beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #46214 from thaJeztah/24.0_backport_allow-all-ipv6-icc

Browse source 
[24.0 backport] libnet/d/bridge: Allow IPv6 ICC from any IP address
This commit is contained in:
Bjorn Neergaard 2023-08-15 16:07:36 -06:00 committed by GitHub
commit f1cc5760d9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
libnetwork/drivers/bridge/setup_ip_tables.go
View file

@ -397,15 +397,21 @@ func removeIPChains(version iptables.IPVersion) {
}
func setupInternalNetworkRules(bridgeIface string, addr *net.IPNet, icc, insert bool) error {
var (
inDropRule = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{"-i", bridgeIface, "!", "-d", addr.String(), "-j", "DROP"}}
outDropRule = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{"-o", bridgeIface, "!", "-s", addr.String(), "-j", "DROP"}}
)
var version iptables.IPVersion
var inDropRule, outDropRule iptRule
version := iptables.IPv4
if addr.IP.To4() == nil {
if addr.IP.To4() != nil {
version = iptables.IPv4
inDropRule = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{
"-i", bridgeIface, "!", "-d", addr.String(), "-j", "DROP"}}
outDropRule = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{
"-o", bridgeIface, "!", "-s", addr.String(), "-j", "DROP"}}
} else {
version = iptables.IPv6
inDropRule = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{
"-i", bridgeIface, "!", "-o", bridgeIface, "!", "-d", addr.String(), "-j", "DROP"}}
outDropRule = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{
"!", "-i", bridgeIface, "-o", bridgeIface, "!", "-s", addr.String(), "-j", "DROP"}}
}
if err := programChainRule(version, inDropRule, "DROP INCOMING", insert); err != nil {
@ -414,6 +420,7 @@ func setupInternalNetworkRules(bridgeIface string, addr *net.IPNet, icc, insert
if err := programChainRule(version, outDropRule, "DROP OUTGOING", insert); err != nil {
return err
}
// Set Inter Container Communication.
return setIcc(version, bridgeIface, icc, insert)
}