mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
Move hasIPTablesEnabled check into firewall_linux.go
Signed-off-by: David O'Rourke <david@scalefactory.com>
This commit is contained in:
parent
b4d0319424
commit
301a7724fb
2 changed files with 33 additions and 28 deletions
|
@ -679,29 +679,6 @@ func (c *controller) isAgent() bool {
|
|||
return c.cfg.Daemon.ClusterProvider.IsAgent()
|
||||
}
|
||||
|
||||
func (c *controller) hasIPTablesEnabled() bool {
|
||||
c.Lock()
|
||||
defer c.Unlock()
|
||||
|
||||
if c.cfg == nil || c.cfg.Daemon.DriverCfg[netlabel.GenericData] == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
genericData, ok := c.cfg.Daemon.DriverCfg[netlabel.GenericData]
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
|
||||
optMap := genericData.(map[string]interface{})
|
||||
|
||||
enabled, ok := optMap["EnableIPTables"].(bool)
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
|
||||
return enabled
|
||||
}
|
||||
|
||||
func (c *controller) isDistributedControl() bool {
|
||||
return !c.isManager() && !c.isAgent()
|
||||
}
|
||||
|
@ -925,9 +902,7 @@ addToStore:
|
|||
c.Unlock()
|
||||
}
|
||||
|
||||
if c.hasIPTablesEnabled() {
|
||||
c.arrangeUserFilterRule()
|
||||
}
|
||||
c.arrangeUserFilterRule()
|
||||
|
||||
return network, nil
|
||||
}
|
||||
|
|
|
@ -2,6 +2,7 @@ package libnetwork
|
|||
|
||||
import (
|
||||
"github.com/docker/libnetwork/iptables"
|
||||
"github.com/docker/libnetwork/netlabel"
|
||||
"github.com/sirupsen/logrus"
|
||||
)
|
||||
|
||||
|
@ -9,15 +10,44 @@ const userChain = "DOCKER-USER"
|
|||
|
||||
func (c *controller) arrangeUserFilterRule() {
|
||||
c.Lock()
|
||||
arrangeUserFilterRule()
|
||||
|
||||
if c.hasIPTablesEnabled() {
|
||||
arrangeUserFilterRule()
|
||||
}
|
||||
|
||||
c.Unlock()
|
||||
|
||||
iptables.OnReloaded(func() {
|
||||
c.Lock()
|
||||
arrangeUserFilterRule()
|
||||
|
||||
if c.hasIPTablesEnabled() {
|
||||
arrangeUserFilterRule()
|
||||
}
|
||||
|
||||
c.Unlock()
|
||||
})
|
||||
}
|
||||
|
||||
func (c *controller) hasIPTablesEnabled() bool {
|
||||
// Locking c should be handled in the calling method.
|
||||
if c.cfg == nil || c.cfg.Daemon.DriverCfg[netlabel.GenericData] == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
genericData, ok := c.cfg.Daemon.DriverCfg[netlabel.GenericData]
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
|
||||
optMap := genericData.(map[string]interface{})
|
||||
enabled, ok := optMap["EnableIPTables"].(bool)
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
|
||||
return enabled
|
||||
}
|
||||
|
||||
// This chain allow users to configure firewall policies in a way that persists
|
||||
// docker operations/restarts. Docker will not delete or modify any pre-existing
|
||||
// rules from the DOCKER-USER filter chain.
|
||||
|
|
Loading…
Reference in a new issue