Skip to content

Commit

Permalink
fix: add 10s wait timeout on iptables command (#151)
Browse files Browse the repository at this point in the history
When the tested server has its iptables heavily manipulated (e.g Kubernetes)
The lock aquirement can sometimes fail, hence generating false positives
The command will retry 10 times with a 1 second interval
  • Loading branch information
ThibaultDewailly committed Mar 23, 2022
1 parent d1bd1eb commit 5c07266
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion bin/hardening/3.5.4.1.1_net_fw_default_policy_drop.sh
Original file line number Diff line number Diff line change
Expand Up @@ -21,14 +21,15 @@ PACKAGE="iptables"
FW_CHAINS="INPUT FORWARD"
FW_POLICY="DROP"
FW_CMD="iptables"
FW_TIMEOUT="10"

# This function will be called if the script status is on enabled / audit mode
audit() {
is_pkg_installed "$PACKAGE"
if [ "$FNRET" != 0 ]; then
crit "$PACKAGE is not installed!"
else
ipt=$($SUDO_CMD "$FW_CMD" -nL 2>/dev/null || true)
ipt=$($SUDO_CMD "$FW_CMD" -w "$FW_TIMEOUT" -nL 2>/dev/null || true)
if [[ -z "$ipt" ]]; then
crit "Empty return from $FW_CMD command. Aborting..."
return
Expand Down

0 comments on commit 5c07266

Please sign in to comment.