kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

enable hairpin mode on the bridge port & fix iptables rule

Browse source 
* When userland-proxy is disabled, enable hairpin mode on the host-side of the veth
* When userland-proxy is enabled, fix the iptable rules appropriately

Signed-off-by: Madhu Venugopal <madhu@docker.com>
This commit is contained in:
Madhu Venugopal 2015-06-11 16:53:20 -07:00
parent 3ed19169a3
commit 903fcbd154
3 changed files with 22 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
libnetwork/drivers/bridge/bridge.go
View file

@ -876,6 +876,13 @@ func (d *driver) CreateEndpoint(nid, eid types.UUID, epInfo driverapi.EndpointIn
return err return err
} }
if !config.EnableUserlandProxy {
err = netlink.LinkSetHairpin(host, true)
if err != nil {
return err
}
}
// v4 address for the sandbox side pipe interface // v4 address for the sandbox side pipe interface
ip4, err := ipAllocator.RequestIP(n.bridge.bridgeIPv4, nil) ip4, err := ipAllocator.RequestIP(n.bridge.bridgeIPv4, nil)
if err != nil { if err != nil {

22
libnetwork/iptables/iptables.go
View file

@ -44,9 +44,10 @@ var (
// Chain defines the iptables chain. // Chain defines the iptables chain.
type Chain struct { type Chain struct {
Name string Name string
Bridge string Bridge string
Table Table Table Table
HairpinMode bool
} }
// ChainError is returned to represent errors during ip table operation. // ChainError is returned to represent errors during ip table operation.
@ -75,9 +76,10 @@ func initCheck() error {
// NewChain adds a new chain to ip table. // NewChain adds a new chain to ip table.
func NewChain(name, bridge string, table Table, hairpinMode bool) (*Chain, error) { func NewChain(name, bridge string, table Table, hairpinMode bool) (*Chain, error) {
c := &Chain{ c := &Chain{
Name: name, Name: name,
Bridge: bridge, Bridge: bridge,
Table: table, Table: table,
HairpinMode: hairpinMode,
} }
if string(c.Table) == "" { if string(c.Table) == "" {
@ -151,12 +153,16 @@ func (c *Chain) Forward(action Action, ip net.IP, port int, proto, destAddr stri
// value" by both iptables and ip6tables. // value" by both iptables and ip6tables.
daddr = "0/0" daddr = "0/0"
} }
if output, err := Raw("-t", string(Nat), string(action), c.Name, args := []string{"-t", string(Nat), string(action), c.Name,
"-p", proto, "-p", proto,
"-d", daddr, "-d", daddr,
"--dport", strconv.Itoa(port), "--dport", strconv.Itoa(port),
"-j", "DNAT", "-j", "DNAT",
"--to-destination", net.JoinHostPort(destAddr, strconv.Itoa(destPort))); err != nil { "--to-destination", net.JoinHostPort(destAddr, strconv.Itoa(destPort))}
if !c.HairpinMode {
args = append(args, "!", "-i", c.Bridge)
}
if output, err := Raw(args...); err != nil {
return err return err
} else if len(output) != 0 { } else if len(output) != 0 {
return ChainError{Chain: "FORWARD", Output: output} return ChainError{Chain: "FORWARD", Output: output}

1
libnetwork/iptables/iptables_test.go
View file

@ -48,6 +48,7 @@ func TestForward(t *testing.T) {
"--dport", strconv.Itoa(port), "--dport", strconv.Itoa(port),
"-j", "DNAT", "-j", "DNAT",
"--to-destination", dstAddr + ":" + strconv.Itoa(dstPort), "--to-destination", dstAddr + ":" + strconv.Itoa(dstPort),
"!", "-i", natChain.Bridge,
} }
if !Exists(natChain.Table, natChain.Name, dnatRule...) { if !Exists(natChain.Table, natChain.Name, dnatRule...) {