beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add internal n/w bridge to firewalld docker zone

Browse source 
Containers attached to an 'internal' bridge network are unable to
communicate when the host is running firewalld.

Non-internal bridges are added to a trusted 'docker' firewalld zone, but
internal bridges were not.

DOCKER-ISOLATION iptables rules are still configured for an internal
network, they block traffic to/from addresses outside the network's subnet.

Signed-off-by: Rob Murray <rob.murray@docker.com>
(cherry picked from commit 2cc627932a)
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This commit is contained in:
Rob Murray 2024-02-01 11:49:53 +00:00 committed by Albin Kerouanton
parent a140d0d95f
commit 990e95dcf0
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
libnetwork/drivers/bridge/setup_ip_tables_linux.go
View file

@ -8,6 +8,7 @@ import (
"strings"
"github.com/containerd/log"
"github.com/docker/docker/errdefs"
"github.com/docker/docker/libnetwork/iptables"
"github.com/docker/docker/libnetwork/types"
"github.com/vishvananda/netlink"
@ -408,6 +409,17 @@ func setupInternalNetworkRules(bridgeIface string, addr *net.IPNet, icc, insert
var version iptables.IPVersion
var inDropRule, outDropRule iptRule
// Either add or remove the interface from the firewalld zone, if firewalld is running.
if insert {
if err := iptables.AddInterfaceFirewalld(bridgeIface); err != nil {
return err
}
} else {
if err := iptables.DelInterfaceFirewalld(bridgeIface); err != nil && !errdefs.IsNotFound(err) {
return err
}
}
if addr.IP.To4() != nil {
version = iptables.IPv4
inDropRule = iptRule{