|
@@ -25,7 +25,12 @@ dir=$(dirname "$0")
|
|
|
. "$dir/vif-common.sh"
|
|
|
|
|
|
#main_ip=$(dom0_ip)
|
|
|
-lockfile=/var/run/xen-hotplug/vif-lock
|
|
|
+
|
|
|
+ipt_arg=
|
|
|
+if "iptables-restore" --help 2>&1 | grep -q wait=; then
|
|
|
+ # 'wait' must be last on command line if secs not specified
|
|
|
+ ipt_arg=--wait
|
|
|
+fi
|
|
|
|
|
|
# shellcheck disable=SC2154
|
|
|
if [ "${ip}" ]; then
|
|
@@ -101,12 +106,12 @@ if [ "${ip}" ] ; then
|
|
|
ipt=iptables-restore
|
|
|
fi
|
|
|
echo -e "*raw\n$iptables_cmd -i ${vif} ! -s ${addr} -j DROP\nCOMMIT" | \
|
|
|
- ${cmdprefix} flock $lockfile $ipt --noflush
|
|
|
+ ${cmdprefix} $ipt --noflush $ipt_arg
|
|
|
done
|
|
|
# if no IPv6 is assigned, block all IPv6 traffic on that interface
|
|
|
if ! [[ "$ip" = *:* ]]; then
|
|
|
echo -e "*raw\n$iptables_cmd -i ${vif} -j DROP\nCOMMIT" | \
|
|
|
- ${cmdprefix} flock $lockfile ip6tables-restore --noflush
|
|
|
+ ${cmdprefix} ip6tables-restore --noflush $ipt_arg
|
|
|
fi
|
|
|
${cmdprefix} ip addr "${ipcmd}" "${back_ip}/32" dev "${vif}"
|
|
|
if [ "${back_ip6}" ] && [[ "${back_ip6}" != "fe80:"* ]]; then
|