Move iptables-restore after full init

This patch moves the loading of iptables rules
after all subsystems have been initialized. In
case any of the subsystems fails,  nether will
not leave any rules behind.

Change-Id: I86b63848d7864a684f2ed5d3f10c9e4419712617

diff --git a/src/nether_Main.cpp b/src/nether_Main.cpp
index 1ab5820..a2fa318 100644 (file)
--- a/src/nether_Main.cpp
+++ b/src/nether_Main.cpp
@@ -29,6 +29,7 @@
 
 using namespace std;
 void showHelp(char *arg);
+void cleanupAndExit();
 
 int main(int argc, char *argv[])
 {
@@ -215,7 +216,8 @@ int main(int argc, char *argv[])
        if(!manager.initialize())
        {
                LOGE("NetherManager failed to initialize, exiting");
-               return (1);
+
+               cleanupAndExit();
        }
 
        if(netherConfig.daemonMode)
@@ -277,3 +279,8 @@ void showHelp(char *arg)
        cout<< "  -i,--iptables-restore-path=<path>\tPath to iptables-restore command (default:" << NETHER_IPTABLES_RESTORE_PATH << ")\n";
        cout<< "  -h,--help\t\t\t\tshow help information\n";
 }
+
+void cleanupAndExit()
+{
+       exit (1);
+}

diff --git a/src/nether_Manager.cpp b/src/nether_Manager.cpp
index 21f5d25..e2099a2 100644 (file)
--- a/src/nether_Manager.cpp
+++ b/src/nether_Manager.cpp
@@ -68,12 +68,6 @@ bool NetherManager::initialize()
                return (false);
        }
 
-       if(netherConfig.noRules == 0 && restoreRules() == false)
-       {
-               LOGE("Failed to setup iptables rules");
-               return (false);
-       }
-
 #ifdef HAVE_AUDIT
        if(netherConfig.enableAudit)
        {
@@ -119,10 +113,19 @@ bool NetherManager::initialize()
                return (false);
        }
 
+       /* Load the rules as last, in case we have a problem with any
+               above subsystems, we won't leave hanging useless rules */
+       if(netherConfig.noRules == 0 && restoreRules() == false)
+       {
+               LOGE("Failed to setup iptables rules");
+               return (false);
+       }
+
        if((backendDescriptor = netherPrimaryPolicyBackend->getDescriptor()) == -1)
        {
                LOGI("Policy backend does not provide descriptor for select()");
        }
+
        return (true);
 }