resolver_unix.go 2.2 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162
  1. //go:build !windows
  2. // +build !windows
  3. package libnetwork
  4. import (
  5. "net"
  6. "github.com/docker/docker/libnetwork/iptables"
  7. "github.com/sirupsen/logrus"
  8. )
  9. const (
  10. // outputChain used for docker embed dns
  11. outputChain = "DOCKER_OUTPUT"
  12. //postroutingchain used for docker embed dns
  13. postroutingchain = "DOCKER_POSTROUTING"
  14. )
  15. func (r *resolver) setupIPTable() error {
  16. if r.err != nil {
  17. return r.err
  18. }
  19. laddr := r.conn.LocalAddr().String()
  20. ltcpaddr := r.tcpListen.Addr().String()
  21. resolverIP, ipPort, _ := net.SplitHostPort(laddr)
  22. _, tcpPort, _ := net.SplitHostPort(ltcpaddr)
  23. rules := [][]string{
  24. {"-t", "nat", "-I", outputChain, "-d", resolverIP, "-p", "udp", "--dport", dnsPort, "-j", "DNAT", "--to-destination", laddr},
  25. {"-t", "nat", "-I", postroutingchain, "-s", resolverIP, "-p", "udp", "--sport", ipPort, "-j", "SNAT", "--to-source", ":" + dnsPort},
  26. {"-t", "nat", "-I", outputChain, "-d", resolverIP, "-p", "tcp", "--dport", dnsPort, "-j", "DNAT", "--to-destination", ltcpaddr},
  27. {"-t", "nat", "-I", postroutingchain, "-s", resolverIP, "-p", "tcp", "--sport", tcpPort, "-j", "SNAT", "--to-source", ":" + dnsPort},
  28. }
  29. return r.backend.ExecFunc(func() {
  30. // TODO IPv6 support
  31. iptable := iptables.GetIptable(iptables.IPv4)
  32. // insert outputChain and postroutingchain
  33. err := iptable.RawCombinedOutputNative("-t", "nat", "-C", "OUTPUT", "-d", resolverIP, "-j", outputChain)
  34. if err == nil {
  35. iptable.RawCombinedOutputNative("-t", "nat", "-F", outputChain)
  36. } else {
  37. iptable.RawCombinedOutputNative("-t", "nat", "-N", outputChain)
  38. iptable.RawCombinedOutputNative("-t", "nat", "-I", "OUTPUT", "-d", resolverIP, "-j", outputChain)
  39. }
  40. err = iptable.RawCombinedOutputNative("-t", "nat", "-C", "POSTROUTING", "-d", resolverIP, "-j", postroutingchain)
  41. if err == nil {
  42. iptable.RawCombinedOutputNative("-t", "nat", "-F", postroutingchain)
  43. } else {
  44. iptable.RawCombinedOutputNative("-t", "nat", "-N", postroutingchain)
  45. iptable.RawCombinedOutputNative("-t", "nat", "-I", "POSTROUTING", "-d", resolverIP, "-j", postroutingchain)
  46. }
  47. for _, rule := range rules {
  48. if iptable.RawCombinedOutputNative(rule...) != nil {
  49. logrus.Errorf("set up rule failed, %v", rule)
  50. }
  51. }
  52. })
  53. }