InTheForest/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-01-11 18:51:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #50098 from robmry/remove_docker-user_return_rule

Browse Source 
iptables: Drop explicit RETURN rule from DOCKER-USER
This commit is contained in:
Rob Murray
2025-05-29 11:27:54 +01:00
committed by GitHub
parent 0e2cc22d36 dc519a0f18
commit b43afbf898
14 changed files with 0 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
integration/network/bridge/iptablesdoc/generated/new-daemon.md
View File

@@ -45,7 +45,6 @@ Table `filter`:
Chain DOCKER-USER (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0
<details>
@@ -72,7 +71,6 @@ Table `filter`:
-A DOCKER-FORWARD -i docker0 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-USER -j RETURN
</details>

2
integration/network/bridge/iptablesdoc/generated/swarm-portmap.md
View File

@@ -60,7 +60,6 @@ The filter table is:
Chain DOCKER-USER (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0
<details>
@@ -99,7 +98,6 @@ The filter table is:
-A DOCKER-ISOLATION-STAGE-1 -i docker_gwbridge ! -o docker_gwbridge -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-2 -o docker_gwbridge -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-USER -j RETURN
</details>

2
integration/network/bridge/iptablesdoc/generated/usernet-internal.md
View File

@@ -66,7 +66,6 @@ The filter table is updated as follows:
Chain DOCKER-USER (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0
<details>
@@ -99,7 +98,6 @@ The filter table is updated as follows:
-A DOCKER-ISOLATION-STAGE-1 ! -d 192.0.2.0/24 -i bridgeICC -j DROP
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-USER -j RETURN
</details>

2
integration/network/bridge/iptablesdoc/generated/usernet-portmap-lo.md
View File

@@ -59,7 +59,6 @@ The filter and nat tables are identical to [nat mode][0]:
Chain DOCKER-USER (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0
-P INPUT ACCEPT
@@ -90,7 +89,6 @@ The filter and nat tables are identical to [nat mode][0]:
-A DOCKER-ISOLATION-STAGE-1 -i bridge1 ! -o bridge1 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-2 -o bridge1 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-USER -j RETURN
</details>

2
integration/network/bridge/iptablesdoc/generated/usernet-portmap-natunprot.md
View File

@@ -56,7 +56,6 @@ The filter table is:
Chain DOCKER-USER (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0
<details>
@@ -89,7 +88,6 @@ The filter table is:
-A DOCKER-ISOLATION-STAGE-1 -i bridge1 ! -o bridge1 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-2 -o bridge1 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-USER -j RETURN
</details>

2
integration/network/bridge/iptablesdoc/generated/usernet-portmap-noicc.md
View File

@@ -58,7 +58,6 @@ The filter table is:
Chain DOCKER-USER (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0
<details>
@@ -93,7 +92,6 @@ The filter table is:
-A DOCKER-ISOLATION-STAGE-1 -i bridge1 ! -o bridge1 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-2 -o bridge1 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-USER -j RETURN
</details>

2
integration/network/bridge/iptablesdoc/generated/usernet-portmap-noproxy.md
View File

@@ -60,7 +60,6 @@ The filter table is the same as with the userland proxy enabled.
Chain DOCKER-USER (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0
-P INPUT ACCEPT
@@ -91,7 +90,6 @@ The filter table is the same as with the userland proxy enabled.
-A DOCKER-ISOLATION-STAGE-1 -i bridge1 ! -o bridge1 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-2 -o bridge1 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-USER -j RETURN
</details>

2
integration/network/bridge/iptablesdoc/generated/usernet-portmap-routed.md
View File

@@ -60,7 +60,6 @@ The filter table is:
Chain DOCKER-USER (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0
<details>
@@ -97,7 +96,6 @@ The filter table is:
-A DOCKER-ISOLATION-STAGE-1 -i bridge1 ! -o bridge1 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-2 -o bridge1 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-USER -j RETURN
</details>

2
integration/network/bridge/iptablesdoc/generated/usernet-portmap.md
View File

@@ -56,7 +56,6 @@ The filter table is updated as follows:
Chain DOCKER-USER (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0
<details>
@@ -90,7 +89,6 @@ The filter table is updated as follows:
-A DOCKER-ISOLATION-STAGE-1 -i bridge1 ! -o bridge1 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-2 -o bridge1 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-USER -j RETURN
</details>

3
libnetwork/firewall_linux.go
View File

@@ -55,9 +55,6 @@ func setupUserChain(ipVersion iptables.IPVersion) error {
if _, err := ipt.NewChain(userChain, iptables.Filter); err != nil {
return fmt.Errorf("failed to create %s %v chain: %v", userChain, ipVersion, err)
}
if err := ipt.AddReturnRule(userChain); err != nil {
return fmt.Errorf("failed to add the RETURN rule for %s %v: %w", userChain, ipVersion, err)
}
if err := ipt.EnsureJumpRule("FORWARD", userChain); err != nil {
return fmt.Errorf("failed to ensure the jump rule for %s %v: %w", userChain, ipVersion, err)
}

1
libnetwork/testdata/TestUserChain_iptables-true_append-false_usrafter4 vendored
View File

@@ -1,2 +1 @@
-N DOCKER-USER
-A DOCKER-USER -j RETURN

1
libnetwork/testdata/TestUserChain_iptables-true_append-false_usrafter6 vendored
View File

@@ -1,2 +1 @@
-N DOCKER-USER
-A DOCKER-USER -j RETURN

1
libnetwork/testdata/TestUserChain_iptables-true_append-true_usrafter4 vendored
View File

@@ -1,2 +1 @@
-N DOCKER-USER
-A DOCKER-USER -j RETURN

1
libnetwork/testdata/TestUserChain_iptables-true_append-true_usrafter6 vendored
View File

@@ -1,2 +1 @@
-N DOCKER-USER
-A DOCKER-USER -j RETURN