Re: safely apply new rulesets: iptables-apply

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



also sprach Jan Engelhardt <jengelh@xxxxxxxxxxxxxxx> [2008.03.09.1745 +0100]:
> It needs a minor tweak in that the timeout needs to be started
> before you output anything to the terminal, just in case the
> terminal blocks.

I don't really see a way to do this trivially. If the terminal
blocks, the shell script will sooner or later be suspended and
unless I used an external resource like atd as timeout processor,
there's nothing I can do, I think.

But I can turn off all printing to the terminal, which is
informational anyway.

> On a related note, you cannot trap signal 0:
> 	trap "rm -f $TMPFILE" 0 1 2 3 4 5 6 7 8 10 11 12 13 14 15

Yes, you can. Trapping 0 means at-exit. Undoubtedly, I don't need it
because I remove the tmpfile at the end anyway, but it's just
a habit I formed and never broke with because it's the only reliable
way I found to get rid of tmpfiles from shell scripts.

> >Could this script possibly make it into the iptables distribution
> >tarball? I am flexible about the licence and all...
> 
> The idea gets my approval.

Is there anything else I need to do?

Thanks.

-- 
martin | http://madduck.net/ | http://two.sentenc.es/
 
people with narrow minds usually have broad tongues.
 
spamtraps: madduck.bogus@xxxxxxxxxxx

Attachment: digital_signature_gpg.asc
Description: Digital signature (see http://martin-krafft.net/gpg/)


[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux