[PATCH v2 0/2] Two fixes related to '--concurrent'

[PATCH v2 0/2] Two fixes related to '--concurrent'

[Firo Yang]

Fixed two problems related to '--concurrent'.

v2:
  Simply print an error message suggested by Pablo Neira Ayuso.

Firo Yang (2):
  libebtc: Fix an issue that '--concurrent' doesn't work with NFS
  ebtables: Spewing an error if --concurrent isn't first argument

 ebtables.c | 2 ++
 libebtc.c  | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

-- 
2.30.2

[PATCH v2 1/2] libebtc: Fix an issue that '--concurrent' doesn't work with NFS

[Firo Yang]

Due to the following commit[1] from kernel, if '/var/lib/ebtables' was
mounted with a NFS filesystem, ebtables command will hit the following
error:
mount | grep nfs
x.x.x.x:/var/lib/ebtables on /var/lib/ebtables type nfs4 [...]
/usr/sbin/ebtables --concurrent -L
Trying to obtain lock /var/lib/ebtables/lock
Trying to obtain lock /var/lib/ebtables/lock
Trying to obtain lock /var/lib/ebtables/lock
Trying to obtain lock /var/lib/ebtables/lock
[...]

In order to fix this problem, add 'O_WRONLY' to match the requirement of
that kernel commit[1].

[1]: 55725513b5ef ("NFSv4: Ensure that we check lock exclusive/shared type against open modes")

Signed-off-by: Firo Yang <firo.yang@suse.com>
---
 libebtc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libebtc.c b/libebtc.c
index 1b058ef..112c307 100644
--- a/libebtc.c
+++ b/libebtc.c
@@ -144,7 +144,7 @@ static int lock_file()
 	int fd, try = 0;
 
 retry:
-	fd = open(LOCKFILE, O_CREAT|O_CLOEXEC, 00600);
+	fd = open(LOCKFILE, O_CREAT|O_WRONLY|O_CLOEXEC, 00600);
 	if (fd < 0) {
 		if (try == 1 || mkdir(dirname(pathbuf), 00700))
 			return -2;
-- 
2.30.2

[PATCH v2 2/2] ebtables: Spewing an error if --concurrent isn't first argument

[Firo Yang]

Our customer reported a following issue:
If '--concurrent' was passed to ebtables command behind other arguments,
'--concurrent' will not take effect sometimes; for a simple example,
ebtables -L --concurrent. This is becuase the handling of '--concurrent'
is implemented in a passing-order-dependent way.

Fixed this problem as Pablo Neira Ayuso suggested by simply spewing
an error like following:
./ebtables-legacy -L --concurrent
Please put the --concurrent option first.

Signed-off-by: Firo Yang <firo.yang@suse.com>
---
 ebtables.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ebtables.c b/ebtables.c
index f7dfccf..c1f5c2b 100644
--- a/ebtables.c
+++ b/ebtables.c
@@ -1041,6 +1041,8 @@ big_iface_length:
 			strcpy(replace->filename, optarg);
 			break;
 		case 13 : /* concurrent */
+			if (OPT_COMMANDS)
+				ebt_print_error2("Please put the --concurrent option first");
 			use_lockfd = 1;
 			break;
 		case 1 :
-- 
2.30.2

Re: [PATCH v2 0/2] Two fixes related to '--concurrent'

[Pablo Neira Ayuso]

On Fri, Apr 16, 2021 at 12:11:39PM +0800, Firo Yang wrote:
> Fixed two problems related to '--concurrent'.

Series applied, thanks.