0ct0pu5/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

libnet/d/overlay: clean up iptables rules on network delete

Browse source 
This commit removes iptables rules configured for secure overlay
networks when a network is deleted. Prior to this commit, only
CreateNetwork() was taking care of removing stale iptables rules.

If one of the iptables rule can't be removed, the erorr is logged but
it doesn't prevent network deletion.

Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This commit is contained in:
Albin Kerouanton 2023-04-17 00:39:22 +02:00
parent 5bf405b2af
commit 1e1efe1f61
No known key found for this signature in database
GPG key ID: 630B8E1DCBDB1864
1 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
libnetwork/drivers/overlay/ov_network.go
View file

@ -216,6 +216,25 @@ func (d *driver) DeleteNetwork(nid string) error {
doPeerFlush = true
delete(d.networks, nid)
if n.secure {
for _, s := range n.subnets {
if err := programMangle(s.vni, false); err != nil {
logrus.WithFields(logrus.Fields{
logrus.ErrorKey: err,
"network_id": n.id,
"subnet": s.subnetIP,
}).Warn("Failed to clean up iptables rules during overlay network deletion")
}
if err := programInput(s.vni, false); err != nil {
logrus.WithFields(logrus.Fields{
logrus.ErrorKey: err,
"network_id": n.id,
"subnet": s.subnetIP,
}).Warn("Failed to clean up iptables rules during overlay network deletion")
}
}
}
return nil
}