commit fb31c2267d576507f2c430e934c28ef8c5bf346d
author Nilesh Poddar <npoddar@codeaurora.org> Fri Dec 19 10:43:30 2014 -0800
committer Nilesh Poddar <npoddar@codeaurora.org> Wed Jan 07 13:02:50 2015 -0800
tree 93f3668a0365b5963cb6e30b842753547428dea8
parent 7684ff3d0ef407753478ff59c9fb115339215ffc

netd: Fix concurrency error for iptables command

When multiple user space processes run the iptables
commands conncurrently, the iptables exits immediately
since it fails to acquire a lock.

CRs-Fixed: 747905

Change-Id: I77cb377eac885139b0b08b13bb5b5388a52e2ce3

server/FirewallController.cpp

diff --git a/server/FirewallController.cpp b/server/FirewallController.cpp
index 17c6da4..b3571d1 100644
--- a/server/FirewallController.cpp
+++ b/server/FirewallController.cpp
@@ -45,9 +45,9 @@
     disableFirewall();
 
     // create default rule to drop all traffic
-    res |= execIptables(V4V6, "-A", LOCAL_INPUT, "-j", "DROP", NULL);
-    res |= execIptables(V4V6, "-A", LOCAL_OUTPUT, "-j", "REJECT", NULL);
-    res |= execIptables(V4V6, "-A", LOCAL_FORWARD, "-j", "REJECT", NULL);
+    res |= execIptables(V4V6, "-w", "-A", LOCAL_INPUT, "-j", "DROP", NULL);
+    res |= execIptables(V4V6, "-w", "-A", LOCAL_OUTPUT, "-j", "REJECT", NULL);
+    res |= execIptables(V4V6, "-w", "-A", LOCAL_FORWARD, "-j", "REJECT", NULL);
 
     return res;
 }
@@ -56,9 +56,9 @@
     int res = 0;
 
     // flush any existing rules
-    res |= execIptables(V4V6, "-F", LOCAL_INPUT, NULL);
-    res |= execIptables(V4V6, "-F", LOCAL_OUTPUT, NULL);
-    res |= execIptables(V4V6, "-F", LOCAL_FORWARD, NULL);
+    res |= execIptables(V4V6, "-w", "-F", LOCAL_INPUT, NULL);
+    res |= execIptables(V4V6, "-w", "-F", LOCAL_OUTPUT, NULL);
+    res |= execIptables(V4V6, "-w", "-F", LOCAL_FORWARD, NULL);
 
     return res;
 }
@@ -82,8 +82,8 @@
     }
 
     int res = 0;
-    res |= execIptables(V4V6, op, LOCAL_INPUT, "-i", iface, "-j", "RETURN", NULL);
-    res |= execIptables(V4V6, op, LOCAL_OUTPUT, "-o", iface, "-j", "RETURN", NULL);
+    res |= execIptables(V4V6, "-w", op, LOCAL_INPUT, "-i", iface, "-j", "RETURN", NULL);
+    res |= execIptables(V4V6, "-w", op, LOCAL_OUTPUT, "-o", iface, "-j", "RETURN", NULL);
     return res;
 }
 
@@ -101,8 +101,8 @@
     }
 
     int res = 0;
-    res |= execIptables(target, op, LOCAL_INPUT, "-d", addr, "-j", "RETURN", NULL);
-    res |= execIptables(target, op, LOCAL_OUTPUT, "-s", addr, "-j", "RETURN", NULL);
+    res |= execIptables(target, "-w", op, LOCAL_INPUT, "-d", addr, "-j", "RETURN", NULL);
+    res |= execIptables(target, "-w", op, LOCAL_OUTPUT, "-s", addr, "-j", "RETURN", NULL);
     return res;
 }
 
@@ -127,9 +127,9 @@
     }
 
     int res = 0;
-    res |= execIptables(target, op, LOCAL_INPUT, "-s", addr, "-p", protocolStr,
+    res |= execIptables(target, "-w", op, LOCAL_INPUT, "-s", addr, "-p", protocolStr,
             "--sport", portStr, "-j", "RETURN", NULL);
-    res |= execIptables(target, op, LOCAL_OUTPUT, "-d", addr, "-p", protocolStr,
+    res |= execIptables(target, "-w", op, LOCAL_OUTPUT, "-d", addr, "-p", protocolStr,
             "--dport", portStr, "-j", "RETURN", NULL);
     return res;
 }
@@ -146,9 +146,9 @@
     }
 
     int res = 0;
-    res |= execIptables(V4V6, op, LOCAL_INPUT, "-m", "owner", "--uid-owner", uidStr,
+    res |= execIptables(V4V6, "-w", op, LOCAL_INPUT, "-m", "owner", "--uid-owner", uidStr,
             "-j", "RETURN", NULL);
-    res |= execIptables(V4V6, op, LOCAL_OUTPUT, "-m", "owner", "--uid-owner", uidStr,
+    res |= execIptables(V4V6, "-w", op, LOCAL_OUTPUT, "-m", "owner", "--uid-owner", uidStr,
             "-j", "RETURN", NULL);
     return res;
 }