diff options
Diffstat (limited to 'fw/src/fw.c')
| -rw-r--r-- | fw/src/fw.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/fw/src/fw.c b/fw/src/fw.c index 6ae38df..bb97960 100644 --- a/fw/src/fw.c +++ b/fw/src/fw.c @@ -1022,11 +1022,30 @@ Done: respond(r, nil); } +/* + * The control filesystem going away takes the firewall with it. + * + * Without this the server proc ends - its mount gone, its /srv name + * removed - and the relays carry on filtering with nothing left to + * talk to them: no ctl, no rules, no flows, and no way for a + * supervisor to see that anything happened. Measured: three procs + * become two and the traffic keeps flowing. A firewall nobody can + * reach or stop is not a state worth staying in, and it is the same + * answer the relays already give when their wire fails. + */ +static void +endsrv(Srv*) +{ + syslog(0, "fw", "control filesystem gone; stopping"); + threadexitsall("ctl"); +} + static Srv fs = { .read= fsread, .write= fswrite, .destroyfid= fsdestroyfid, +.end= endsrv, }; /* a rule change must not leave traffic running that the rules now forbid */ |