dilim/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-08-07 16:41:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Combine firewalld reload callbacks for IPv4/IPv6

Browse Source 
Signed-off-by: Rob Murray <rob.murray@docker.com>
This commit is contained in:
Rob Murray
2025-03-17 10:30:45 +00:00
parent 97c397112a
commit fce915897c
3 changed files with 15 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libnetwork/drivers/bridge/bridge_linux.go
View File

@@ -939,9 +939,10 @@ func (d *driver) createNetwork(config *networkConfiguration) (err error) {
// We want to track firewalld configuration so that
// if it is started/reloaded, the rules can be applied correctly
{config.EnableIPv4 && d.config.EnableIPTables, network.setupFirewalld},
// same for IPv6
{config.EnableIPv6 && d.config.EnableIP6Tables, network.setupFirewalld6},
{
(config.EnableIPv4 && d.config.EnableIPTables) || (config.EnableIPv6 && d.config.EnableIP6Tables),
network.setupFirewalld,
},
// Setup DefaultGatewayIPv4
{config.DefaultGatewayIPv4 != nil, setupGatewayIPv4},

16
libnetwork/drivers/bridge/port_mapping_linux.go
View File

@@ -962,15 +962,7 @@ func rawRulesDisabled(ctx context.Context) bool {
return false
}
func (n *bridgeNetwork) reapplyPerPortIptables4() {
n.reapplyPerPortIptables(func(b portBinding) bool { return b.IP.To4() != nil })
}
func (n *bridgeNetwork) reapplyPerPortIptables6() {
n.reapplyPerPortIptables(func(b portBinding) bool { return b.IP.To4() == nil })
}
func (n *bridgeNetwork) reapplyPerPortIptables(needsReconfig func(portBinding) bool) {
func (n *bridgeNetwork) reapplyPerPortIptables() {
n.Lock()
var allPBs []portBinding
for _, ep := range n.endpoints {
@@ -979,10 +971,8 @@ func (n *bridgeNetwork) reapplyPerPortIptables(needsReconfig func(portBinding) b
n.Unlock()
for _, b := range allPBs {
if needsReconfig(b) {
if err := n.setPerPortIptables(context.Background(), b, true); err != nil {
log.G(context.TODO()).Warnf("Failed to reconfigure iptables on firewalld reload %s: %s", b, err)
}
if err := n.setPerPortIptables(context.Background(), b, true); err != nil {
log.G(context.TODO()).Warnf("Failed to reconfigure iptables on firewalld reload %s: %s", b, err)
}
}
}

37
libnetwork/drivers/bridge/setup_firewalld.go
View File

@@ -3,39 +3,18 @@
package bridge
import (
"errors"
"github.com/docker/docker/libnetwork/iptables"
)
func (n *bridgeNetwork) setupFirewalld(config *networkConfiguration, i *bridgeInterface) error {
d := n.driver
d.Lock()
driverConfig := d.config
d.Unlock()
// Sanity check.
if !driverConfig.EnableIPTables {
return errors.New("no need to register firewalld hooks, iptables is disabled")
// FIXME(robmry) - these reload functions aren't deleted when the network is deleted.
// So, a firewalld reload leads to creation of zombie rules belonging to those networks.
if n.driver.config.EnableIPTables && config.EnableIPv4 {
iptables.OnReloaded(func() { n.setupIP4Tables(config, i) })
}
iptables.OnReloaded(func() { n.setupIP4Tables(config, i) })
iptables.OnReloaded(n.reapplyPerPortIptables4)
return nil
}
func (n *bridgeNetwork) setupFirewalld6(config *networkConfiguration, i *bridgeInterface) error {
d := n.driver
d.Lock()
driverConfig := d.config
d.Unlock()
// Sanity check.
if !driverConfig.EnableIP6Tables {
return errors.New("no need to register firewalld hooks, ip6tables is disabled")
}
iptables.OnReloaded(func() { n.setupIP6Tables(config, i) })
iptables.OnReloaded(n.reapplyPerPortIptables6)
if n.driver.config.EnableIP6Tables && config.EnableIPv6 {
iptables.OnReloaded(func() { n.setupIP6Tables(config, i) })
}
iptables.OnReloaded(n.reapplyPerPortIptables)
return nil
}