Better approach to fix firewalld zone

msilveirabr · msilveirabr · commit 2449e0a61608 · 2023-06-08T00:49:31.000-03:00
* Better approach to fix firewalld+nftables docker zone
diff --git a/libnetwork/drivers/bridge/setup_ip_tables.go b/libnetwork/drivers/bridge/setup_ip_tables.go
@@ -291,6 +291,22 @@ func programChainRule(version iptables.IPVersion, rule iptRule, ruleDescr string
 	return nil
 }
 
+// SetupInternalICC is used to add or remove the internal interface to/from the firewalld docker zone ( ICC )
+// https://github.com/moby/libnetwork/issues/2647
+func SetupInternalICC(bridgeIface string, include bool) error {
+	// Either add or remove the interface from the firewalld docker zone
+	if include {
+		if err := iptables.AddInterfaceFirewalld(bridgeIface); err != nil {
+			return fmt.Errorf("Failed to add interface %s to firewalld docker zone: %s", bridgeIface, err.Error())
+		}
+	} else {
+		if err := iptables.DelInterfaceFirewalld(bridgeIface); err != nil {
+			return fmt.Errorf("Failed to remove interface %s from firewalld docker zone: %s", bridgeIface, err.Error())
+		}
+	}
+	return nil
+}
+
 func setIcc(version iptables.IPVersion, bridgeIface string, iccEnable, insert bool) error {
 	iptable := iptables.GetIptable(version)
 	var (
@@ -413,10 +429,10 @@ func setupInternalNetworkRules(bridgeIface string, addr *net.IPNet, icc, insert
 	if err := programChainRule(version, outDropRule, "DROP OUTGOING", insert); err != nil {
 		return err
 	}
-	//Add internal interface to docker zone if ICC is enabled
 	if icc {
-		iiptable := iptables.GetIptable(version)
-		iiptable.SetupInternalICC(bridgeIface, insert)
+		if err := SetupInternalICC(bridgeIface, insert); err != nil {
+			return err
+		}
 	}
 	// Set Inter Container Communication.
 	return setIcc(version, bridgeIface, icc, insert)
diff --git a/libnetwork/iptables/iptables.go b/libnetwork/iptables/iptables.go
@@ -173,24 +173,6 @@ func (iptable IPTable) LoopbackByVersion() string {
 	return "127.0.0.0/8"
 }
 
-// SetupInternalICC is used to add or remove the internal interface from the firewalld zone ( ICC )
-// https://github.com/moby/libnetwork/issues/2647
-func (iptable IPTable) SetupInternalICC(bridgeIface string, include bool) error {
-	// Either add or remove the interface from the firewalld zone
-	if firewalldRunning {
-		if include {
-			if err := AddInterfaceFirewalld(bridgeIface); err != nil {
-				return fmt.Errorf("Failed to add interface %s to firewalld zone: %s", bridgeIface, err.Error())
-			}
-		} else {
-			if err := DelInterfaceFirewalld(bridgeIface); err != nil {
-				return fmt.Errorf("Failed to remove interface %s from firewalld zone: %s", bridgeIface, err.Error())
-			}
-		}
-	}
-	return nil
-}
-
 // ProgramChain is used to add rules to a chain
 func (iptable IPTable) ProgramChain(c *ChainInfo, bridgeName string, hairpinMode, enable bool) error {
 	if c.Name == "" {
