Explorar o código

Merge pull request #44811 from akerouanton/23.0-backport-44803

[23.0 backport] libnetwork: Remove iptables nat rule when hairpin is disabled
Bjorn Neergaard %!s(int64=2) %!d(string=hai) anos
pai
achega
7e4f58d894
Modificáronse 1 ficheiros con 4 adicións e 5 borrados
  1. 4 5
      libnetwork/drivers/bridge/setup_ip_tables.go

+ 4 - 5
libnetwork/drivers/bridge/setup_ip_tables.go

@@ -244,11 +244,10 @@ func setupIPTablesInternal(hostIP net.IP, bridgeIface string, addr *net.IPNet, i
 		}
 	}
 
-	// In hairpin mode, masquerade traffic from localhost
-	if hairpin {
-		if err := programChainRule(ipVersion, hpNatRule, "MASQ LOCAL HOST", enable); err != nil {
-			return err
-		}
+	// In hairpin mode, masquerade traffic from localhost. If hairpin is disabled or if we're tearing down
+	// that bridge, make sure the iptables rule isn't lying around.
+	if err := programChainRule(ipVersion, hpNatRule, "MASQ LOCAL HOST", enable && hairpin); err != nil {
+		return err
 	}
 
 	// Set Inter Container Communication.