kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Move iptable rules outside of create bridge

Browse source 
This allows the user to toggle enabling and
disabling intercontainer communication when
they run the daemon.
This commit is contained in:
Michael Crosby 2013-10-24 09:08:50 -07:00 committed by Victor Vieux
parent e179a24ad5
commit 94e5081bac
2 changed files with 22 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
iptables/iptables.go
View file

@ -92,6 +92,11 @@ func (c *Chain) Remove() error {
return nil return nil
} }
// Check if an existing rule exists
func Exists(args ...string) bool {
return Raw(append([]string{"-C"}, args...)...) == nil
}
func Raw(args ...string) error { func Raw(args ...string) error {
path, err := exec.LookPath("iptables") path, err := exec.LookPath("iptables")
if err != nil { if err != nil {

27
network.go
View file

@ -145,16 +145,6 @@ func CreateBridgeIface(config *DaemonConfig) error {
"!", "-d", ifaceAddr, "-j", "MASQUERADE"); err != nil { "!", "-d", ifaceAddr, "-j", "MASQUERADE"); err != nil {
return fmt.Errorf("Unable to enable network bridge NAT: %s", err) return fmt.Errorf("Unable to enable network bridge NAT: %s", err)
} }
if !config.InterContainerCommunication {
utils.Debugf("Disable inter-container communication")
if err := iptables.Raw("-A", "FORWARD", "-i", config.BridgeIface, "-o", config.BridgeIface, "-j", "DROP"); err != nil {
return fmt.Errorf("Unable to prevent intercontainer communication: %s", err)
}
} else {
utils.Debugf("Enable inter-container communication")
iptables.Raw("-D", "FORWARD", "-i", config.BridgeIface, "-o", config.BridgeIface, "-j", "DROP")
}
} }
return nil return nil
} }
@ -659,6 +649,23 @@ func newNetworkManager(config *DaemonConfig) (*NetworkManager, error) {
} }
network := addr.(*net.IPNet) network := addr.(*net.IPNet)
// Configure iptables for link support
if config.EnableIptables {
args := []string{"FORWARD", "-i", config.BridgeIface, "-o", config.BridgeIface, "-j", "DROP"}
if !config.InterContainerCommunication {
if !iptables.Exists(args...) {
utils.Debugf("Disable inter-container communication")
if err := iptables.Raw(append([]string{"-A"}, args...)...); err != nil {
return nil, fmt.Errorf("Unable to prevent intercontainer communication: %s", err)
}
}
} else {
utils.Debugf("Enable inter-container communication")
iptables.Raw(append([]string{"-D"}, args...)...)
}
}
ipAllocator := newIPAllocator(network) ipAllocator := newIPAllocator(network)
tcpPortAllocator, err := newPortAllocator() tcpPortAllocator, err := newPortAllocator()