NetworkManager: do not use FW rule numbers in shared dispatcher script #3429
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
alexgg
reviewed
May 23, 2024
meta-balena-common/recipes-connectivity/networkmanager/balena-files/90shared
Outdated
Show resolved
Hide resolved
| info "Found shared FORWARD rule 'nm-shared-${IFNAME}' at index ${FW_RULE_NO}, moving down" | ||
|
|
||
| FW_RULE_ARGS="$(${IPTABLES} -S FORWARD ${FW_RULE_NO})" | ||
| info "Found shared FORWARD rule 'nm-shared-${IFNAME}', moving down" |
There was a problem hiding this comment.
This feels informational and ambiguous - what I'd prefer is a final check that actually makes sure the rule is last, and then print a message stating it has been moved. Printing the intention to move is not useful.
|
|
||
| # Append the rule to the bottom | ||
| # Do not quote ${FW_RULE_ARGS}, this needs to expand | ||
| ${IPTABLES} ${FW_RULE_ARGS} | ||
|
|
||
| # Remove the rule from its original position | ||
| ${IPTABLES} -D FORWARD "${FW_RULE_NO}" | ||
| ${IPTABLES} -D ${FW_RULE_ARGS#-A } |
There was a problem hiding this comment.
I like not using line numbers, but a final check to make sure all has worked and err out (or retry) if not would make it more robust.
There was a problem hiding this comment.
Added this into a loop that tries 5 times before bailing out.
mtoman
force-pushed
the
mtoman/shared-no-rule-index
branch
2 times, most recently
from
76bcb36
to
95c64e4
Compare
Manipulating the firewall rules by index introduces a race condition. Both NetworkManager and balenaEngine add the rules to the top of the FORWARD chain instead of appending, so if we first look up a rule by number and then use the number to refer to it, we can not guarantee that the rule number has not changed (iow the rule has not been moved down) in the meantime. This patch removes the use of rule numbers completely and makes the "shared" dispatcher script refer to the rules by definition. Change-type: patch Signed-off-by: Michal Toman <michalt@balena.io>
mtoman
force-pushed
the
mtoman/shared-no-rule-index
branch
from
95c64e4
to
ab8d611
Compare
alexgg
approved these changes
May 23, 2024
|
@resin-jenkins retest this please |
6 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Manipulating the firewall rules by index introduces a race condition. Both NetworkManager and balenaEngine add the rules to the top of the
FORWARDchain instead of appending, so if we first look up a rule by number and then use the number to refer to it, we can not guarantee that the rule number has not changed (iow the rule has not been moved down) in the meantime.This patch removes the use of rule numbers completely and makes the "shared" dispatcher script refer to the rules by definition.
Contributor checklist
Change-typepresent on at least one commitSigned-off-byis presentReviewer Guidelines