moby/libnetwork/testdata/TestUserChain_iptables-true_append-false_dockerfwdinit4 at 76417bf7630e943a84406c99e87cd09ab53f1923 - moby - InTheForest

InTheForest/moby

mirror of https://github.com/moby/moby.git synced 2026-01-11 18:51:37 +00:00

Files

Rob Murray 76417bf763 Don't use ipset

Commit 0546d90 introduced the use of ipset to reduce the number
of rules that need to be processed per-packet, and make the code
a bit simpler.

But, docker's used on embedded kernels compiled without support
for ipset, so the change is too disruptive.

Replace the two ipset rules with a new chain that writes out the
rule's actions long-hand. So ..

This rule:
  -A FORWARD -m set --match-set docker-ext-bridges-v4 dst \
    -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
Is transformed into a per-bridge rule in new chain DOCKER-CT:
  -A DOCKER-FORWARD -j DOCKER-CT
  -A DOCKER-CT -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  -A DOCKER-CT -o bridge1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

And:
  -A FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER
Is transformed into a per-bridge rule in new chain DOCKER-BRIDGE:
  -A DOCKER-FORWARD -j DOCKER-BRIDGE
  -A DOCKER-BRIDGE -o docker0 -j DOCKER
  -A DOCKER-BRIDGE -o bridge1 -j DOCKER

Signed-off-by: Rob Murray <rob.murray@docker.com>

2025-02-25 15:24:25 +00:00

5 lines

130 B

Plaintext

Raw Blame History

 -N DOCKER-FORWARD
 -A DOCKER-FORWARD -j DOCKER-CT
 -A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1
 -A DOCKER-FORWARD -j DOCKER-BRIDGE