dilim/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-08-05 15:40:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #52423 from CarsonLenze/master

Browse Source 
Change Conntrack to delete by Both Port And IP
This commit is contained in:
Sebastiaan van Stijn
2026-05-05 09:57:57 +02:00
committed by GitHub
parent ee7e401904 a836506d19
commit 0fef616242
2 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
daemon/libnetwork/drivers/bridge/bridge_linux.go
View File

@@ -1680,7 +1680,7 @@ func (ep *bridgeEndpoint) trimPortBindings(ctx context.Context, n *bridgeNetwork
func clearConntrackEntries(nlh nlwrap.Handle, ep *bridgeEndpoint) {
var ipv4List []net.IP
var ipv6List []net.IP
var udpPorts []uint16
var udpPorts []types.PortBinding
if ep.addr != nil {
ipv4List = append(ipv4List, ep.addr.IP)
@@ -1690,7 +1690,7 @@ func clearConntrackEntries(nlh nlwrap.Handle, ep *bridgeEndpoint) {
}
for _, pb := range ep.portMapping {
if pb.Proto == types.UDP {
udpPorts = append(udpPorts, pb.HostPort)
udpPorts = append(udpPorts, pb.PortBinding)
}
}

18
daemon/libnetwork/iptables/conntrack.go
View File

@@ -57,34 +57,36 @@ func DeleteConntrackEntries(nlh nlwrap.Handle, ipv4List []net.IP, ipv6List []net
return nil
}
func DeleteConntrackEntriesByPort(nlh nlwrap.Handle, proto types.Protocol, ports []uint16) error {
func DeleteConntrackEntriesByPort(nlh nlwrap.Handle, proto types.Protocol, ports []types.PortBinding) error {
if err := checkConntrackProgrammable(nlh); err != nil {
return err
}
var totalIPv4FlowPurged uint
var totalIPv6FlowPurged uint
for _, port := range ports {
filter := &netlink.ConntrackFilter{}
if err := filter.AddProtocol(uint8(proto)); err != nil {
log.G(context.TODO()).Warnf("Failed to delete conntrack state for %s port %d: %v", proto.String(), port, err)
log.G(context.TODO()).Warnf("Failed to delete conntrack state for %s port %d: %v", proto.String(), port.Port, err)
continue
}
if err := filter.AddPort(netlink.ConntrackOrigDstPort, port); err != nil {
log.G(context.TODO()).Warnf("Failed to delete conntrack state for %s port %d: %v", proto.String(), port, err)
if err := filter.AddPort(netlink.ConntrackOrigDstPort, port.Port); err != nil {
log.G(context.TODO()).Warnf("Failed to delete conntrack state for %s port %d: %v", proto.String(), port.Port, err)
continue
}
if err := filter.AddIP(netlink.ConntrackOrigDstIP, port.HostIP); err != nil {
log.G(context.TODO()).Warnf("Failed to delete conntrack state for %s port %d: %v", proto.String(), port.Port, err)
continue
}
v4FlowPurged, err := nlh.ConntrackDeleteFilters(netlink.ConntrackTable, syscall.AF_INET, filter)
if err != nil {
log.G(context.TODO()).Warnf("Failed to delete conntrack state for IPv4 %s port %d: %v", proto.String(), port, err)
log.G(context.TODO()).Warnf("Failed to delete conntrack state for IPv4 %s port %d: %v", proto.String(), port.Port, err)
}
totalIPv4FlowPurged += v4FlowPurged
v6FlowPurged, err := nlh.ConntrackDeleteFilters(netlink.ConntrackTable, syscall.AF_INET6, filter)
if err != nil {
log.G(context.TODO()).Warnf("Failed to delete conntrack state for IPv6 %s port %d: %v", proto.String(), port, err)
log.G(context.TODO()).Warnf("Failed to delete conntrack state for IPv6 %s port %d: %v", proto.String(), port.Port, err)
}
totalIPv6FlowPurged += v6FlowPurged
}