commit fb31c2267d576507f2c430e934c28ef8c5bf346d
author Nilesh Poddar <npoddar@codeaurora.org> Fri Dec 19 10:43:30 2014 -0800
committer Nilesh Poddar <npoddar@codeaurora.org> Wed Jan 07 13:02:50 2015 -0800
tree 93f3668a0365b5963cb6e30b842753547428dea8
parent 7684ff3d0ef407753478ff59c9fb115339215ffc

netd: Fix concurrency error for iptables command

When multiple user space processes run the iptables
commands conncurrently, the iptables exits immediately
since it fails to acquire a lock.

CRs-Fixed: 747905

Change-Id: I77cb377eac885139b0b08b13bb5b5388a52e2ce3

server/CommandListener.cpp

diff --git a/server/CommandListener.cpp b/server/CommandListener.cpp
index d29048d..cbe5abb 100644
--- a/server/CommandListener.cpp
+++ b/server/CommandListener.cpp
@@ -168,11 +168,11 @@
         // -N to create the chain
         // -A to append the chain to parent
 
-        execIptablesSilently(target, "-t", table, "-D", parentChain, "-j", *childChain, NULL);
-        execIptablesSilently(target, "-t", table, "-F", *childChain, NULL);
-        execIptablesSilently(target, "-t", table, "-X", *childChain, NULL);
-        execIptables(target, "-t", table, "-N", *childChain, NULL);
-        execIptables(target, "-t", table, "-A", parentChain, "-j", *childChain, NULL);
+        execIptablesSilently(target, "-w", "-t", table, "-D", parentChain, "-j", *childChain, NULL);
+        execIptablesSilently(target, "-w", "-t", table, "-F", *childChain, NULL);
+        execIptablesSilently(target, "-w", "-t", table, "-X", *childChain, NULL);
+        execIptables(target, "-w", "-t", table, "-N", *childChain, NULL);
+        execIptables(target, "-w", "-t", table, "-A", parentChain, "-j", *childChain, NULL);
     } while (*(++childChain) != NULL);
 }
 

server/FirewallController.cpp

diff --git a/server/FirewallController.cpp b/server/FirewallController.cpp
index 17c6da4..b3571d1 100644
--- a/server/FirewallController.cpp
+++ b/server/FirewallController.cpp
@@ -45,9 +45,9 @@
     disableFirewall();
 
     // create default rule to drop all traffic
-    res |= execIptables(V4V6, "-A", LOCAL_INPUT, "-j", "DROP", NULL);
-    res |= execIptables(V4V6, "-A", LOCAL_OUTPUT, "-j", "REJECT", NULL);
-    res |= execIptables(V4V6, "-A", LOCAL_FORWARD, "-j", "REJECT", NULL);
+    res |= execIptables(V4V6, "-w", "-A", LOCAL_INPUT, "-j", "DROP", NULL);
+    res |= execIptables(V4V6, "-w", "-A", LOCAL_OUTPUT, "-j", "REJECT", NULL);
+    res |= execIptables(V4V6, "-w", "-A", LOCAL_FORWARD, "-j", "REJECT", NULL);
 
     return res;
 }
@@ -56,9 +56,9 @@
     int res = 0;
 
     // flush any existing rules
-    res |= execIptables(V4V6, "-F", LOCAL_INPUT, NULL);
-    res |= execIptables(V4V6, "-F", LOCAL_OUTPUT, NULL);
-    res |= execIptables(V4V6, "-F", LOCAL_FORWARD, NULL);
+    res |= execIptables(V4V6, "-w", "-F", LOCAL_INPUT, NULL);
+    res |= execIptables(V4V6, "-w", "-F", LOCAL_OUTPUT, NULL);
+    res |= execIptables(V4V6, "-w", "-F", LOCAL_FORWARD, NULL);
 
     return res;
 }
@@ -82,8 +82,8 @@
     }
 
     int res = 0;
-    res |= execIptables(V4V6, op, LOCAL_INPUT, "-i", iface, "-j", "RETURN", NULL);
-    res |= execIptables(V4V6, op, LOCAL_OUTPUT, "-o", iface, "-j", "RETURN", NULL);
+    res |= execIptables(V4V6, "-w", op, LOCAL_INPUT, "-i", iface, "-j", "RETURN", NULL);
+    res |= execIptables(V4V6, "-w", op, LOCAL_OUTPUT, "-o", iface, "-j", "RETURN", NULL);
     return res;
 }
 
@@ -101,8 +101,8 @@
     }
 
     int res = 0;
-    res |= execIptables(target, op, LOCAL_INPUT, "-d", addr, "-j", "RETURN", NULL);
-    res |= execIptables(target, op, LOCAL_OUTPUT, "-s", addr, "-j", "RETURN", NULL);
+    res |= execIptables(target, "-w", op, LOCAL_INPUT, "-d", addr, "-j", "RETURN", NULL);
+    res |= execIptables(target, "-w", op, LOCAL_OUTPUT, "-s", addr, "-j", "RETURN", NULL);
     return res;
 }
 
@@ -127,9 +127,9 @@
     }
 
     int res = 0;
-    res |= execIptables(target, op, LOCAL_INPUT, "-s", addr, "-p", protocolStr,
+    res |= execIptables(target, "-w", op, LOCAL_INPUT, "-s", addr, "-p", protocolStr,
             "--sport", portStr, "-j", "RETURN", NULL);
-    res |= execIptables(target, op, LOCAL_OUTPUT, "-d", addr, "-p", protocolStr,
+    res |= execIptables(target, "-w", op, LOCAL_OUTPUT, "-d", addr, "-p", protocolStr,
             "--dport", portStr, "-j", "RETURN", NULL);
     return res;
 }
@@ -146,9 +146,9 @@
     }
 
     int res = 0;
-    res |= execIptables(V4V6, op, LOCAL_INPUT, "-m", "owner", "--uid-owner", uidStr,
+    res |= execIptables(V4V6, "-w", op, LOCAL_INPUT, "-m", "owner", "--uid-owner", uidStr,
             "-j", "RETURN", NULL);
-    res |= execIptables(V4V6, op, LOCAL_OUTPUT, "-m", "owner", "--uid-owner", uidStr,
+    res |= execIptables(V4V6, "-w", op, LOCAL_OUTPUT, "-m", "owner", "--uid-owner", uidStr,
             "-j", "RETURN", NULL);
     return res;
 }

server/RouteController.cpp

diff --git a/server/RouteController.cpp b/server/RouteController.cpp
index 140c0d3..37f6f90 100644
--- a/server/RouteController.cpp
+++ b/server/RouteController.cpp
@@ -437,7 +437,7 @@
     char markString[UINT32_HEX_STRLEN];
     snprintf(markString, sizeof(markString), "0x%x", fwmark.intValue);
 
-    if (execIptables(V4V6, "-t", "mangle", add ? "-A" : "-D", "INPUT", "-i", interface, "-j",
+    if (execIptables(V4V6, "-w", "-t", "mangle", add ? "-A" : "-D", "INPUT", "-i", interface, "-j",
                      "MARK", "--set-mark", markString, NULL)) {
         ALOGE("failed to change iptables rule that sets incoming packet mark");
         return -EREMOTEIO;