dilim/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-08-08 00:52:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow "--ip6tables=true" when "--iptables=false"

Browse Source 
The bridge driver's setupIPChains() had an initial sanity check that
"--iptables=true".

But, it's called with "version=IPv6" when "--iptables=false" and
"--ip6tables=true" - the sanity test needed to allow for that.

Signed-off-by: Rob Murray <rob.murray@docker.com>
This commit is contained in:
Rob Murray
2024-04-24 12:31:15 +01:00
parent 9a8ffe38fc
commit 23fd15985b
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libnetwork/drivers/bridge/bridge_linux_test.go
View File

@@ -1126,9 +1126,13 @@ func TestCleanupIptableRules(t *testing.T) {
}
ipVersions := []iptables.IPVersion{iptables.IPv4, iptables.IPv6}
configs := map[iptables.IPVersion]configuration{
iptables.IPv4: {EnableIPTables: true},
iptables.IPv6: {EnableIP6Tables: true},
}
for _, version := range ipVersions {
if _, _, _, _, err := setupIPChains(configuration{EnableIPTables: true}, version); err != nil {
if _, _, _, _, err := setupIPChains(configs[version], version); err != nil {
t.Fatalf("Error setting up ip chains for %s: %v", version, err)
}

7
libnetwork/drivers/bridge/setup_ip_tables_linux.go
View File

@@ -34,8 +34,11 @@ const (
func setupIPChains(config configuration, version iptables.IPVersion) (natChain *iptables.ChainInfo, filterChain *iptables.ChainInfo, isolationChain1 *iptables.ChainInfo, isolationChain2 *iptables.ChainInfo, retErr error) {
// Sanity check.
if !config.EnableIPTables {
return nil, nil, nil, nil, errors.New("cannot create new chains, EnableIPTable is disabled")
if version == iptables.IPv4 && !config.EnableIPTables {
return nil, nil, nil, nil, errors.New("cannot create new chains, iptables is disabled")
}
if version == iptables.IPv6 && !config.EnableIP6Tables {
return nil, nil, nil, nil, errors.New("cannot create new chains, ip6tables is disabled")
}
hairpinMode := !config.EnableUserlandProxy