kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request #299 from icecrime/13956_duplicate_iptables_rules

Browse source 
Fix duplicated iptables rules
This commit is contained in:
Madhu Venugopal 2015-06-16 11:21:10 -07:00
commit 9ec67edb66
2 changed files with 13 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

16
libnetwork/iptables/iptables.go
View file

@ -99,7 +99,8 @@ func NewChain(name, bridge string, table Table, hairpinMode bool) (*Chain, error
case Nat: case Nat:
preroute := []string{ preroute := []string{
"-m", "addrtype", "-m", "addrtype",
"--dst-type", "LOCAL"} "--dst-type", "LOCAL",
"-j", c.Name}
if !Exists(Nat, "PREROUTING", preroute...) { if !Exists(Nat, "PREROUTING", preroute...) {
if err := c.Prerouting(Append, preroute...); err != nil { if err := c.Prerouting(Append, preroute...); err != nil {
return nil, fmt.Errorf("Failed to inject docker in PREROUTING chain: %s", err) return nil, fmt.Errorf("Failed to inject docker in PREROUTING chain: %s", err)
@ -107,7 +108,8 @@ func NewChain(name, bridge string, table Table, hairpinMode bool) (*Chain, error
} }
output := []string{ output := []string{
"-m", "addrtype", "-m", "addrtype",
"--dst-type", "LOCAL"} "--dst-type", "LOCAL",
"-j", c.Name}
if !hairpinMode { if !hairpinMode {
output = append(output, "!", "--dst", "127.0.0.0/8") output = append(output, "!", "--dst", "127.0.0.0/8")
} }
@ -228,7 +230,7 @@ func (c *Chain) Prerouting(action Action, args ...string) error {
if len(args) > 0 { if len(args) > 0 {
a = append(a, args...) a = append(a, args...)
} }
if output, err := Raw(append(a, "-j", c.Name)...); err != nil { if output, err := Raw(a...); err != nil {
return err return err
} else if len(output) != 0 { } else if len(output) != 0 {
return ChainError{Chain: "PREROUTING", Output: output} return ChainError{Chain: "PREROUTING", Output: output}
@ -242,7 +244,7 @@ func (c *Chain) Output(action Action, args ...string) error {
if len(args) > 0 { if len(args) > 0 {
a = append(a, args...) a = append(a, args...)
} }
if output, err := Raw(append(a, "-j", c.Name)...); err != nil { if output, err := Raw(a...); err != nil {
return err return err
} else if len(output) != 0 { } else if len(output) != 0 {
return ChainError{Chain: "OUTPUT", Output: output} return ChainError{Chain: "OUTPUT", Output: output}
@ -254,9 +256,9 @@ func (c *Chain) Output(action Action, args ...string) error {
func (c *Chain) Remove() error { func (c *Chain) Remove() error {
// Ignore errors - This could mean the chains were never set up // Ignore errors - This could mean the chains were never set up
if c.Table == Nat { if c.Table == Nat {
c.Prerouting(Delete, "-m", "addrtype", "--dst-type", "LOCAL") c.Prerouting(Delete, "-m", "addrtype", "--dst-type", "LOCAL", "-j", c.Name)
c.Output(Delete, "-m", "addrtype", "--dst-type", "LOCAL", "!", "--dst", "127.0.0.0/8") c.Output(Delete, "-m", "addrtype", "--dst-type", "LOCAL", "!", "--dst", "127.0.0.0/8", "-j", c.Name)
c.Output(Delete, "-m", "addrtype", "--dst-type", "LOCAL") // Created in versions <= 0.1.6 c.Output(Delete, "-m", "addrtype", "--dst-type", "LOCAL", "-j", c.Name) // Created in versions <= 0.1.6
c.Prerouting(Delete) c.Prerouting(Delete)
c.Output(Delete) c.Output(Delete)

18
libnetwork/iptables/iptables_test.go
View file

@ -131,16 +131,11 @@ func TestPrerouting(t *testing.T) {
t.Fatal(err) t.Fatal(err)
} }
rule := []string{ if !Exists(natChain.Table, "PREROUTING", args...) {
"-j", natChain.Name}
rule = append(rule, args...)
if !Exists(natChain.Table, "PREROUTING", rule...) {
t.Fatalf("rule does not exist") t.Fatalf("rule does not exist")
} }
delRule := append([]string{"-D", "PREROUTING", "-t", string(Nat)}, rule...) delRule := append([]string{"-D", "PREROUTING", "-t", string(Nat)}, args...)
if _, err = Raw(delRule...); err != nil { if _, err = Raw(delRule...); err != nil {
t.Fatal(err) t.Fatal(err)
} }
@ -156,17 +151,12 @@ func TestOutput(t *testing.T) {
t.Fatal(err) t.Fatal(err)
} }
rule := []string{ if !Exists(natChain.Table, "OUTPUT", args...) {
"-j", natChain.Name}
rule = append(rule, args...)
if !Exists(natChain.Table, "OUTPUT", rule...) {
t.Fatalf("rule does not exist") t.Fatalf("rule does not exist")
} }
delRule := append([]string{"-D", "OUTPUT", "-t", delRule := append([]string{"-D", "OUTPUT", "-t",
string(natChain.Table)}, rule...) string(natChain.Table)}, args...)
if _, err = Raw(delRule...); err != nil { if _, err = Raw(delRule...); err != nil {
t.Fatal(err) t.Fatal(err)
} }