The dispatcher script that moves around FORWARD rules of shared interfaces currently calls iptables assuming it will always work but in practice two iptables commands can not run in parallel and we have occasionally seen the script fail with:
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
This patch adds the -w option to make the script wait for the lock when necessary.
It also makes the script exit with an error code if anything fails, which will log the output as WARN instead of INFO as the errors are easy to overlook at this moment.
'Approve' if this change would be acceptable in the codebase (even if there are minor or cosmetic tweaks that could be improved).
'Request Changes' if this change would not be acceptable in our codebase (e.g. bugs, changes that will make development harder in future, security/performance issues, etc).
'Comment' if you don't feel you have enough information to decide either way (e.g. if you have major questions, or you don't understand the context of the change sufficiently to fully review yourself, but want to make a comment)
The dispatcher script that moves around FORWARD rules of shared interfaces currently calls iptables assuming it will always work but in practice two iptables commands can not run in parallel and we have occasionally seen the script fail with:
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?This patch adds the -w option to make the script wait for the lock when necessary.
It also makes the script exit with an error code if anything fails, which will log the output as WARN instead of INFO as the errors are easy to overlook at this moment.
Contributor checklist
Change-typepresent on at least one commitSigned-off-byis presentReviewer Guidelines