Browse Source

Fix stale cache when state is inconsistent

If a firewall rule is added to allow an IP address, it is cached.
When a user manually runs `firewall-cmd --reload` with this daemon running,
any cached record would remain, even though reloading FirewallD would cause
it to actually be removed from the rules. When Kazoo sends an AMQP message
to the daemon to remove the rule, the command would be run and would fail,
since the rule no longer exists on the firewall. Before, the cached record
remained, so subsequent commands from Kazoo to add it would be ignored, since
the daemon "thinks" it still has the rule in the firewall. Removing the
cached record BEFORE trying to run the command to remove it (which correctly
fails) fixes the issue and makes sure that the state of the cache tracks the
actual firewall state better.
master
Ruel Tmeizeh - RuhNet 10 months ago
parent
commit
73900b8dba
1 changed files with 3 additions and 2 deletions
  1. +3
    -2
      firewall.go

+ 3
- 2
firewall.go View File

@ -122,13 +122,14 @@ func firewallDelete(ipaddr, portstring string) error {
logit(5, "Firewall removing from zone '"+zone+"': "+ipaddr)
ipcache.Remove(ipaddr)
//ipcache.Remove(ipaddr+":"+pp.Port+"/"+pp.Proto)
fwOutput, err := exec.Command("firewall-cmd", "--zone="+zone, "--remove-source="+ipaddr).CombinedOutput()
if err != nil {
logit(3, "Error executing firewall-cmd: "+err.Error()+" OUTPUT: "+string(fwOutput))
return errors.New("Error executing firewall-cmd: " + err.Error())
}
ipcache.Remove(ipaddr)
//ipcache.Remove(ipaddr+":"+pp.Port+"/"+pp.Proto)
return nil
}


Loading…
Cancel
Save