriously fail + when other programs modify the iptables rules in parallel (bnc#1045130). + This can especially affect SuSEfirewall2 during startup. + --- iptables/iptables-batch.c | 21 +++++++++++++++++++++ iptables/xshared.c | 8 +++++++- diff --git a/iptables.changes b/iptables.changes index 015c83b..4db318c 100644 --- a/iptables.changes +++ b/iptables.changes @@ -9,8 +9,9 @@ Sat Feb 3 14:02:59 UTC 2018 - jengelh@inai.de ------------------------------------------------------------------- Thu Jun 22 15:34:40 UTC 2017 - matthias.gerstner@suse.com -- fix a locking issue of iptables-batch which can cause it to spuriously fail - when other programs modify the iptables rules in parallel (bnc#1045130). +- Add iptables-batch-lock.patch: Fix a locking issue of + iptables-batch which can cause it to spuriously fail when other + programs modify the iptables rules in parallel (bnc#1045130). This can especially affect SuSEfirewall2 during startup. -------------------------------------------------------------------