Attachment 315173 Details for Bug 460410 – patch to resolve iptables contention in xen network scripts

[patch] patch to resolve iptables contention in xen network scripts

xen-iptables.patch (text/plain), 3.06 KB, created by Michael Kearey on 2008-08-28 05:40:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Michael Kearey

Created: 2008-08-28 05:40:32 UTC

Size: 3.06 KB

patch

obsolete

>diff -Naur /etc/xen/scripts.orig/network-bridge /etc/xen/scripts/network-bridge
>--- /etc/xen/scripts.orig/network-bridge	2008-05-09 21:25:57.000000000 +0530
>+++ /etc/xen/scripts/network-bridge	2008-08-17 21:52:56.000000000 +0530
>@@ -164,10 +164,10 @@
> # Set the default forwarding policy for $dev to drop.
> # Allow forwarding to the bridge.
> antispoofing () {
>-    iptables -P FORWARD DROP
>-    iptables -F FORWARD
>-    iptables -A FORWARD -m physdev --physdev-in ${pdev} -j ACCEPT
>-    iptables -A FORWARD -m physdev --physdev-in ${vif0} -j ACCEPT
>+    iptables_safe -P FORWARD DROP
>+    iptables_safe -F FORWARD
>+    iptables_safe -A FORWARD -m physdev --physdev-in ${pdev} -j ACCEPT
>+    iptables_safe -A FORWARD -m physdev --physdev-in ${vif0} -j ACCEPT
> }
> 
> # Usage: show_status dev bridge
>diff -Naur /etc/xen/scripts.orig/network-nat /etc/xen/scripts/network-nat
>--- /etc/xen/scripts.orig/network-nat	2008-05-09 21:25:57.000000000 +0530
>+++ /etc/xen/scripts/network-nat	2008-08-17 21:53:33.000000000 +0530
>@@ -69,14 +69,14 @@
> 
> op_start() {
> 	echo 1 >/proc/sys/net/ipv4/ip_forward
>-	iptables -t nat -A POSTROUTING -o ${netdev} -j MASQUERADE
>+	iptables_safe -t nat -A POSTROUTING -o ${netdev} -j MASQUERADE
>         [ "$dhcp" != 'no' ] && dhcp_start
> }
> 
> 
> op_stop() {
>         [ "$dhcp" != 'no' ] && dhcp_stop
>-	iptables -t nat -D POSTROUTING -o ${netdev} -j MASQUERADE
>+	iptables_safe -t nat -D POSTROUTING -o ${netdev} -j MASQUERADE
> }
> 
> 
>diff -Naur /etc/xen/scripts.orig/vif-common.sh /etc/xen/scripts/vif-common.sh
>--- /etc/xen/scripts.orig/vif-common.sh	2008-05-09 21:25:57.000000000 +0530
>+++ /etc/xen/scripts/vif-common.sh	2008-08-18 16:39:07.000000000 +0530
>@@ -73,8 +73,8 @@
>     local c="-D"
>   fi
> 
>-  iptables "$c" FORWARD -m physdev --physdev-in "$vif" "$@" -j ACCEPT \
>-    2>/dev/null ||
>+  iptables_safe "$c" FORWARD -m physdev --physdev-in "$vif" "$@" -j ACCEPT \
>+    2>/dev/null ||
>     [ "$c" == "-D" ] ||
>     log err \
>      "iptables $c FORWARD -m physdev --physdev-in $vif $@ -j ACCEPT failed.
>
>diff -Naur /etc/xen/scripts.orig/xen-network-common.sh /etc/xen/scripts/xen-network-common.sh
>--- /etc/xen/scripts.orig/xen-network-common.sh	2008-05-09 21:25:57.000000000 +0530
>+++ /etc/xen/scripts/xen-network-common.sh	2008-08-19 05:12:59.000000000 +0530
>@@ -142,3 +142,26 @@
>     ip link set ${dev} up
> }
> 
>+iptables_safe () {
>+  # As a precaution to avoid infinite wait for the lock, use a -sleeptime and retry
>+  # -2 -r 1
>+
>+  # If the lockfile command fails to get a lock consider manually cleaning up 
>+  # /var/lock/xen-iptables.lock and increase the RETRIES
>+  RETRIES=3
>+  TIMEOUT=2  
>+  lockfile -${TIMEOUT} -r ${RETRIES} /var/lock/xen-iptables.lock
>+  if [ $? -eq 0 ]; then
>+  	iptables $*
>+  	if [ $? -eq 0 ]; then
>+	  	#logger -p daemon.err "Success adding rule $*" 
>+	  	rm -f /var/lock/xen-iptables.lock
>+	  	return 0
>+  	fi
>+  	#logger -p daemon.err "Failed to add rule $*"
>+  	rm -f /var/lock/xen-iptables.lock
>+  	return 1
>+  fi
>+  logger -p daemon.err "/etc/xen/scripts/xen-network-common.sh function iptables_safe failed to get lock: /var/lock/xen-iptables.lock exists"
>+  return 1
>+}

Actions: View | Diff

Attachments on bug 460410: 315173 | 345650