0ct0pu5/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #45649 from akerouanton/allow-all-ipv6-icc

Browse source 
libnet/d/bridge: Allow IPv6 ICC from any IP address
This commit is contained in:
Albin Kerouanton 2023-07-27 19:41:55 +02:00 • committed by GitHub
commit 2870559b2c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
libnetwork/drivers/bridge/setup_ip_tables.go
View file

@ -396,15 +396,21 @@ func removeIPChains(version iptables.IPVersion) {
}
func setupInternalNetworkRules(bridgeIface string, addr *net.IPNet, icc, insert bool) error {
var (
inDropRule = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{"-i", bridgeIface, "!", "-d", addr.String(), "-j", "DROP"}}
outDropRule = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{"-o", bridgeIface, "!", "-s", addr.String(), "-j", "DROP"}}
)
var version iptables.IPVersion
var inDropRule, outDropRule iptRule
version := iptables.IPv4
if addr.IP.To4() == nil {
if addr.IP.To4() != nil {
version = iptables.IPv4
inDropRule = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{
"-i", bridgeIface, "!", "-d", addr.String(), "-j", "DROP"}}
outDropRule = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{
"-o", bridgeIface, "!", "-s", addr.String(), "-j", "DROP"}}
} else {
version = iptables.IPv6
inDropRule = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{
"-i", bridgeIface, "!", "-o", bridgeIface, "!", "-d", addr.String(), "-j", "DROP"}}
outDropRule = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{
"!", "-i", bridgeIface, "-o", bridgeIface, "!", "-s", addr.String(), "-j", "DROP"}}
}
if err := programChainRule(version, inDropRule, "DROP INCOMING", insert); err != nil {
@ -413,6 +419,7 @@ func setupInternalNetworkRules(bridgeIface string, addr *net.IPNet, icc, insert
if err := programChainRule(version, outDropRule, "DROP OUTGOING", insert); err != nil {
return err
}
// Set Inter Container Communication.
return setIcc(version, bridgeIface, icc, insert)
}