moby/libnetwork/firewall_others.go

//go:build !linux

package libnetwork

func setupArrangeUserFilterRule(c *Controller) {}
func arrangeUserFilterRule()                   {}
func setupUserChain(ipVersion any) error       { return nil }
Update to Go 1.17.0, and gofmt with Go 1.17 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> 2021-08-23 13:14:53 +00:00			`//go:build !linux`
Add a filter chain to allow persistent rules Allow users to configure firewall policies in a way that persists docker operations/restarts. Docker will not delete or modify any pre-existing rules from the DOCKER-USER filter chain. This allows the user to create in advance any rules required to further restrict access from/to the containers. Fixes docker/docker#29184 Fixes docker/docker#23987 Related to docker/docker#24848 Signed-off-by: Jacob Wen <jian.w.wen@oracle.com> 2017-03-13 07:46:46 +00:00
			`package libnetwork`

libnetwork: return concrete-typed *Controller libnetwork.NetworkController is an interface with a single implementation. https://github.com/golang/go/wiki/CodeReviewComments#interfaces Signed-off-by: Cory Snider <csnider@mirantis.com> 2023-01-11 22:43:32 +00:00			`func setupArrangeUserFilterRule(c *Controller) {}`
DOCKER-USER chain not created when IPTableEnable=false. This fix addresses https://docker.atlassian.net/browse/ENGCORE-1115 Expected behaviors upon docker engine restarts: 1. IPTableEnable=true, DOCKER-USER chain present -- no change to DOCKER-USER chain 2. IPTableEnable=true, DOCKER-USER chain not present -- DOCKER-USER chain created and inserted top of FORWARD chain. 3. IPTableEnable=false, DOCKER-USER chain present -- no change to DOCKER-USER chain the rational is that DOCKER-USER is populated and may be used by end-user for purpose other than filtering docker container traffic. Thus even if IPTableEnable=false, docker engine does not touch pre-existing DOCKER-USER chain. 4. IPTableEnable=false, DOCKER-USER chain not present -- DOCKER-USER chain is not created. Signed-off-by: Su Wang <su.wang@docker.com> 2019-10-13 04:54:49 +00:00			`func arrangeUserFilterRule() {}`
libnetwork: arrangeUserFilterRule: don't return early commit ffd75c2e0cd791ba9e57f905677904590deb6921 updated this function to set up the DOCKER-USER chain for both iptables and ip6tables, however the function would return early if a failure happened (instead of continuing with the next iptables version). This patch extracts setting up the chain to a separate function, and updates arrangeUserFilterRule to log the failure as a warning, but continue with the next iptables version. Signed-off-by: Sebastiaan van Stijn <github@gone.nl> 2023-07-16 14:21:23 +00:00			`func setupUserChain(ipVersion any) error { return nil }`