From a836506d193bd1e3e307bbb0b4ad220e1fd27476 Mon Sep 17 00:00:00 2001 From: CarsonLenze Date: Tue, 21 Apr 2026 00:18:11 -0400 Subject: [PATCH] Change Conntrack to delete by Both Port And IP Signed-off-by: CarsonLenze Change to use PortBinding Signed-off-by: CarsonLenze --- .../libnetwork/drivers/bridge/bridge_linux.go | 4 ++-- daemon/libnetwork/iptables/conntrack.go | 18 ++++++++++-------- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/daemon/libnetwork/drivers/bridge/bridge_linux.go b/daemon/libnetwork/drivers/bridge/bridge_linux.go index b2cde11244..3ed1182345 100644 --- a/daemon/libnetwork/drivers/bridge/bridge_linux.go +++ b/daemon/libnetwork/drivers/bridge/bridge_linux.go @@ -1664,7 +1664,7 @@ func (ep *bridgeEndpoint) trimPortBindings(ctx context.Context, n *bridgeNetwork func clearConntrackEntries(nlh nlwrap.Handle, ep *bridgeEndpoint) { var ipv4List []net.IP var ipv6List []net.IP - var udpPorts []uint16 + var udpPorts []types.PortBinding if ep.addr != nil { ipv4List = append(ipv4List, ep.addr.IP) @@ -1674,7 +1674,7 @@ func clearConntrackEntries(nlh nlwrap.Handle, ep *bridgeEndpoint) { } for _, pb := range ep.portMapping { if pb.Proto == types.UDP { - udpPorts = append(udpPorts, pb.HostPort) + udpPorts = append(udpPorts, pb.PortBinding) } } diff --git a/daemon/libnetwork/iptables/conntrack.go b/daemon/libnetwork/iptables/conntrack.go index 081f6257ca..e4d3ffbd3c 100644 --- a/daemon/libnetwork/iptables/conntrack.go +++ b/daemon/libnetwork/iptables/conntrack.go @@ -57,34 +57,36 @@ func DeleteConntrackEntries(nlh nlwrap.Handle, ipv4List []net.IP, ipv6List []net return nil } -func DeleteConntrackEntriesByPort(nlh nlwrap.Handle, proto types.Protocol, ports []uint16) error { +func DeleteConntrackEntriesByPort(nlh nlwrap.Handle, proto types.Protocol, ports []types.PortBinding) error { if err := checkConntrackProgrammable(nlh); err != nil { return err } - var totalIPv4FlowPurged uint var totalIPv6FlowPurged uint - for _, port := range ports { filter := &netlink.ConntrackFilter{} if err := filter.AddProtocol(uint8(proto)); err != nil { - log.G(context.TODO()).Warnf("Failed to delete conntrack state for %s port %d: %v", proto.String(), port, err) + log.G(context.TODO()).Warnf("Failed to delete conntrack state for %s port %d: %v", proto.String(), port.Port, err) continue } - if err := filter.AddPort(netlink.ConntrackOrigDstPort, port); err != nil { - log.G(context.TODO()).Warnf("Failed to delete conntrack state for %s port %d: %v", proto.String(), port, err) + if err := filter.AddPort(netlink.ConntrackOrigDstPort, port.Port); err != nil { + log.G(context.TODO()).Warnf("Failed to delete conntrack state for %s port %d: %v", proto.String(), port.Port, err) + continue + } + if err := filter.AddIP(netlink.ConntrackOrigDstIP, port.HostIP); err != nil { + log.G(context.TODO()).Warnf("Failed to delete conntrack state for %s port %d: %v", proto.String(), port.Port, err) continue } v4FlowPurged, err := nlh.ConntrackDeleteFilters(netlink.ConntrackTable, syscall.AF_INET, filter) if err != nil { - log.G(context.TODO()).Warnf("Failed to delete conntrack state for IPv4 %s port %d: %v", proto.String(), port, err) + log.G(context.TODO()).Warnf("Failed to delete conntrack state for IPv4 %s port %d: %v", proto.String(), port.Port, err) } totalIPv4FlowPurged += v4FlowPurged v6FlowPurged, err := nlh.ConntrackDeleteFilters(netlink.ConntrackTable, syscall.AF_INET6, filter) if err != nil { - log.G(context.TODO()).Warnf("Failed to delete conntrack state for IPv6 %s port %d: %v", proto.String(), port, err) + log.G(context.TODO()).Warnf("Failed to delete conntrack state for IPv6 %s port %d: %v", proto.String(), port.Port, err) } totalIPv6FlowPurged += v6FlowPurged }