From daeb080ff166d0d4241f84e85fcb70b5646350da Mon Sep 17 00:00:00 2001 From: Rob Murray Date: Mon, 17 Feb 2025 19:19:28 +0000 Subject: [PATCH] Test Iptabler params Signed-off-by: Rob Murray --- .../bridge/internal/iptabler/iptabler_test.go | 173 +++++++++++++++++- ...er_cleaned,hairpin=false__ip6tables.golden | 28 +++ ...ler_cleaned,hairpin=false__iptables.golden | 28 +++ ...ler_cleaned,hairpin=true__ip6tables.golden | 28 +++ ...bler_cleaned,hairpin=true__iptables.golden | 28 +++ ...lse,gwm=nat,bindlh=false__ip6tables.golden | 38 ++++ ...alse,gwm=nat,bindlh=false__iptables.golden | 38 ++++ ...alse,gwm=nat,bindlh=true__ip6tables.golden | 38 ++++ ...false,gwm=nat,bindlh=true__iptables.golden | 39 ++++ ...unprotected,bindlh=false__ip6tables.golden | 36 ++++ ...-unprotected,bindlh=false__iptables.golden | 36 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 36 ++++ ...t-unprotected,bindlh=true__iptables.golden | 37 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 40 ++++ ...e,gwm=routed,bindlh=false__iptables.golden | 40 ++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 40 ++++ ...se,gwm=routed,bindlh=true__iptables.golden | 41 +++++ ...rue,gwm=nat,bindlh=false__ip6tables.golden | 38 ++++ ...true,gwm=nat,bindlh=false__iptables.golden | 38 ++++ ...true,gwm=nat,bindlh=true__ip6tables.golden | 38 ++++ ...=true,gwm=nat,bindlh=true__iptables.golden | 39 ++++ ...unprotected,bindlh=false__ip6tables.golden | 36 ++++ ...-unprotected,bindlh=false__iptables.golden | 36 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 36 ++++ ...t-unprotected,bindlh=true__iptables.golden | 37 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 40 ++++ ...e,gwm=routed,bindlh=false__iptables.golden | 40 ++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 40 ++++ ...ue,gwm=routed,bindlh=true__iptables.golden | 41 +++++ ...lse,gwm=nat,bindlh=false__ip6tables.golden | 40 ++++ ...alse,gwm=nat,bindlh=false__iptables.golden | 40 ++++ ...alse,gwm=nat,bindlh=true__ip6tables.golden | 40 ++++ ...false,gwm=nat,bindlh=true__iptables.golden | 41 +++++ ...unprotected,bindlh=false__ip6tables.golden | 38 ++++ ...-unprotected,bindlh=false__iptables.golden | 38 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 38 ++++ ...t-unprotected,bindlh=true__iptables.golden | 39 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 41 +++++ ...e,gwm=routed,bindlh=false__iptables.golden | 41 +++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 41 +++++ ...se,gwm=routed,bindlh=true__iptables.golden | 42 +++++ ...rue,gwm=nat,bindlh=false__ip6tables.golden | 40 ++++ ...true,gwm=nat,bindlh=false__iptables.golden | 40 ++++ ...true,gwm=nat,bindlh=true__ip6tables.golden | 40 ++++ ...=true,gwm=nat,bindlh=true__iptables.golden | 41 +++++ ...unprotected,bindlh=false__ip6tables.golden | 38 ++++ ...-unprotected,bindlh=false__iptables.golden | 38 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 38 ++++ ...t-unprotected,bindlh=true__iptables.golden | 39 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 41 +++++ ...e,gwm=routed,bindlh=false__iptables.golden | 41 +++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 41 +++++ ...ue,gwm=routed,bindlh=true__iptables.golden | 42 +++++ ...lse,gwm=nat,bindlh=false__ip6tables.golden | 37 ++++ ...alse,gwm=nat,bindlh=false__iptables.golden | 37 ++++ ...alse,gwm=nat,bindlh=true__ip6tables.golden | 37 ++++ ...false,gwm=nat,bindlh=true__iptables.golden | 38 ++++ ...unprotected,bindlh=false__ip6tables.golden | 35 ++++ ...-unprotected,bindlh=false__iptables.golden | 35 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 35 ++++ ...t-unprotected,bindlh=true__iptables.golden | 36 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 39 ++++ ...e,gwm=routed,bindlh=false__iptables.golden | 39 ++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 39 ++++ ...se,gwm=routed,bindlh=true__iptables.golden | 40 ++++ ...rue,gwm=nat,bindlh=false__ip6tables.golden | 37 ++++ ...true,gwm=nat,bindlh=false__iptables.golden | 37 ++++ ...true,gwm=nat,bindlh=true__ip6tables.golden | 37 ++++ ...=true,gwm=nat,bindlh=true__iptables.golden | 38 ++++ ...unprotected,bindlh=false__ip6tables.golden | 35 ++++ ...-unprotected,bindlh=false__iptables.golden | 35 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 35 ++++ ...t-unprotected,bindlh=true__iptables.golden | 36 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 39 ++++ ...e,gwm=routed,bindlh=false__iptables.golden | 39 ++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 39 ++++ ...ue,gwm=routed,bindlh=true__iptables.golden | 40 ++++ ...lse,gwm=nat,bindlh=false__ip6tables.golden | 39 ++++ ...alse,gwm=nat,bindlh=false__iptables.golden | 39 ++++ ...alse,gwm=nat,bindlh=true__ip6tables.golden | 39 ++++ ...false,gwm=nat,bindlh=true__iptables.golden | 40 ++++ ...unprotected,bindlh=false__ip6tables.golden | 37 ++++ ...-unprotected,bindlh=false__iptables.golden | 37 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 37 ++++ ...t-unprotected,bindlh=true__iptables.golden | 38 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 40 ++++ ...e,gwm=routed,bindlh=false__iptables.golden | 40 ++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 40 ++++ ...se,gwm=routed,bindlh=true__iptables.golden | 41 +++++ ...rue,gwm=nat,bindlh=false__ip6tables.golden | 39 ++++ ...true,gwm=nat,bindlh=false__iptables.golden | 39 ++++ ...true,gwm=nat,bindlh=true__ip6tables.golden | 39 ++++ ...=true,gwm=nat,bindlh=true__iptables.golden | 40 ++++ ...unprotected,bindlh=false__ip6tables.golden | 37 ++++ ...-unprotected,bindlh=false__iptables.golden | 37 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 37 ++++ ...t-unprotected,bindlh=true__iptables.golden | 38 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 40 ++++ ...e,gwm=routed,bindlh=false__iptables.golden | 40 ++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 40 ++++ ...ue,gwm=routed,bindlh=true__iptables.golden | 41 +++++ ...,internal=true,icc=false__ip6tables.golden | 31 ++++ ...e,internal=true,icc=false__iptables.golden | 31 ++++ ...e,internal=true,icc=true__ip6tables.golden | 31 ++++ ...se,internal=true,icc=true__iptables.golden | 31 ++++ ...lse,gwm=nat,bindlh=false__ip6tables.golden | 40 ++++ ...alse,gwm=nat,bindlh=false__iptables.golden | 40 ++++ ...alse,gwm=nat,bindlh=true__ip6tables.golden | 40 ++++ ...false,gwm=nat,bindlh=true__iptables.golden | 41 +++++ ...unprotected,bindlh=false__ip6tables.golden | 38 ++++ ...-unprotected,bindlh=false__iptables.golden | 38 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 38 ++++ ...t-unprotected,bindlh=true__iptables.golden | 39 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 42 +++++ ...e,gwm=routed,bindlh=false__iptables.golden | 42 +++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 42 +++++ ...se,gwm=routed,bindlh=true__iptables.golden | 43 +++++ ...rue,gwm=nat,bindlh=false__ip6tables.golden | 40 ++++ ...true,gwm=nat,bindlh=false__iptables.golden | 40 ++++ ...true,gwm=nat,bindlh=true__ip6tables.golden | 40 ++++ ...=true,gwm=nat,bindlh=true__iptables.golden | 41 +++++ ...unprotected,bindlh=false__ip6tables.golden | 38 ++++ ...-unprotected,bindlh=false__iptables.golden | 38 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 38 ++++ ...t-unprotected,bindlh=true__iptables.golden | 39 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 42 +++++ ...e,gwm=routed,bindlh=false__iptables.golden | 42 +++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 42 +++++ ...ue,gwm=routed,bindlh=true__iptables.golden | 43 +++++ ...lse,gwm=nat,bindlh=false__ip6tables.golden | 41 +++++ ...alse,gwm=nat,bindlh=false__iptables.golden | 41 +++++ ...alse,gwm=nat,bindlh=true__ip6tables.golden | 41 +++++ ...false,gwm=nat,bindlh=true__iptables.golden | 42 +++++ ...unprotected,bindlh=false__ip6tables.golden | 39 ++++ ...-unprotected,bindlh=false__iptables.golden | 39 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 39 ++++ ...t-unprotected,bindlh=true__iptables.golden | 40 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 42 +++++ ...e,gwm=routed,bindlh=false__iptables.golden | 42 +++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 42 +++++ ...se,gwm=routed,bindlh=true__iptables.golden | 43 +++++ ...rue,gwm=nat,bindlh=false__ip6tables.golden | 41 +++++ ...true,gwm=nat,bindlh=false__iptables.golden | 41 +++++ ...true,gwm=nat,bindlh=true__ip6tables.golden | 41 +++++ ...=true,gwm=nat,bindlh=true__iptables.golden | 42 +++++ ...unprotected,bindlh=false__ip6tables.golden | 39 ++++ ...-unprotected,bindlh=false__iptables.golden | 39 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 39 ++++ ...t-unprotected,bindlh=true__iptables.golden | 40 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 42 +++++ ...e,gwm=routed,bindlh=false__iptables.golden | 42 +++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 42 +++++ ...ue,gwm=routed,bindlh=true__iptables.golden | 43 +++++ ...lse,gwm=nat,bindlh=false__ip6tables.golden | 39 ++++ ...alse,gwm=nat,bindlh=false__iptables.golden | 39 ++++ ...alse,gwm=nat,bindlh=true__ip6tables.golden | 39 ++++ ...false,gwm=nat,bindlh=true__iptables.golden | 40 ++++ ...unprotected,bindlh=false__ip6tables.golden | 37 ++++ ...-unprotected,bindlh=false__iptables.golden | 37 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 37 ++++ ...t-unprotected,bindlh=true__iptables.golden | 38 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 41 +++++ ...e,gwm=routed,bindlh=false__iptables.golden | 41 +++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 41 +++++ ...se,gwm=routed,bindlh=true__iptables.golden | 42 +++++ ...rue,gwm=nat,bindlh=false__ip6tables.golden | 39 ++++ ...true,gwm=nat,bindlh=false__iptables.golden | 39 ++++ ...true,gwm=nat,bindlh=true__ip6tables.golden | 39 ++++ ...=true,gwm=nat,bindlh=true__iptables.golden | 40 ++++ ...unprotected,bindlh=false__ip6tables.golden | 37 ++++ ...-unprotected,bindlh=false__iptables.golden | 37 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 37 ++++ ...t-unprotected,bindlh=true__iptables.golden | 38 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 41 +++++ ...e,gwm=routed,bindlh=false__iptables.golden | 41 +++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 41 +++++ ...ue,gwm=routed,bindlh=true__iptables.golden | 42 +++++ ...lse,gwm=nat,bindlh=false__ip6tables.golden | 40 ++++ ...alse,gwm=nat,bindlh=false__iptables.golden | 40 ++++ ...alse,gwm=nat,bindlh=true__ip6tables.golden | 40 ++++ ...false,gwm=nat,bindlh=true__iptables.golden | 41 +++++ ...unprotected,bindlh=false__ip6tables.golden | 38 ++++ ...-unprotected,bindlh=false__iptables.golden | 38 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 38 ++++ ...t-unprotected,bindlh=true__iptables.golden | 39 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 41 +++++ ...e,gwm=routed,bindlh=false__iptables.golden | 41 +++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 41 +++++ ...se,gwm=routed,bindlh=true__iptables.golden | 42 +++++ ...rue,gwm=nat,bindlh=false__ip6tables.golden | 40 ++++ ...true,gwm=nat,bindlh=false__iptables.golden | 40 ++++ ...true,gwm=nat,bindlh=true__ip6tables.golden | 40 ++++ ...=true,gwm=nat,bindlh=true__iptables.golden | 41 +++++ ...unprotected,bindlh=false__ip6tables.golden | 38 ++++ ...-unprotected,bindlh=false__iptables.golden | 38 ++++ ...-unprotected,bindlh=true__ip6tables.golden | 38 ++++ ...t-unprotected,bindlh=true__iptables.golden | 39 ++++ ...,gwm=routed,bindlh=false__ip6tables.golden | 41 +++++ ...e,gwm=routed,bindlh=false__iptables.golden | 41 +++++ ...e,gwm=routed,bindlh=true__ip6tables.golden | 41 +++++ ...ue,gwm=routed,bindlh=true__iptables.golden | 42 +++++ ...,internal=true,icc=false__ip6tables.golden | 31 ++++ ...e,internal=true,icc=false__iptables.golden | 31 ++++ ...e,internal=true,icc=true__ip6tables.golden | 31 ++++ ...ue,internal=true,icc=true__iptables.golden | 31 ++++ .../TestIptabler_no__ip6tables.golden | 15 ++ .../testdata/TestIptabler_no__iptables.golden | 15 ++ 207 files changed, 8111 insertions(+), 4 deletions(-) create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=false__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=false__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=true__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=true__iptables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_no__ip6tables.golden create mode 100644 libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_no__iptables.golden diff --git a/libnetwork/drivers/bridge/internal/iptabler/iptabler_test.go b/libnetwork/drivers/bridge/internal/iptabler/iptabler_test.go index 8f74369190..1ade150136 100644 --- a/libnetwork/drivers/bridge/internal/iptabler/iptabler_test.go +++ b/libnetwork/drivers/bridge/internal/iptabler/iptabler_test.go @@ -4,20 +4,33 @@ package iptabler import ( "context" + "fmt" + "net" + "net/netip" + "slices" + "strings" "testing" "github.com/docker/docker/internal/testutils/netnsutils" + "github.com/docker/docker/libnetwork/drivers/bridge/internal/firewaller" "github.com/docker/docker/libnetwork/iptables" + "github.com/docker/docker/libnetwork/types" "gotest.tools/v3/assert" + "gotest.tools/v3/golden" + "gotest.tools/v3/icmd" + "gotest.tools/v3/skip" ) -func TestCleanupIptableRules(t *testing.T) { +func usingFirewalld() bool { // Check for existence of a dummy rule to make sure iptables is initialised - then can // check whether firewalld is running. _ = iptables.GetIptable(iptables.IPv4).Exists(iptables.Filter, "FORWARD", "-j", "DROP") - if fw, _ := iptables.UsingFirewalld(); fw { - t.Skip("firewalld is running in the host netns, it can't modify rules in the test's netns") - } + fw, _ := iptables.UsingFirewalld() + return fw +} + +func TestCleanupIptableRules(t *testing.T) { + skip.If(t, usingFirewalld(), "firewalld is running in the host netns, it can't modify rules in the test's netns") defer netnsutils.SetupTestOSContext(t)() bridgeChains := []struct { @@ -68,3 +81,155 @@ func TestCleanupIptableRules(t *testing.T) { } } } + +// TestIptabler tests combinations of firewaller options against golden results. +func TestIptabler(t *testing.T) { + skip.If(t, usingFirewalld(), "firewalld is running in the host netns, it can't modify rules in the test's netns") + + const ( + ipv4 int64 = iota + ipv6 + hairpin + internal + icc + masq + snat + bindLocalhost + numBoolParams + ) + for i := range 1 << numBoolParams { + p := func(n int64) bool { return (i & (1 << n)) != 0 } + for _, gwmode := range []string{"nat", "nat-unprotected", "routed"} { + config := firewaller.Config{ + IPv4: p(ipv4), + IPv6: p(ipv6), + Hairpin: p(hairpin), + } + netConfig := firewaller.NetworkConfig{ + IfName: "br-dummy", + Internal: p(internal), + ICC: p(icc), + Masquerade: p(masq), + Config4: firewaller.NetworkConfigFam{ + HostIP: netip.Addr{}, + Prefix: netip.MustParsePrefix("192.168.0.0/24"), + Routed: gwmode == "routed", + Unprotected: gwmode == "nat-unprotected", + }, + Config6: firewaller.NetworkConfigFam{ + HostIP: netip.Addr{}, + Prefix: netip.MustParsePrefix("fd49:efd7:54aa::/64"), + Routed: gwmode == "routed", + Unprotected: gwmode == "nat-unprotected", + }, + } + if p(snat) { + netConfig.Config4.HostIP = netip.MustParseAddr("192.168.123.0") + netConfig.Config6.HostIP = netip.MustParseAddr("fd34:d0d4:672f::123") + } + tn := t.Name() + t.Run(fmt.Sprintf("ipv4=%v/ipv6=%v/hairpin=%v/internal=%v/icc=%v/masq=%v/snat=%v/gwm=%v/bindlh=%v", + p(ipv4), p(ipv6), p(hairpin), p(internal), p(icc), p(masq), p(snat), gwmode, p(bindLocalhost)), func(t *testing.T) { + // Run in parallel, unless updating results (because tests share golden results files, so + // they trample each other's output). + if !golden.FlagUpdate() { + t.Parallel() + } + // Combine results (golden output files) where possible to: + // - check params that should have no effect when made irrelevant by other params, and + // - minimise the number of results files. + var resName string + if p(internal) { + // Port binding params should have no effect on an internal network. + resName = fmt.Sprintf("hairpin=%v,internal=true,icc=%v", p(hairpin), p(icc)) + } else { + resName = fmt.Sprintf("hairpin=%v,internal=%v,icc=%v,masq=%v,snat=%v,gwm=%v,bindlh=%v", + p(hairpin), p(internal), p(icc), p(masq), p(snat), gwmode, p(bindLocalhost)) + } + testIptabler(t, tn, config, netConfig, p(bindLocalhost), tn+"_"+resName) + }) + } + } +} + +func testIptabler(t *testing.T, tn string, config firewaller.Config, netConfig firewaller.NetworkConfig, bindLocalhost bool, resName string) { + defer netnsutils.SetupTestOSContext(t)() + + stripComments := func(text string) string { + lines := strings.Split(text, "\n") + lines = slices.DeleteFunc(lines, func(l string) bool { return len(l) > 0 && l[0] == '#' }) + return strings.Join(lines, "\n") + } + + checkResults := func(cmd, name string, en bool) { + t.Helper() + // Explicitly save each table that might be used because: + // - iptables-nft and iptables-legacy pick a different order when dumping all tables + // - if the raw table isn't used it's not included in the all-tables dump but, once it's been used, it's always + // included ... so, "cleaned" results would differ only in the empty raw table. + var dump string + for _, table := range []string{"raw", "filter", "nat"} { + res := icmd.RunCommand(cmd+"-save", "-t", table) + assert.Assert(t, res.Error) + if !en { + name = tn + "_no" + } + dump += res.Combined() + } + assert.Check(t, golden.String(stripComments(dump), name+"__"+cmd+".golden")) + } + + makePB := func(hip string, cip netip.Addr) types.PortBinding { + return types.PortBinding{ + Proto: types.TCP, + IP: cip.AsSlice(), + Port: 80, + HostIP: net.ParseIP(hip), + HostPort: 8080, + HostPortEnd: 8080, + } + } + + // Initialise iptables, check the iptables config looks like it should look at the + // end of the test (after deleting per-network and per-port rules). + fw, err := NewIptabler(context.Background(), config) + assert.NilError(t, err) + checkResults("iptables", fmt.Sprintf("%s_cleaned,hairpin=%v", tn, config.Hairpin), config.IPv4) + checkResults("ip6tables", fmt.Sprintf("%s_cleaned,hairpin=%v", tn, config.Hairpin), config.IPv6) + + // Add the network. + nw, err := fw.NewNetwork(context.Background(), netConfig) + assert.NilError(t, err) + + // Add an endpoint. + epAddr4 := netip.MustParseAddr("192.168.0.2") + epAddr6 := netip.MustParseAddr("fd49:efd7:54aa::1") + err = nw.AddEndpoint(context.Background(), epAddr4, epAddr6) + assert.NilError(t, err) + + // Add IPv4 and IPv6 port mappings. + var pb4, pb6 types.PortBinding + if bindLocalhost { + pb4 = makePB("127.0.0.1", epAddr4) + pb6 = makePB("::1", epAddr6) + } else { + pb4 = makePB("0.0.0.0", epAddr4) + pb6 = makePB("::", epAddr6) + } + err = nw.AddPorts(context.Background(), []types.PortBinding{pb4, pb6}) + assert.NilError(t, err) + + // Check the resulting iptables config. + checkResults("iptables", resName, config.IPv4) + checkResults("ip6tables", resName, config.IPv6) + + // Remove the port mappings and the network, and check the result. + err = nw.DelPorts(context.Background(), []types.PortBinding{pb4, pb6}) + assert.NilError(t, err) + err = nw.DelEndpoint(context.Background(), epAddr4, epAddr6) + assert.NilError(t, err) + err = nw.DelNetworkLevelRules(context.Background()) + assert.NilError(t, err) + checkResults("iptables", fmt.Sprintf("%s_cleaned,hairpin=%v", tn, config.Hairpin), config.IPv4) + checkResults("ip6tables", fmt.Sprintf("%s_cleaned,hairpin=%v", tn, config.Hairpin), config.IPv6) +} diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=false__ip6tables.golden new file mode 100644 index 0000000000..b04e74a3b1 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=false__ip6tables.golden @@ -0,0 +1,28 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=false__iptables.golden new file mode 100644 index 0000000000..cb1d7f12c2 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=false__iptables.golden @@ -0,0 +1,28 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=true__ip6tables.golden new file mode 100644 index 0000000000..22b1768c1e --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=true__ip6tables.golden @@ -0,0 +1,28 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=true__iptables.golden new file mode 100644 index 0000000000..22b1768c1e --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_cleaned,hairpin=true__iptables.golden @@ -0,0 +1,28 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..390b6f2925 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..d5ff027ccf --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..1756ca56d9 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..73cdd2bbec --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..55b12b5519 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,36 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..8df0420036 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,36 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..5d78ffc885 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,36 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..81ed1c8d61 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..9cac6bd23e --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..c60b79859d --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..f7ba8a081d --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..f09624435d --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..390b6f2925 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..d5ff027ccf --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..1756ca56d9 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..73cdd2bbec --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..55b12b5519 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,36 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..8df0420036 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,36 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..5d78ffc885 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,36 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..81ed1c8d61 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..9cac6bd23e --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..c60b79859d --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..f7ba8a081d --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..f09624435d --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..6ad4c6dffd --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..eb0e81ec46 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..27d27a4fd8 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..98c2186588 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..0fc3e8bf60 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..92a816e7dd --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..d81165727e --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..d9d0279609 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..a76a822fb7 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..ed9cc4a3ef --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..c399513a37 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..02023c8270 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..347d65657c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..556820bf0c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..7d803719cd --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..cde564f824 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..dd6eade39e --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..0f060e7cb7 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..22d5045657 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..993d79fcf7 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..a76a822fb7 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..ed9cc4a3ef --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..c399513a37 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..02023c8270 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..88694639c4 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..7c772ab221 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..b675b02778 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..ff8fecbf9f --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..19ed79f064 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,35 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..1384b412e3 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,35 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..85d25e22ff --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,35 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..4fc2feb71c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,36 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..9b5e1d0fd4 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..ec43b6801b --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..4db5f3ae98 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..d2608f5771 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..88694639c4 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..7c772ab221 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..b675b02778 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..ff8fecbf9f --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..19ed79f064 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,35 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..1384b412e3 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,35 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..85d25e22ff --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,35 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..4fc2feb71c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,36 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..9b5e1d0fd4 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..ec43b6801b --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..4db5f3ae98 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..d2608f5771 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..8ece20e4b1 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..57c87a5472 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..4df14b9ea6 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..57bbb0a24f --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..fbe5d80edb --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..ff005d1185 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..1a0923d3c0 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..7f6ffab372 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A DOCKER -i br-dummy -j RETURN +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..b6f5d9c637 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..9e82925d8b --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..92f2905980 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..487fe77b3b --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..5fcd3ca7c6 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..f1b720ccad --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..83cf135dbb --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..be56c835e0 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..bc8025e641 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..3dc131ab4c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..0825321d3d --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..9a91985ca6 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A DOCKER -i br-dummy -j RETURN +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..b6f5d9c637 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..9e82925d8b --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..92f2905980 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER ! -s fe80::/10 -d ::1/128 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..487fe77b3b --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A DOCKER -i br-dummy -j RETURN +-A DOCKER -d 127.0.0.1/32 ! -i br-dummy -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=false__ip6tables.golden new file mode 100644 index 0000000000..7dcb341218 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=false__ip6tables.golden @@ -0,0 +1,31 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-ISOLATION-STAGE-1 ! -s fd49:efd7:54aa::/64 ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-ISOLATION-STAGE-1 ! -d fd49:efd7:54aa::/64 -i br-dummy ! -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=false__iptables.golden new file mode 100644 index 0000000000..8fe7955989 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=false__iptables.golden @@ -0,0 +1,31 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-ISOLATION-STAGE-1 ! -s 192.168.0.0/24 -o br-dummy -j DROP +-A DOCKER-ISOLATION-STAGE-1 ! -d 192.168.0.0/24 -i br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=true__ip6tables.golden new file mode 100644 index 0000000000..8d30240c26 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=true__ip6tables.golden @@ -0,0 +1,31 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 ! -s fd49:efd7:54aa::/64 ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-ISOLATION-STAGE-1 ! -d fd49:efd7:54aa::/64 -i br-dummy ! -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=true__iptables.golden new file mode 100644 index 0000000000..7c87194591 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=false,internal=true,icc=true__iptables.golden @@ -0,0 +1,31 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 ! -s 192.168.0.0/24 -o br-dummy -j DROP +-A DOCKER-ISOLATION-STAGE-1 ! -d 192.168.0.0/24 -i br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..5b81de1e72 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..dbcc24d818 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..ef3a802a0c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..c3e57870a4 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..5622d96487 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..ce3bb626fb --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..75eba802e9 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..0460e5531c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..7b7dfa5454 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..57ec4acb58 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..6af1e71d68 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..d8405378ae --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,43 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..9b23a16d3d --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..1745c64838 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..a21f92b560 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..5a622ba9fc --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..f656e572a8 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..5b12b6d589 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..a229e44f5b --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..3279e66e12 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..f3b825b364 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..7380846dfa --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..0b4d181768 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..0f837aca1c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,43 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..97c7db0923 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..4eb3102f19 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..328d019be5 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..823f07d258 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..be87dbf779 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..b5cb6388db --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..de1d3187b9 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..26ef3e2a56 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..7b7dfa5454 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..57ec4acb58 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..6af1e71d68 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..d8405378ae --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,43 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..91730f8859 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..9719c7ced9 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..8697dc9e48 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..33fa487f07 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..be2cdad161 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..14256a5d12 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..c1d6759278 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..0ee90b90bd --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..f3b825b364 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..7380846dfa --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..0b4d181768 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..0f837aca1c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=false,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,43 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-FORWARD -i br-dummy ! -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..91561d69a4 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..b51c394141 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..3a9c626d6d --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..1ff73acc2c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..ef92d5f74e --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..c23789f8d7 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..0c8ca6e24c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..2f511fc849 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..92911d7501 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..917516b715 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..12df370514 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..113585ee6c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=false,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..051a6f8f54 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..a51c8b1368 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..596250cf6e --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..a2581db3e0 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..a1c0b24121 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..2047dd2a6f --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..ec62e2a939 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,37 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..c9e0eb3e8d --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..a40433fec2 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..485d47ef68 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..778533fb0b --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..87f34d5426 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=false,snat=true,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..971e0fedd3 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..dc38c34b53 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..cb34f4744b --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..feaa954f84 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..0db016604f --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..e323f91b8a --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..5013c7df9c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..c841fadcb5 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..92911d7501 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..917516b715 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..12df370514 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..113585ee6c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=false,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j MASQUERADE +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..52b91a1f23 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden new file mode 100644 index 0000000000..a051f81e3a --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=false__iptables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..073b1410c3 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__ip6tables.golden @@ -0,0 +1,40 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d fd49:efd7:54aa::1/128 ! -i br-dummy -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden new file mode 100644 index 0000000000..a0f8f4788c --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat,bindlh=true__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 192.168.0.2/32 ! -i br-dummy -j DROP +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..4f5b1f6dd5 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden new file mode 100644 index 0000000000..eca87cb7e4 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=false__iptables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..6933fa4e05 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__ip6tables.golden @@ -0,0 +1,38 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::/64 ! -o br-dummy -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden new file mode 100644 index 0000000000..be55afb906 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=nat-unprotected,bindlh=true__iptables.golden @@ -0,0 +1,39 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER ! -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.0/24 ! -o br-dummy -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden new file mode 100644 index 0000000000..a40433fec2 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden new file mode 100644 index 0000000000..485d47ef68 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=false__iptables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden new file mode 100644 index 0000000000..778533fb0b --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__ip6tables.golden @@ -0,0 +1,41 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d fd49:efd7:54aa::1/128 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p ipv6-icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source fd34:d0d4:672f::123 +-A POSTROUTING -s fd49:efd7:54aa::1/128 -d fd49:efd7:54aa::1/128 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER ! -s fe80::/10 -d ::1/128 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd49:efd7:54aa::1]:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden new file mode 100644 index 0000000000..87f34d5426 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=false,icc=true,masq=true,snat=true,gwm=routed,bindlh=true__iptables.golden @@ -0,0 +1,42 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8080 -j DROP +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER -d 192.168.0.2/32 ! -i br-dummy -o br-dummy -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -o br-dummy -p icmp -j ACCEPT +-A DOCKER ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-BRIDGE -o br-dummy -j DOCKER +-A DOCKER-CT -o br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 -o br-dummy -j RETURN +-A DOCKER-ISOLATION-STAGE-1 -i br-dummy ! -o br-dummy -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-2 -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -o br-dummy -m addrtype --src-type LOCAL -j SNAT --to-source 192.168.123.0 +-A POSTROUTING -s 192.168.0.2/32 -d 192.168.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE +-A DOCKER -d 127.0.0.1/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.2:80 +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=false__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=false__ip6tables.golden new file mode 100644 index 0000000000..536c5d17f4 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=false__ip6tables.golden @@ -0,0 +1,31 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-ISOLATION-STAGE-1 ! -s fd49:efd7:54aa::/64 ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-ISOLATION-STAGE-1 ! -d fd49:efd7:54aa::/64 -i br-dummy ! -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=false__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=false__iptables.golden new file mode 100644 index 0000000000..8ce494ce2f --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=false__iptables.golden @@ -0,0 +1,31 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j DROP +-A DOCKER-ISOLATION-STAGE-1 ! -s 192.168.0.0/24 -o br-dummy -j DROP +-A DOCKER-ISOLATION-STAGE-1 ! -d 192.168.0.0/24 -i br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=true__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=true__ip6tables.golden new file mode 100644 index 0000000000..0719b84d99 --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=true__ip6tables.golden @@ -0,0 +1,31 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 ! -s fd49:efd7:54aa::/64 ! -i br-dummy -o br-dummy -j DROP +-A DOCKER-ISOLATION-STAGE-1 ! -d fd49:efd7:54aa::/64 -i br-dummy ! -o br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=true__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=true__iptables.golden new file mode 100644 index 0000000000..0f7fdd575d --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_hairpin=true,internal=true,icc=true__iptables.golden @@ -0,0 +1,31 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER - [0:0] +:DOCKER-BRIDGE - [0:0] +:DOCKER-CT - [0:0] +:DOCKER-FORWARD - [0:0] +:DOCKER-ISOLATION-STAGE-1 - [0:0] +:DOCKER-ISOLATION-STAGE-2 - [0:0] +-A FORWARD -j DOCKER-FORWARD +-A DOCKER-FORWARD -j DOCKER-CT +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1 +-A DOCKER-FORWARD -j DOCKER-BRIDGE +-A DOCKER-FORWARD -i br-dummy -o br-dummy -j ACCEPT +-A DOCKER-ISOLATION-STAGE-1 ! -s 192.168.0.0/24 -o br-dummy -j DROP +-A DOCKER-ISOLATION-STAGE-1 ! -d 192.168.0.0/24 -i br-dummy -j DROP +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:DOCKER - [0:0] +-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_no__ip6tables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_no__ip6tables.golden new file mode 100644 index 0000000000..398ec451be --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_no__ip6tables.golden @@ -0,0 +1,15 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +COMMIT diff --git a/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_no__iptables.golden b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_no__iptables.golden new file mode 100644 index 0000000000..398ec451be --- /dev/null +++ b/libnetwork/drivers/bridge/internal/iptabler/testdata/TestIptabler_no__iptables.golden @@ -0,0 +1,15 @@ +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +COMMIT