From 268e636b2bcd4cda879d59b14f9f7ff24dbfd9e9 Mon Sep 17 00:00:00 2001 From: Albin Kerouanton Date: Wed, 6 Aug 2025 11:02:32 +0200 Subject: [PATCH] libnet/pmapi: let portmappers specify NAT/fwding rules Add two new fields to portmapperapi.PortBinding: NAT and Forwarding. These can be used by portmappers to specify how they want their callers (e.g. bridge driver) to reconfigure the host firewall to NAT a host port, or allow forwarding to the container port. If portmappers don't want to opt-in to these, they can implement their own firewall rules, and not fill these fields. Signed-off-by: Albin Kerouanton --- daemon/libnetwork/portmapperapi/api.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/daemon/libnetwork/portmapperapi/api.go b/daemon/libnetwork/portmapperapi/api.go index 932a70feac..d161a068da 100644 --- a/daemon/libnetwork/portmapperapi/api.go +++ b/daemon/libnetwork/portmapperapi/api.go @@ -92,9 +92,25 @@ func (pbReq PortBindingReq) Compare(other PortBindingReq) int { } type PortBinding struct { + // PortBinding contains the port binding information reported through the + // Engine API. types.PortBinding // Mapper is the name of the port mapper used to process this PortBinding. Mapper string + + // NAT represents the host IP and port that should be NATed to the + // container IP and port specified in types.PortBinding. When set, callers + // of the port mapper should reconfigure the host firewall. When it's not + // set, callers won't reconfigure the host firewall. + // + // If the address is invalid, or a non-unicast address, or the port is 0, + // it's treated as an error. If both Forwarding and NAT are specified, NAT + // takes precedence. + NAT netip.AddrPort + // Forwarding indicates whether callers of the port mapper should update + // the host firewall to allow traffic forwarding to IP:Port. + Forwarding bool + // BoundSocket is used to reserve a host port for the binding. If the // userland proxy is in-use, it's passed to the proxy when the proxy is // started, then it's closed and set to nil here.