2015-03-04 18:11:31 +00:00
|
|
|
package bridge
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"io/ioutil"
|
2016-11-21 18:53:07 +00:00
|
|
|
|
|
|
|
"github.com/Sirupsen/logrus"
|
|
|
|
"github.com/docker/libnetwork/iptables"
|
2015-03-04 18:11:31 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
2015-03-04 21:25:43 +00:00
|
|
|
ipv4ForwardConf = "/proc/sys/net/ipv4/ip_forward"
|
|
|
|
ipv4ForwardConfPerm = 0644
|
2015-03-04 18:11:31 +00:00
|
|
|
)
|
|
|
|
|
2016-10-28 20:54:52 +00:00
|
|
|
func configureIPForwarding(enable bool) error {
|
|
|
|
var val byte
|
|
|
|
if enable {
|
|
|
|
val = '1'
|
|
|
|
}
|
|
|
|
return ioutil.WriteFile(ipv4ForwardConf, []byte{val, '\n'}, ipv4ForwardConfPerm)
|
|
|
|
}
|
|
|
|
|
|
|
|
func setupIPForwarding(enableIPTables bool) error {
|
2015-07-27 11:31:03 +00:00
|
|
|
// Get current IPv4 forward setup
|
|
|
|
ipv4ForwardData, err := ioutil.ReadFile(ipv4ForwardConf)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Cannot read IP forwarding setup: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Enable IPv4 forwarding only if it is not already enabled
|
|
|
|
if ipv4ForwardData[0] != '1' {
|
|
|
|
// Enable IPv4 forwarding
|
2016-10-28 20:54:52 +00:00
|
|
|
if err := configureIPForwarding(true); err != nil {
|
|
|
|
return fmt.Errorf("Enabling IP forwarding failed: %v", err)
|
2015-07-27 11:31:03 +00:00
|
|
|
}
|
2016-10-28 20:54:52 +00:00
|
|
|
// When enabling ip_forward set the default policy on forward chain to
|
|
|
|
// drop only if the daemon option iptables is not set to false.
|
|
|
|
if !enableIPTables {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
if err := iptables.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {
|
|
|
|
if err := configureIPForwarding(false); err != nil {
|
2016-11-21 18:53:07 +00:00
|
|
|
logrus.Errorf("Disabling IP forwarding failed, %v", err)
|
2016-10-28 20:54:52 +00:00
|
|
|
}
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
iptables.OnReloaded(func() {
|
2016-11-21 18:53:07 +00:00
|
|
|
logrus.Debug("Setting the default DROP policy on firewall reload")
|
2016-10-28 20:54:52 +00:00
|
|
|
if err := iptables.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {
|
2016-11-21 18:53:07 +00:00
|
|
|
logrus.Warnf("Settig the default DROP policy on firewall reload failed, %v", err)
|
2016-10-28 20:54:52 +00:00
|
|
|
}
|
|
|
|
})
|
2015-03-04 19:37:16 +00:00
|
|
|
}
|
|
|
|
return nil
|
2015-03-04 18:11:31 +00:00
|
|
|
}
|