From 23fd15985b47bba67e869d5c7d239effaebcfe25 Mon Sep 17 00:00:00 2001 From: Rob Murray Date: Wed, 24 Apr 2024 12:31:15 +0100 Subject: [PATCH] Allow "--ip6tables=true" when "--iptables=false" The bridge driver's setupIPChains() had an initial sanity check that "--iptables=true". But, it's called with "version=IPv6" when "--iptables=false" and "--ip6tables=true" - the sanity test needed to allow for that. Signed-off-by: Rob Murray --- libnetwork/drivers/bridge/bridge_linux_test.go | 6 +++++- libnetwork/drivers/bridge/setup_ip_tables_linux.go | 7 +++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/libnetwork/drivers/bridge/bridge_linux_test.go b/libnetwork/drivers/bridge/bridge_linux_test.go index bf8da3c2c1..2ea61a7796 100644 --- a/libnetwork/drivers/bridge/bridge_linux_test.go +++ b/libnetwork/drivers/bridge/bridge_linux_test.go @@ -1126,9 +1126,13 @@ func TestCleanupIptableRules(t *testing.T) { } ipVersions := []iptables.IPVersion{iptables.IPv4, iptables.IPv6} + configs := map[iptables.IPVersion]configuration{ + iptables.IPv4: {EnableIPTables: true}, + iptables.IPv6: {EnableIP6Tables: true}, + } for _, version := range ipVersions { - if _, _, _, _, err := setupIPChains(configuration{EnableIPTables: true}, version); err != nil { + if _, _, _, _, err := setupIPChains(configs[version], version); err != nil { t.Fatalf("Error setting up ip chains for %s: %v", version, err) } diff --git a/libnetwork/drivers/bridge/setup_ip_tables_linux.go b/libnetwork/drivers/bridge/setup_ip_tables_linux.go index 328c58bced..631c8df730 100644 --- a/libnetwork/drivers/bridge/setup_ip_tables_linux.go +++ b/libnetwork/drivers/bridge/setup_ip_tables_linux.go @@ -34,8 +34,11 @@ const ( func setupIPChains(config configuration, version iptables.IPVersion) (natChain *iptables.ChainInfo, filterChain *iptables.ChainInfo, isolationChain1 *iptables.ChainInfo, isolationChain2 *iptables.ChainInfo, retErr error) { // Sanity check. - if !config.EnableIPTables { - return nil, nil, nil, nil, errors.New("cannot create new chains, EnableIPTable is disabled") + if version == iptables.IPv4 && !config.EnableIPTables { + return nil, nil, nil, nil, errors.New("cannot create new chains, iptables is disabled") + } + if version == iptables.IPv6 && !config.EnableIP6Tables { + return nil, nil, nil, nil, errors.New("cannot create new chains, ip6tables is disabled") } hairpinMode := !config.EnableUserlandProxy