Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #160493

Re: How do packages that modify iptables rules prevent race conditions?

Show all headers | View raw

Patrick Schleizer a écrit :
> 
> as I just learned on the mailing list, that at least the packages
> fail2ban and miniupnpd [and most likely arno-iptables-firewall also]
> modify iptables rules...

Firewall managers such as ufw, shorewall, firestarter...
Custom iptables scripts.
IDS such as portsentry.
"Port knocking" daemons such as knockd.

> Is there a chance for race conditions?

Plenty.

> I.e. two packages trying to add
> iptables rules at the same time and thereby failing to do so?

Yes, or mixing up their rules resulting in unpredictable results.

> What is the proper mechanism to add iptables rules [for packages] to
> avoid such race conditions?
> 
> Is using 'iptables --wait' sufficient or something else?

No it's not. You must also make sure that the rules created by each
program don't disrupt the rules created by the others.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Are there packages that modify iptables rules? Patrick Schleizer <patrick-mailinglists@whonix.org> - 2015-11-12 14:50 +0100
  Re: Are there packages that modify iptables rules? Sven Hartge <sven@svenhartge.de> - 2015-11-12 15:00 +0100
    How do packages that modify iptables rules prevent race conditions? Patrick Schleizer <patrick-mailinglists@whonix.org> - 2015-11-12 15:20 +0100
      Re: How do packages that modify iptables rules prevent race conditions? John Hasler <jhasler@newsguy.com> - 2015-11-12 17:30 +0100
      Re: How do packages that modify iptables rules prevent race conditions? Sven Hartge <sven@svenhartge.de> - 2015-11-12 19:40 +0100
      Re: How do packages that modify iptables rules prevent race conditions? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2015-11-12 20:50 +0100
        Re: How do packages that modify iptables rules prevent race  conditions? Erwan David <erwan@rail.eu.org> - 2015-11-12 21:20 +0100
        Re: How do packages that modify iptables rules prevent race conditions? John Hasler <jhasler@newsguy.com> - 2015-11-12 22:50 +0100

csiph-web