示例#1
0
func setupIPTables(config *NetworkConfiguration, i *bridgeInterface) error {
	// Sanity check.
	if config.EnableIPTables == false {
		return IPTableCfgError(config.BridgeName)
	}

	hairpinMode := !config.EnableUserlandProxy

	addrv4, _, err := netutils.GetIfaceAddr(config.BridgeName)
	if err != nil {
		return fmt.Errorf("Failed to setup IP tables, cannot acquire Interface address: %s", err.Error())
	}
	if err = setupIPTablesInternal(config.BridgeName, addrv4, config.EnableICC, config.EnableIPMasquerade, hairpinMode, true); err != nil {
		return fmt.Errorf("Failed to Setup IP tables: %s", err.Error())
	}

	_, err = iptables.NewChain(DockerChain, config.BridgeName, iptables.Nat, hairpinMode)
	if err != nil {
		return fmt.Errorf("Failed to create NAT chain: %s", err.Error())
	}

	chain, err := iptables.NewChain(DockerChain, config.BridgeName, iptables.Filter, hairpinMode)
	if err != nil {
		return fmt.Errorf("Failed to create FILTER chain: %s", err.Error())
	}

	portMapper.SetIptablesChain(chain)

	return nil
}
示例#2
0
func (n *bridgeNetwork) setupIPTables(config *networkConfiguration, i *bridgeInterface) error {
	d := n.driver
	d.Lock()
	driverConfig := d.config
	d.Unlock()

	// Sanity check.
	if driverConfig.EnableIPTables == false {
		return fmt.Errorf("Cannot program chains, EnableIPTable is disabled")
	}

	// Pickup this configuraton option from driver
	hairpinMode := !driverConfig.EnableUserlandProxy

	addrv4, _, err := netutils.GetIfaceAddr(config.BridgeName)
	if err != nil {
		return fmt.Errorf("Failed to setup IP tables, cannot acquire Interface address: %s", err.Error())
	}
	ipnet := addrv4.(*net.IPNet)
	maskedAddrv4 := &net.IPNet{
		IP:   ipnet.IP.Mask(ipnet.Mask),
		Mask: ipnet.Mask,
	}
	if err = setupIPTablesInternal(config.BridgeName, maskedAddrv4, config.EnableICC, config.EnableIPMasquerade, hairpinMode, true); err != nil {
		return fmt.Errorf("Failed to Setup IP tables: %s", err.Error())
	}
	n.registerIptCleanFunc(func() error {
		return setupIPTablesInternal(config.BridgeName, maskedAddrv4, config.EnableICC, config.EnableIPMasquerade, hairpinMode, false)
	})

	natChain, filterChain, _, err := n.getDriverChains()
	if err != nil {
		return fmt.Errorf("Failed to setup IP tables, cannot acquire chain info %s", err.Error())
	}

	err = iptables.ProgramChain(natChain, config.BridgeName, hairpinMode, true)
	if err != nil {
		return fmt.Errorf("Failed to program NAT chain: %s", err.Error())
	}

	err = iptables.ProgramChain(filterChain, config.BridgeName, hairpinMode, true)
	if err != nil {
		return fmt.Errorf("Failed to program FILTER chain: %s", err.Error())
	}

	if err := ensureJumpRule("FORWARD", IsolationChain); err != nil {
		return err
	}

	n.registerIptCleanFunc(func() error {
		return iptables.ProgramChain(filterChain, config.BridgeName, hairpinMode, false)
	})

	n.portMapper.SetIptablesChain(filterChain, n.getNetworkBridgeName())

	return nil
}