the kernel can only prevent the concurrency of s/getsockopt, but
iptables will call these interfaces multiple times at a time. We
need to wait for one iptables to complete before executing the second
one, otherwise the data will be overwritten.
iptables flow:
get current iptables entries [1] -> add new entry 2 [1,2] -> set to kernel [1,2]
get current iptables entries [1] -> add new entry 3 [1,3] -> set to kernel [1,3]
entry 2 is lost
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
