Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #160492

Re: How do packages that modify iptables rules prevent race conditions?

Show all headers | View raw

Patrick Schleizer <patrick-mailinglists@whonix.org> wrote:

> as I just learned on the mailing list, that at least the packages
> fail2ban and miniupnpd [and most likely arno-iptables-firewall also]
> modify iptables rules...

> Is there a chance for race conditions? I.e. two packages trying to add
> iptables rules at the same time and thereby failing to do so?

fail2ban und miniupnpd create their own chains and a rule to jump to
that personal chain on startup. Subsequent rules are only ever added to
that personal chain. This effectivly avoids any race with different
rules inserted at different places of the ruleset.

Grüße,
Sven.

-- 
Sigmentation fault. Core dumped.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Are there packages that modify iptables rules? Patrick Schleizer <patrick-mailinglists@whonix.org> - 2015-11-12 14:50 +0100
  Re: Are there packages that modify iptables rules? Sven Hartge <sven@svenhartge.de> - 2015-11-12 15:00 +0100
    How do packages that modify iptables rules prevent race conditions? Patrick Schleizer <patrick-mailinglists@whonix.org> - 2015-11-12 15:20 +0100
      Re: How do packages that modify iptables rules prevent race conditions? John Hasler <jhasler@newsguy.com> - 2015-11-12 17:30 +0100
      Re: How do packages that modify iptables rules prevent race conditions? Sven Hartge <sven@svenhartge.de> - 2015-11-12 19:40 +0100
      Re: How do packages that modify iptables rules prevent race conditions? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2015-11-12 20:50 +0100
        Re: How do packages that modify iptables rules prevent race  conditions? Erwan David <erwan@rail.eu.org> - 2015-11-12 21:20 +0100
        Re: How do packages that modify iptables rules prevent race conditions? John Hasler <jhasler@newsguy.com> - 2015-11-12 22:50 +0100

csiph-web