From c80d87554a179831d9613d0f1b9f816b8acc305e Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Fri, 17 Jun 2016 16:10:13 +0100 Subject: [PATCH] Maintain per-interface DROP rule for multicast ingress --- net/veth.go | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/net/veth.go b/net/veth.go index fbca71c3..d924897d 100644 --- a/net/veth.go +++ b/net/veth.go @@ -5,6 +5,7 @@ import ( "net" "time" + "github.com/coreos/go-iptables/iptables" "github.com/j-keck/arping" "github.com/vishvananda/netlink" "github.com/vishvananda/netns" @@ -112,6 +113,11 @@ func interfaceExistsInNamespace(ns netns.NsHandle, ifName string) bool { } func AttachContainer(ns netns.NsHandle, id, ifName, bridgeName string, mtu int, withMulticastRoute bool, cidrs []*net.IPNet, keepTXOn bool) error { + ipt, err := iptables.New() + if err != nil { + return err + } + if !interfaceExistsInNamespace(ns, ifName) { maxIDLen := IFNAMSIZ - 1 - len(vethPrefix+"pl") if len(id) > maxIDLen { @@ -129,6 +135,9 @@ func AttachContainer(ns netns.NsHandle, id, ifName, bridgeName string, mtu int, if err := ConfigureARPCache(ifName); err != nil { return err } + if err := ipt.Append("filter", "INPUT", "-i", ifName, "-d", "224.0.0.0/4", "-j", "DROP"); err != nil { + return err + } return nil }); err != nil { return fmt.Errorf("error setting up interface: %s", err) @@ -177,6 +186,11 @@ func AttachContainer(ns netns.NsHandle, id, ifName, bridgeName string, mtu int, } func DetachContainer(ns netns.NsHandle, id, ifName string, cidrs []*net.IPNet) error { + ipt, err := iptables.New() + if err != nil { + return err + } + return WithNetNSLink(ns, ifName, func(veth netlink.Link) error { existingAddrs, err := netlink.AddrList(veth, netlink.FAMILY_V4) if err != nil { @@ -195,6 +209,9 @@ func DetachContainer(ns netns.NsHandle, id, ifName string, cidrs []*net.IPNet) e return fmt.Errorf("failed to get IP address for %q: %v", veth.Attrs().Name, err) } if len(addrs) == 0 { // all addresses gone: remove the interface + if err := ipt.Delete("filter", "INPUT", "-i", ifName, "-d", "224.0.0.0/4", "-j", "DROP"); err != nil { + return err + } if err := netlink.LinkDel(veth); err != nil { return err }