kotovalexarian-likes-github
/
moby--moby
mirror of https://github.com/moby/moby.git
1
0
Fork 0
Code Releases Activity

resorted EnableIP6Tables in driver configure 

Signed-off-by: Benjamin Böhmke <benjamin@boehmke.net>
This commit is contained in:
Benjamin Böhmke 2020-07-21 18:38:34 +02:00
parent 9bc2f88f04
commit 4d1c92c155
2 changed files with 30 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
libnetwork/drivers/bridge/bridge.go
View File

@ -375,40 +375,42 @@ func (d *driver) configure(option map[string]interface{}) error {
return &ErrInvalidDriverConfig{}
}
if config.EnableIPTables {
if config.EnableIPTables || config.EnableIP6Tables {
if _, err := os.Stat("/proc/sys/net/bridge"); err != nil {
if out, err := exec.Command("modprobe", "-va", "bridge", "br_netfilter").CombinedOutput(); err != nil {
logrus.Warnf("Running modprobe bridge br_netfilter failed with message: %s, error: %v", out, err)
}
}
}
if config.EnableIPTables {
removeIPChains(iptables.IPv4)
if config.EnableIP6Tables {
removeIPChains(iptables.IPv6)
}
natChain, filterChain, isolationChain1, isolationChain2, err = setupIPChains(config, iptables.IPv4)
if err != nil {
return err
}
if config.EnableIP6Tables {
natChainV6, filterChainV6, isolationChain1V6, isolationChain2V6, err = setupIPChains(config, iptables.IPv6)
if err != nil {
return err
}
}
// Make sure on firewall reload, first thing being re-played is chains creation
iptables.OnReloaded(func() {
logrus.Debugf("Recreating iptables chains on firewall reload")
setupIPChains(config, iptables.IPv4)
})
if config.EnableIP6Tables {
iptables.OnReloaded(func() {
logrus.Debugf("Recreating ip6tables chains on firewall reload")
setupIPChains(config, iptables.IPv6)
})
}
if config.EnableIP6Tables {
removeIPChains(iptables.IPv6)
natChainV6, filterChainV6, isolationChain1V6, isolationChain2V6, err = setupIPChains(config, iptables.IPv6)
if err != nil {
return err
}
// Make sure on firewall reload, first thing being re-played is chains creation
iptables.OnReloaded(func() {
logrus.Debugf("Recreating ip6tables chains on firewall reload")
setupIPChains(config, iptables.IPv6)
})
}
if config.EnableIPForwarding {

27
libnetwork/drivers/bridge/setup_ip_forwarding.go
View File

@ -36,22 +36,21 @@ func setupIPForwarding(enableIPTables bool, enableIP6Tables bool) error {
}
// When enabling ip_forward set the default policy on forward chain to
// drop only if the daemon option iptables is not set to false.
if !enableIPTables {
return nil
}
iptable := iptables.GetIptable(iptables.IPv4)
if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {
if err := configureIPForwarding(false); err != nil {
logrus.Errorf("Disabling IP forwarding failed, %v", err)
}
return err
}
iptables.OnReloaded(func() {
logrus.Debug("Setting the default DROP policy on firewall reload")
if enableIPTables {
iptable := iptables.GetIptable(iptables.IPv4)
if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {
logrus.Warnf("Setting the default DROP policy on firewall reload failed, %v", err)
if err := configureIPForwarding(false); err != nil {
logrus.Errorf("Disabling IP forwarding failed, %v", err)
}
return err
}
})
iptables.OnReloaded(func() {
logrus.Debug("Setting the default DROP policy on firewall reload")
if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {
logrus.Warnf("Setting the default DROP policy on firewall reload failed, %v", err)
}
})
}
}
// add only iptables rules - forwarding is handled by setupIPv6Forwarding in setup_ipv6