From e5812117a594f59d4a775b27f9ba6f95113cbf29 Mon Sep 17 00:00:00 2001 From: Vincent Bernat Date: Wed, 23 Mar 2022 08:34:26 +0100 Subject: [PATCH] bridge: also flush conntrack entries when setting up endpoints There is a race condition between the local proxy and iptables rule setting. When we have a lot of UDP traffic, the kernel will create conntrack entries to the local proxy and will ignore the iptables rules set after that. Related to PR #32505. Fix #8795. Signed-off-by: Vincent Bernat --- libnetwork/drivers/bridge/bridge.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libnetwork/drivers/bridge/bridge.go b/libnetwork/drivers/bridge/bridge.go index 0c7811c1ef..0a886fe2b4 100644 --- a/libnetwork/drivers/bridge/bridge.go +++ b/libnetwork/drivers/bridge/bridge.go @@ -1352,6 +1352,11 @@ func (d *driver) ProgramExternalConnectivity(nid, eid string, options map[string } }() + // Clean the connection tracker state of the host for the + // specific endpoint. This is needed because some flows may be + // bound to the local proxy and won't bre redirect to the new endpoints. + clearEndpointConnections(d.nlh, endpoint) + if err = d.storeUpdate(endpoint); err != nil { return fmt.Errorf("failed to update bridge endpoint %.7s to store: %v", endpoint.id, err) }