clearlinux/hyperstart
2
0
Fork 0
mirror of https://github.com/clearlinux/hyperstart.git synced 2026-09-03 12:11:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Do not add redirect rule if hostport is equal to containerport

Browse Source
This commit is contained in:
Pengfei Ni
2016-06-06 10:06:18 +08:00
parent 286e0f9c8f
commit 7856628d8a
1 changed files with 34 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/portmapping.c
+34 -30
View File
@@ -272,21 +272,23 @@ int hyper_setup_container_portmapping(struct hyper_container *c, struct hyper_po
network = pod->portmap_white_lists->external_networks[j];
// redirect host_port to container_port
sprintf(rule, "-s %s -p %s -m %s --dport %d -j REDIRECT --to-ports %d",
network,
c->ports[i].protocol,
c->ports[i].protocol,
c->ports[i].host_port,
c->ports[i].container_port);
struct ipt_rule redirect_rule = {
.table = "nat",
.op = "-I",
.chain = "hyperstart-PREROUTING",
.rule = rule,
};
if (hyper_setup_iptables_rule(redirect_rule)<0) {
fprintf(stderr, "setup redirect_rule '%s' failed\n", rule);
return -1;
if (c->ports[i].host_port != c->ports[i].container_port) {
sprintf(rule, "-s %s -p %s -m %s --dport %d -j REDIRECT --to-ports %d",
network,
c->ports[i].protocol,
c->ports[i].protocol,
c->ports[i].host_port,
c->ports[i].container_port);
struct ipt_rule redirect_rule = {
.table = "nat",
.op = "-I",
.chain = "hyperstart-PREROUTING",
.rule = rule,
};
if (hyper_setup_iptables_rule(redirect_rule)<0) {
fprintf(stderr, "setup redirect_rule '%s' failed\n", rule);
return -1;
}
}
// open container_port to external network
@@ -351,21 +353,23 @@ void hyper_cleanup_container_portmapping(struct hyper_container *c, struct hyper
for (j=0; j<pod->portmap_white_lists->e_num; j++) {
network = pod->portmap_white_lists->external_networks[j];
// redirect host_port to container_port
sprintf(rule, "-s %s -p %s -m %s --dport %d -j REDIRECT --to-ports %d",
network,
c->ports[i].protocol,
c->ports[i].protocol,
c->ports[i].host_port,
c->ports[i].container_port);
struct ipt_rule redirect_rule = {
.table = "nat",
.op = "-D",
.chain = "hyperstart-PREROUTING",
.rule = rule,
};
if (hyper_setup_iptables_rule(redirect_rule)<0) {
fprintf(stderr, "cleanup redirect '%s' failed\n", rule);
// delete rules redirecting host_port to container_port
if (c->ports[i].host_port != c->ports[i].container_port) {
sprintf(rule, "-s %s -p %s -m %s --dport %d -j REDIRECT --to-ports %d",
network,
c->ports[i].protocol,
c->ports[i].protocol,
c->ports[i].host_port,
c->ports[i].container_port);
struct ipt_rule redirect_rule = {
.table = "nat",
.op = "-D",
.chain = "hyperstart-PREROUTING",
.rule = rule,
};
if (hyper_setup_iptables_rule(redirect_rule)<0) {
fprintf(stderr, "cleanup redirect '%s' failed\n", rule);
}
}
// open container_port to external network