17723691e5
This reverts commit 2d397beb00.
moby#44706 and moby#44805 were both merged, and both refactored the same
file. The combination broke the build, and was not detected in CI as
only the combination of the two, applied to the same parent commit,
caused the failure.
moby#44706 should be carried forward, based on the current master, in
order to resolve this conflict.
Signed-off-by: Bjorn Neergaard <bneergaard@mirantis.com>
44 lines
1.3 KiB
Go
44 lines
1.3 KiB
Go
package libnetwork
|
|
|
|
import (
|
|
"github.com/docker/docker/libnetwork/iptables"
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
const userChain = "DOCKER-USER"
|
|
|
|
var ctrl *Controller
|
|
|
|
func setupArrangeUserFilterRule(c *Controller) {
|
|
ctrl = c
|
|
iptables.OnReloaded(arrangeUserFilterRule)
|
|
}
|
|
|
|
// This chain allow users to configure firewall policies in a way that persists
|
|
// docker operations/restarts. Docker will not delete or modify any pre-existing
|
|
// rules from the DOCKER-USER filter chain.
|
|
// Note once DOCKER-USER chain is created, docker engine does not remove it when
|
|
// IPTableForwarding is disabled, because it contains rules configured by user that
|
|
// are beyond docker engine's control.
|
|
func arrangeUserFilterRule() {
|
|
if ctrl == nil || !ctrl.iptablesEnabled() {
|
|
return
|
|
}
|
|
// TODO IPv6 support
|
|
iptable := iptables.GetIptable(iptables.IPv4)
|
|
_, err := iptable.NewChain(userChain, iptables.Filter, false)
|
|
if err != nil {
|
|
logrus.Warnf("Failed to create %s chain: %v", userChain, err)
|
|
return
|
|
}
|
|
|
|
if err = iptable.AddReturnRule(userChain); err != nil {
|
|
logrus.Warnf("Failed to add the RETURN rule for %s: %v", userChain, err)
|
|
return
|
|
}
|
|
|
|
err = iptable.EnsureJumpRule("FORWARD", userChain)
|
|
if err != nil {
|
|
logrus.Warnf("Failed to ensure the jump rule for %s: %v", userChain, err)
|
|
}
|
|
}
|