path: root/iptables/iptables.c
diff options
authorLorenzo Colitti <>2017-05-19 16:08:59 +0900
committerPablo Neira Ayuso <>2017-05-29 13:42:20 +0200
commit80d8bfaac9e2430d710084a10ec78e68bd61e6ec (patch)
treecc15d1b7b3a68774db0335003a1f639d2e72fcae /iptables/iptables.c
parentc29d99c83d95ca063fd378bd0b7f798eb66163fb (diff)
iptables: insist that the lock is held.
Currently, iptables programs will exit with an error if the iptables lock cannot be acquired, but will silently continue if the lock cannot be opened at all. This can cause unexpected failures (with unhelpful error messages) in the presence of concurrent updates, which can be very difficult to find in a complex or multi-administrator system. Instead, refuse to do anything if the lock cannot be acquired. The behaviour is not affected by command-line flags because: 1. In order to reliably avoid concurrent modification, all invocations of iptables commands must follow this behaviour. 2. Whether or not the lock can be opened is typically not a run-time condition but is likely to be a configuration error. Existing systems that depended on things working mostly correctly even if there was no lock might be affected by this change. However, that is arguably a configuration error, and now that the iptables lock is configurable, it is trivial to provide a lock file that is always accessible: if nothing else, the iptables binary itself can be used. The lock does not have to be writable, only readable. Tested by configuring the system to use an xtables.lock file in a non-existent directory and observing that all commands failed. Signed-off-by: Lorenzo Colitti <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'iptables/iptables.c')
1 files changed, 2 insertions, 9 deletions
diff --git a/iptables/iptables.c b/iptables/iptables.c
index 97cbda91..69d19fec 100644
--- a/iptables/iptables.c
+++ b/iptables/iptables.c
@@ -1765,15 +1765,8 @@ int do_command4(int argc, char *argv[], char **table,
generic_opt_check(command, cs.options);
/* Attempt to acquire the xtables lock */
- if (!restore && xtables_lock(wait, &wait_interval) == XT_LOCK_BUSY) {
- fprintf(stderr, "Another app is currently holding the xtables lock. ");
- if (wait == 0)
- fprintf(stderr, "Perhaps you want to use the -w option?\n");
- else
- fprintf(stderr, "Stopped waiting after %ds.\n", wait);
- xtables_free_opts(1);
- }
+ if (!restore)
+ xtables_lock_or_exit(wait, &wait_interval);
/* only allocate handle if we weren't called with a handle */
if (!*handle)