mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
a0a473125b
After moving libnetwork to this repo, we need to update all the import paths for libnetwork to point to docker/docker/libnetwork instead of docker/libnetwork. This change implements that. Signed-off-by: Brian Goff <cpuguy83@gmail.com>
71 lines
2.2 KiB
Go
71 lines
2.2 KiB
Go
package bridge
|
|
|
|
import (
|
|
"fmt"
|
|
"io/ioutil"
|
|
|
|
"github.com/docker/docker/libnetwork/iptables"
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
const (
|
|
ipv4ForwardConf = "/proc/sys/net/ipv4/ip_forward"
|
|
ipv4ForwardConfPerm = 0644
|
|
)
|
|
|
|
func configureIPForwarding(enable bool) error {
|
|
var val byte
|
|
if enable {
|
|
val = '1'
|
|
}
|
|
return ioutil.WriteFile(ipv4ForwardConf, []byte{val, '\n'}, ipv4ForwardConfPerm)
|
|
}
|
|
|
|
func setupIPForwarding(enableIPTables bool, enableIP6Tables bool) error {
|
|
// Get current IPv4 forward setup
|
|
ipv4ForwardData, err := ioutil.ReadFile(ipv4ForwardConf)
|
|
if err != nil {
|
|
return fmt.Errorf("Cannot read IP forwarding setup: %v", err)
|
|
}
|
|
|
|
// Enable IPv4 forwarding only if it is not already enabled
|
|
if ipv4ForwardData[0] != '1' {
|
|
// Enable IPv4 forwarding
|
|
if err := configureIPForwarding(true); err != nil {
|
|
return fmt.Errorf("Enabling IP forwarding failed: %v", err)
|
|
}
|
|
// When enabling ip_forward set the default policy on forward chain to
|
|
// drop only if the daemon option iptables is not set to false.
|
|
if enableIPTables {
|
|
iptable := iptables.GetIptable(iptables.IPv4)
|
|
if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {
|
|
if err := configureIPForwarding(false); err != nil {
|
|
logrus.Errorf("Disabling IP forwarding failed, %v", err)
|
|
}
|
|
return err
|
|
}
|
|
iptables.OnReloaded(func() {
|
|
logrus.Debug("Setting the default DROP policy on firewall reload")
|
|
if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {
|
|
logrus.Warnf("Setting the default DROP policy on firewall reload failed, %v", err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// add only iptables rules - forwarding is handled by setupIPv6Forwarding in setup_ipv6
|
|
if enableIP6Tables {
|
|
iptable := iptables.GetIptable(iptables.IPv6)
|
|
if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {
|
|
logrus.Warnf("Setting the default DROP policy on firewall reload failed, %v", err)
|
|
}
|
|
iptables.OnReloaded(func() {
|
|
logrus.Debug("Setting the default DROP policy on firewall reload")
|
|
if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {
|
|
logrus.Warnf("Setting the default DROP policy on firewall reload failed, %v", err)
|
|
}
|
|
})
|
|
}
|
|
|
|
return nil
|
|
}
|