kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request #2596 from bboehmke/portmapper_ipv6

Browse source 
Added improved IP validation for port mapper
This commit is contained in:
Tibor Vass 2020-11-24 15:12:21 -08:00 • committed by GitHub
commit 3fe029f9c3
3 changed files with 16 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
libnetwork/portmapper/mapper.go
View file

@ -151,7 +151,7 @@ func (pm *PortMapper) MapRange(container net.Addr, hostIP net.IP, hostPortStart,
}
containerIP, containerPort := getIPAndPort(m.container)
if hostIP.To4() != nil || hostIP.To16() != nil {
if pm.checkIP(hostIP) {
if err := pm.AppendForwardingTableEntry(m.proto, hostIP, allocatedHostPort, containerIP.String(), containerPort); err != nil {
return nil, err
}
@ -160,7 +160,7 @@ func (pm *PortMapper) MapRange(container net.Addr, hostIP net.IP, hostPortStart,
cleanup := func() error {
// need to undo the iptables rules before we return
m.userlandProxy.Stop()
if hostIP.To4() != nil || hostIP.To16() != nil {
if pm.checkIP(hostIP) {
pm.DeleteForwardingTableEntry(m.proto, hostIP, allocatedHostPort, containerIP.String(), containerPort)
if err := pm.Allocator.ReleasePort(hostIP, m.proto, allocatedHostPort); err != nil {
return err

8
libnetwork/portmapper/mapper_linux.go
View file

@ -44,3 +44,11 @@ func (pm *PortMapper) forward(action iptables.Action, proto string, sourceIP net
}
return pm.chain.Forward(action, sourceIP, sourcePort, proto, containerIP, containerPort, pm.bridgeName)
}
// checkIP checks if IP is valid and matching to chain version
func (pm *PortMapper) checkIP(ip net.IP) bool {
if pm.chain == nil || pm.chain.IPTable.Version == iptables.IPv4 {
return ip.To4() != nil
}
return ip.To16() != nil
}

6
libnetwork/portmapper/mapper_windows.go
View file

@ -29,3 +29,9 @@ func (pm *PortMapper) AppendForwardingTableEntry(proto string, sourceIP net.IP,
func (pm *PortMapper) DeleteForwardingTableEntry(proto string, sourceIP net.IP, sourcePort int, containerIP string, containerPort int) error {
return nil
}
// checkIP checks if IP is valid and matching to chain version
func (pm *PortMapper) checkIP(ip net.IP) bool {
// no IPv6 for port mapper on windows -> only IPv4 valid
return ip.To4() != nil
}