beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

libnetwork/iptables: move IPTable.LoopbackByVersion() to a utility

Browse source 
Not critical, but when used from ChainInfo, we had to construct an IPTable
based on the version of the ChainInfo, which then only used the version
we passed to get the right loopback.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
Sebastiaan van Stijn 2023-07-05 16:31:16 +02:00
parent aad2dbb93d
commit ddd33c6bbd
No known key found for this signature in database
GPG key ID: 76698F39D527CE8C
1 changed files with 16 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
libnetwork/iptables/iptables.go
View file

@ -94,6 +94,19 @@ func (e ChainError) Error() string {
return fmt.Sprintf("error iptables %s: %s", e.Chain, string(e.Output))
}
// loopbackAddress returns the loopback address for the given IP version.
func loopbackAddress(version IPVersion) string {
switch version {
case IPv4, "":
// IPv4 (default for backward-compatibility)
return "127.0.0.0/8"
case IPv6:
return "::1/128"
default:
panic("unknown IP version: " + version)
}
}
func detectIptables() {
path, err := exec.LookPath("iptables")
if err != nil {
@ -183,14 +196,6 @@ func (iptable IPTable) NewChain(name string, table Table, hairpinMode bool) (*Ch
}, nil
}
// LoopbackByVersion returns loopback address by version
func (iptable IPTable) LoopbackByVersion() string {
if iptable.ipVersion == IPv6 {
return "::1/128"
}
return "127.0.0.0/8"
}
// ProgramChain is used to add rules to a chain
func (iptable IPTable) ProgramChain(c *ChainInfo, bridgeName string, hairpinMode, enable bool) error {
if c.Name == "" {
@ -232,7 +237,7 @@ func (iptable IPTable) ProgramChain(c *ChainInfo, bridgeName string, hairpinMode
"-j", c.Name,
}
if !hairpinMode {
output = append(output, "!", "--dst", iptable.LoopbackByVersion())
output = append(output, "!", "--dst", loopbackAddress(iptable.ipVersion))
}
if !iptable.Exists(Nat, "OUTPUT", output...) && enable {
if err := c.Output(Append, output...); err != nil {
@ -443,15 +448,15 @@ func (c *ChainInfo) Output(action Action, args ...string) error {
// Remove removes the chain.
func (c *ChainInfo) Remove() error {
iptable := GetIptable(c.IPVersion)
// Ignore errors - This could mean the chains were never set up
if c.Table == Nat {
_ = c.Prerouting(Delete, "-m", "addrtype", "--dst-type", "LOCAL", "-j", c.Name)
_ = c.Output(Delete, "-m", "addrtype", "--dst-type", "LOCAL", "!", "--dst", iptable.LoopbackByVersion(), "-j", c.Name)
_ = c.Output(Delete, "-m", "addrtype", "--dst-type", "LOCAL", "!", "--dst", loopbackAddress(c.IPVersion), "-j", c.Name)
_ = c.Output(Delete, "-m", "addrtype", "--dst-type", "LOCAL", "-j", c.Name) // Created in versions <= 0.1.6
_ = c.Prerouting(Delete)
_ = c.Output(Delete)
}
iptable := GetIptable(c.IPVersion)
_, _ = iptable.Raw("-t", string(c.Table), "-F", c.Name)
_, _ = iptable.Raw("-t", string(c.Table), "-X", c.Name)
return nil