From 9a9c06966b9ccd16d74d293f869afeeb746d988e Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Sat, 20 Jan 2018 12:47:11 +0100 Subject: [PATCH] Bring the weave bridge isolation iptables rule to the top Make the rule creation to use the same mechanism (via ensureRules) as other rules from filter/FORWARD. Otherwise, the rule is preceded by "-j WEAVE-EXPOSE" rule which can break the subnet isolation. --- net/bridge.go | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) diff --git a/net/bridge.go b/net/bridge.go index c084d7cd..b2183103 100644 --- a/net/bridge.go +++ b/net/bridge.go @@ -409,20 +409,13 @@ func configureIPTables(config *BridgeConfig) error { if err != nil { return errors.Wrap(err, "creating iptables object") } + + // The order among weave filter/FORWARD rules is important! + fwdRules := make([][]string, 0) + if config.DockerBridgeName != "" { if config.WeaveBridgeName != config.DockerBridgeName { - // This is not ideal, as it does not check whether the rule is at the top - // of the chain. - found, err := ipt.Exists("filter", "FORWARD", "-i", config.DockerBridgeName, "-o", config.WeaveBridgeName, "-j", "DROP") - if err != nil { - return err - } - if !found { - err := ipt.Insert("filter", "FORWARD", 1, "-i", config.DockerBridgeName, "-o", config.WeaveBridgeName, "-j", "DROP") - if err != nil { - return err - } - } + fwdRules = append(fwdRules, []string{"-i", config.DockerBridgeName, "-o", config.WeaveBridgeName, "-j", "DROP"}) } dockerBridgeIP, err := FindBridgeIP(config.DockerBridgeName, nil) @@ -450,9 +443,6 @@ func configureIPTables(config *BridgeConfig) error { } } - // The order among weave filter/FORWARD rules is important! - fwdRules := make([][]string, 0) - if config.NPC { // Steer traffic via the NPC _ = ipt.NewChain("filter", "WEAVE-NPC") // ignore error because it might already exist