holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Accomodate both DOCKER-ISOLATION and DOCKER-ISOLATION-STAGE-*

Browse Source 
Previously, the code assumed that either DOCKER-ISOLATION or
DOCKER-ISOLATION-STAGE-* would exist but not both. That has been corrected
This commit is contained in:
Tom Eastep 2020-02-22 11:31:19 -08:00
parent 3f5e1b5b60
commit caa7475483
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10
2 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -8713,6 +8713,9 @@ sub save_docker_rules($) {
qq( ;;),
qq( Two\)),
qq( rm -f \${VARDIR}/.filter_DOCKER-ISOLATION*),
qq( if chain_exists DOCKER_ISOLATION; then),
qq( $tool -t filter -S DOCKER-ISOLATION | tail -n +2 > \${VARDIR}/.filter_DOCKER-ISOLATION),
qq( fi),
qq( $tool -t filter -S DOCKER-ISOLATION-STAGE-1 | tail -n +2 > \${VARDIR}/.filter_DOCKER-ISOLATION-STAGE-1),
qq( $tool -t filter -S DOCKER-ISOLATION-STAGE-2 | tail -n +2 > \${VARDIR}/.filter_DOCKER-ISOLATION-STAGE-2),
qq( ;;),
@ -9238,7 +9241,7 @@ sub create_netfilter_load( $ ) {
} elsif ( $name eq 'DOCKER-ISOLATION' ) {
ensure_cmd_mode;
emit( '[ "$g_dockernetwork" = One ] && echo ":DOCKER-ISOLATION - [0:0]" >&3' );
} elsif ( $name =~ /^DOCKER-ISOLATION-/ ) {
} elsif ( $name =~ /^DOCKER-ISOLATION/ ) {
ensure_cmd_mode;
emit( qq([ "\$g_dockernetwork" = Two ] && echo ":$name - [0:0]" >&3) );
} elsif ( $name eq 'DOCKER-INGRESS' ) {
@ -9454,7 +9457,7 @@ sub create_stop_load( $ ) {
} elsif ( $name eq 'DOCKER-ISOLATION' ) {
ensure_cmd_mode;
emit( '[ -n "$g_dockernetwork" ] && echo ":DOCKER-ISOLATION - [0:0]" >&3' );
} elsif ( $name =~ /^DOCKER-ISOLATION-/ ) {
} elsif ( $name =~ /^DOCKER-ISOLATION/ ) {
ensure_cmd_mode;
emit( qq([ "\$g_dockernetwork" = Two ] && echo ":$name - [0:0]" >&3) );
} elsif ( $name eq 'DOCKER-INGRESS' ) {

6
Shorewall/Perl/Shorewall/Compiler.pm
View File

@ -270,10 +270,10 @@ sub generate_script_2() {
);
emit( 'chain_exists DOCKER-INGRESS && g_dockeringress=Yes' );
emit( 'chain_exists DOCKER-USER && g_dockeruser=Yes' );
emit( 'if chain_exists DOCKER-ISOLATION; then',
' g_dockernetwork=One',
'elif chain_exists DOCKER-ISOLATION-STAGE-1; then',
emit( 'if chain_exists DOCKER-ISOLATION-STAGE-1; then',
' g_dockernetwork=Two',
'elif chain_exists DOCKER-ISOLATION; then',
' g_dockernetwork=One',
'fi' );
}