f9c68e5fbc
Resolver.setupIPTable() checks whether it needs to flush or create the user chains used for NATing container DNS requests by testing for the existence of the rules which jump to said user chains. Unfortunately it does so using the IPTable.RawCombinedOutputNative() method, which returns a non-nil error if the iptables command returns any output even if the command exits with a zero status code. While that is fine with iptables-legacy as it prints no output if the rule exists, iptables-nft v1.8.7 prints some information about the rule. Consequently, Resolver.setupIPTable() would incorrectly think that the rule does not exist during container restore and attempt to create it. This happened work work by coincidence before8f5a9a741bbecause the failure to create the already-existing table would be ignored and the new NAT rules would be inserted before the stale rules left in the table from when the container was last started/restored. Now that failing to create the table is treated as a fatal error, the incompatibility with iptables-nft is no longer hidden. Switch to using IPTable.ExistsNative() to test for the existence of the jump rules as it correctly only checks the iptables command's exit status without regard for whether it outputs anything. Signed-off-by: Cory Snider <csnider@mirantis.com> (cherry picked from commit1178319313) Signed-off-by: Cory Snider <csnider@mirantis.com>
84 lines
2.5 KiB
Go
84 lines
2.5 KiB
Go
//go:build !windows
|
|
// +build !windows
|
|
|
|
package libnetwork
|
|
|
|
import (
|
|
"fmt"
|
|
"net"
|
|
|
|
"github.com/docker/docker/libnetwork/iptables"
|
|
)
|
|
|
|
const (
|
|
// output chain used for docker embedded DNS resolver
|
|
outputChain = "DOCKER_OUTPUT"
|
|
// postrouting chain used for docker embedded DNS resolver
|
|
postroutingChain = "DOCKER_POSTROUTING"
|
|
)
|
|
|
|
func (r *Resolver) setupIPTable() error {
|
|
if r.err != nil {
|
|
return r.err
|
|
}
|
|
laddr := r.conn.LocalAddr().String()
|
|
ltcpaddr := r.tcpListen.Addr().String()
|
|
resolverIP, ipPort, _ := net.SplitHostPort(laddr)
|
|
_, tcpPort, _ := net.SplitHostPort(ltcpaddr)
|
|
rules := [][]string{
|
|
{"-t", "nat", "-I", outputChain, "-d", resolverIP, "-p", "udp", "--dport", dnsPort, "-j", "DNAT", "--to-destination", laddr},
|
|
{"-t", "nat", "-I", postroutingChain, "-s", resolverIP, "-p", "udp", "--sport", ipPort, "-j", "SNAT", "--to-source", ":" + dnsPort},
|
|
{"-t", "nat", "-I", outputChain, "-d", resolverIP, "-p", "tcp", "--dport", dnsPort, "-j", "DNAT", "--to-destination", ltcpaddr},
|
|
{"-t", "nat", "-I", postroutingChain, "-s", resolverIP, "-p", "tcp", "--sport", tcpPort, "-j", "SNAT", "--to-source", ":" + dnsPort},
|
|
}
|
|
|
|
var setupErr error
|
|
err := r.backend.ExecFunc(func() {
|
|
// TODO IPv6 support
|
|
iptable := iptables.GetIptable(iptables.IPv4)
|
|
|
|
// insert outputChain and postroutingchain
|
|
if iptable.ExistsNative("nat", "OUTPUT", "-d", resolverIP, "-j", outputChain) {
|
|
if err := iptable.RawCombinedOutputNative("-t", "nat", "-F", outputChain); err != nil {
|
|
setupErr = err
|
|
return
|
|
}
|
|
} else {
|
|
if err := iptable.RawCombinedOutputNative("-t", "nat", "-N", outputChain); err != nil {
|
|
setupErr = err
|
|
return
|
|
}
|
|
if err := iptable.RawCombinedOutputNative("-t", "nat", "-I", "OUTPUT", "-d", resolverIP, "-j", outputChain); err != nil {
|
|
setupErr = err
|
|
return
|
|
}
|
|
}
|
|
|
|
if iptable.ExistsNative("nat", "POSTROUTING", "-d", resolverIP, "-j", postroutingChain) {
|
|
if err := iptable.RawCombinedOutputNative("-t", "nat", "-F", postroutingChain); err != nil {
|
|
setupErr = err
|
|
return
|
|
}
|
|
} else {
|
|
if err := iptable.RawCombinedOutputNative("-t", "nat", "-N", postroutingChain); err != nil {
|
|
setupErr = err
|
|
return
|
|
}
|
|
if err := iptable.RawCombinedOutputNative("-t", "nat", "-I", "POSTROUTING", "-d", resolverIP, "-j", postroutingChain); err != nil {
|
|
setupErr = err
|
|
return
|
|
}
|
|
}
|
|
|
|
for _, rule := range rules {
|
|
if iptable.RawCombinedOutputNative(rule...) != nil {
|
|
setupErr = fmt.Errorf("set up rule failed, %v", rule)
|
|
return
|
|
}
|
|
}
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return setupErr
|
|
}
|