0ct0pu5/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

libnetwork/iptables: implement addInterface/delInterface methods

Browse source 
Move the implementation from AddInterfaceFirewalld and DelInterfaceFirewalld
to a method on firewalldConnection, but keeping the exported utility-functions.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
Sebastiaan van Stijn 2023-08-15 20:03:55 +02:00
parent da8d51ddbd
commit 3721ef11bb
No known key found for this signature in database
GPG key ID: 76698F39D527CE8C
3 changed files with 32 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
libnetwork/iptables/firewalld.go
View file

@ -268,16 +268,16 @@ func (fwd *firewalldConnection) setupDockerZone() error {
return nil
}
// AddInterfaceFirewalld adds the interface to the trusted zone. It is a
// no-op if firewalld is not running.
func AddInterfaceFirewalld(intf string) error {
if !firewalld.isRunning() {
// addInterface adds the interface to the trusted zone. It is a no-op if
// firewalld is not running or firewalldConnection not initialized.
func (fwd *firewalldConnection) addInterface(intf string) error {
if !fwd.isRunning() {
return nil
}
var intfs []string
// Check if interface is already added to the zone
if err := firewalld.sysObj.Call(dbusInterface+".zone.getInterfaces", 0, dockerZone).Store(&intfs); err != nil {
if err := fwd.sysObj.Call(dbusInterface+".zone.getInterfaces", 0, dockerZone).Store(&intfs); err != nil {
return err
}
// Return if interface is already part of the zone
@ -288,16 +288,16 @@ func AddInterfaceFirewalld(intf string) error {
log.G(context.TODO()).Debugf("Firewalld: adding %s interface to %s zone", intf, dockerZone)
// Runtime
if err := firewalld.sysObj.Call(dbusInterface+".zone.addInterface", 0, dockerZone, intf).Err; err != nil {
if err := fwd.sysObj.Call(dbusInterface+".zone.addInterface", 0, dockerZone, intf).Err; err != nil {
return err
}
return nil
}
// DelInterfaceFirewalld removes the interface from the trusted zone It is a
// no-op if firewalld is not running.
func DelInterfaceFirewalld(intf string) error {
if !firewalld.isRunning() {
// delInterface removes the interface from the trusted zone It is a no-op if
// firewalld is not running or firewalldConnection not initialized.
func (fwd *firewalldConnection) delInterface(intf string) error {
if !fwd.isRunning() {
return nil
}
@ -319,6 +319,18 @@ func DelInterfaceFirewalld(intf string) error {
return nil
}
// AddInterfaceFirewalld adds the interface to the trusted zone. It is a
// no-op if firewalld is not running.
func AddInterfaceFirewalld(intf string) error {
return firewalld.addInterface(intf)
}
// DelInterfaceFirewalld removes the interface from the trusted zone It is a
// no-op if firewalld is not running.
func DelInterfaceFirewalld(intf string) error {
return firewalld.delInterface(intf)
}
type interfaceNotFound struct{ error }
func (interfaceNotFound) NotFound() {}

8
libnetwork/iptables/firewalld_test.go
View file

@ -112,4 +112,12 @@ func TestFirewalldUninitialized(t *testing.T) {
if fwd.isRunning() {
t.Error("did not expect an uninitialized firewalldConnection to be running")
}
err := fwd.addInterface("anything")
if err != nil {
t.Errorf("unexpected error when calling addInterface on an uninitialized firewalldConnection: %v", err)
}
err = fwd.delInterface("anything")
if err != nil {
t.Errorf("unexpected error when calling delInterface on an uninitialized firewalldConnection: %v", err)
}
}

4
libnetwork/iptables/iptables.go
View file

@ -206,11 +206,11 @@ func (iptable IPTable) ProgramChain(c *ChainInfo, bridgeName string, hairpinMode
// Either add or remove the interface from the firewalld zone, if firewalld is running.
if enable {
if err := AddInterfaceFirewalld(bridgeName); err != nil {
if err := firewalld.addInterface(bridgeName); err != nil {
return err
}
} else {
if err := DelInterfaceFirewalld(bridgeName); err != nil && !errdefs.IsNotFound(err) {
if err := firewalld.delInterface(bridgeName); err != nil && !errdefs.IsNotFound(err) {
return err
}
}