dilim/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-08-02 22:26:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

libnet/iptables: don't filter on unspecified IP to delete conntrack

Browse Source 
Fixes: a836506d19 "Change Conntrack to delete by Both Port And IP"
Signed-off-by: Vincent Bernat <vincent@bernat.ch>
This commit is contained in:
Vincent Bernat
2026-05-16 15:13:13 +02:00
parent 0686f57c3d
commit df58acf56e
1 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
daemon/libnetwork/iptables/conntrack.go
View File

@@ -98,14 +98,20 @@ func DeleteConntrackEntriesByPort(nlh nlwrap.Handle, proto types.Protocol, ports
}).Warn("Failed to delete conntrack state for port")
continue
}
if err := filter.AddIP(netlink.ConntrackOrigDstIP, port.HostIP); err != nil {
log.G(context.TODO()).WithFields(log.Fields{
"error": err,
"hostIP": port.HostIP.String(),
"proto": port.Proto.String(),
"port": port.Port,
}).Warn("Failed to delete conntrack state for port")
continue
// Only filter by destination IP when the host IP is specified. When
// HostIP is 0.0.0.0 or ::, the binding applies to all interfaces, but
// conntrack entries record the actual interface IP, so filtering by the
// unspecified address would never match.
if !port.HostIP.IsUnspecified() {
if err := filter.AddIP(netlink.ConntrackOrigDstIP, port.HostIP); err != nil {
log.G(context.TODO()).WithFields(log.Fields{
"error": err,
"hostIP": port.HostIP.String(),
"proto": port.Proto.String(),
"port": port.Port,
}).Warn("Failed to delete conntrack state for port")
continue
}
}
v4FlowPurged, err := nlh.ConntrackDeleteFilters(netlink.ConntrackTable, syscall.AF_INET, filter)