mirror of
https://github.com/moby/moby.git
synced 2026-07-21 15:01:26 +00:00
419f5a6372
Prior to release 25.0.0, the bridge in an internal network was assigned an IP address - making the internal network accessible from the host, giving containers on the network access to anything listening on the bridge's address (or INADDR_ANY on the host). This change restores that behaviour. It does not restore the default route that was configured in the container, because packets sent outside the internal network's subnet have always been dropped. So, a 'connect()' to an address outside the subnet will still fail fast. Signed-off-by: Rob Murray <rob.murray@docker.com>
50 lines
1.4 KiB
Go
50 lines
1.4 KiB
Go
package bridge
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/docker/docker/libnetwork/ns"
|
|
"github.com/vishvananda/netlink"
|
|
)
|
|
|
|
// setupVerifyAndReconcileIPv4 checks what IPv4 addresses the given i interface has
|
|
// and ensures that they match the passed network config.
|
|
func setupVerifyAndReconcileIPv4(config *networkConfiguration, i *bridgeInterface) error {
|
|
// Fetch a slice of IPv4 addresses and a slice of IPv6 addresses from the bridge.
|
|
addrsv4, err := i.addresses(netlink.FAMILY_V4)
|
|
if err != nil {
|
|
return fmt.Errorf("Failed to verify ip addresses: %v", err)
|
|
}
|
|
|
|
addrv4, _ := selectIPv4Address(addrsv4, config.AddressIPv4)
|
|
|
|
// Verify that the bridge has an IPv4 address.
|
|
if addrv4.IPNet == nil {
|
|
return &ErrNoIPAddr{}
|
|
}
|
|
|
|
// Verify that the bridge IPv4 address matches the requested configuration.
|
|
if config.AddressIPv4 != nil && !addrv4.IP.Equal(config.AddressIPv4.IP) {
|
|
return &IPv4AddrNoMatchError{IP: addrv4.IP, CfgIP: config.AddressIPv4.IP}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func bridgeInterfaceExists(name string) (bool, error) {
|
|
nlh := ns.NlHandle()
|
|
link, err := nlh.LinkByName(name)
|
|
if err != nil {
|
|
if strings.Contains(err.Error(), "Link not found") {
|
|
return false, nil
|
|
}
|
|
return false, fmt.Errorf("failed to check bridge interface existence: %v", err)
|
|
}
|
|
|
|
if link.Type() == "bridge" {
|
|
return true, nil
|
|
}
|
|
return false, fmt.Errorf("existing interface %s is not a bridge", name)
|
|
}
|