From defcd4afb9aa58569cd493df20fc41dabaf7c025 Mon Sep 17 00:00:00 2001 From: Alessandro Boch Date: Fri, 5 Feb 2016 10:34:48 -0800 Subject: [PATCH] Change in programming iptables in container - iptables to provide a native API - resolver.go to invoke the iptables native API when programming tables in the container Signed-off-by: Alessandro Boch --- libnetwork/iptables/iptables.go | 13 ++++++++++++- libnetwork/resolver.go | 2 +- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/libnetwork/iptables/iptables.go b/libnetwork/iptables/iptables.go index b97292225f..ca07893888 100644 --- a/libnetwork/iptables/iptables.go +++ b/libnetwork/iptables/iptables.go @@ -325,9 +325,11 @@ func Raw(args ...string) ([]byte, error) { if err == nil || !strings.Contains(err.Error(), "was not provided by any .service files") { return output, err } - } + return raw(args...) +} +func raw(args ...string) ([]byte, error) { if err := initCheck(); err != nil { return nil, err } @@ -362,6 +364,15 @@ func RawCombinedOutput(args ...string) error { return nil } +// RawCombinedOutputNative behave as RawCombinedOutput with the difference it +// will always invoke `iptables` binary +func RawCombinedOutputNative(args ...string) error { + if output, err := raw(args...); err != nil || len(output) != 0 { + return fmt.Errorf("%s (%v)", string(output), err) + } + return nil +} + // ExistChain checks if a chain exists func ExistChain(chain string, table Table) bool { if _, err := Raw("-t", string(table), "-L", chain); err == nil { diff --git a/libnetwork/resolver.go b/libnetwork/resolver.go index a839298491..01d3483f08 100644 --- a/libnetwork/resolver.go +++ b/libnetwork/resolver.go @@ -95,7 +95,7 @@ func (r *resolver) SetupFunc() func() { } for _, rule := range rules { - r.err = iptables.RawCombinedOutput(rule...) + r.err = iptables.RawCombinedOutputNative(rule...) if r.err != nil { return }