balena-os / meta-balena

A collection of Yocto layers used to build balenaOS images
https://www.balena.io/os
968 stars 115 forks source link

NetworkManager: do not use FW rule numbers in shared dispatcher script #3430

Closed alexgg closed 4 months ago

alexgg commented 4 months ago

Manipulating the firewall rules by index introduces a race condition. Both NetworkManager and balenaEngine add the rules to the top of the FORWARD chain instead of appending, so if we first look up a rule by number and then use the number to refer to it, we can not guarantee that the rule number has not changed (iow the rule has not been moved down) in the meantime.

This patch removes the use of rule numbers completely and makes the "shared" dispatcher script refer to the rules by definition.

Change-type: patch Relates-to: https://balena.zendesk.com/agent/tickets/3402


Contributor checklist

Reviewer Guidelines

alexgg commented 4 months ago

lgtm