Repository: moby/moby
File: libnetwork/drivers/bridge/internal/nftabler/endpoint.go (Go)

Code before:
	return nil
}

// filterDirectAccess drops packets addressed directly to the container's IP address,
// when direct routing is not permitted by network configuration.
//
// It is a no-op if:
//   - gateway mode is "nat-unprotected" or "routed".
//   - direct routing is enabled at the daemon level.
//   - "raw" rules are disabled (possibly because the host doesn't have the necessary
//     kernel support).
//
// Packets originating on the bridge's own interface and addressed directly to the
// container are allowed - the host always has direct access to its own containers
// (it doesn't need to use the port mapped to its own addresses, although it can).
//
// "Trusted interfaces" are treated in the same way as the bridge itself.
func (n *network) filterDirectAccess(ctx context.Context, table nftables.TableRef, conf firewaller.NetworkConfigFam, epIP netip.Addr, enable bool) error {
	if n.config.Internal || conf.Unprotected || conf.Routed || n.fw.config.AllowDirectRouting {
		return nil
	}
	updater := table.ChainUpdateFunc(ctx, rawPreroutingChain, enable)
	ifNames := strings.Join(append(n.config.TrustedHostInterfaces, n.config.IfName), ", ")
	return updater(ctx, rawPreroutingPortsRuleGroup,
		`%s daddr %s iifname != { %s } counter drop comment "DROP DIRECT ACCESS"`,
		table.Family(), epIP, ifNames)
}


Review comment (suggestion):
While _possibly_ okay, it makes me nervous that the backing array of `n.config.TrustedHostInterfaces` may be mutated here. It's a surprising source of shared mutable state, one that is easily avoided.
```suggestion
	ifNames := strings.Join(n.config.TrustedHostInterfaces, ", ")
	return updater(ctx, rawPreroutingPortsRuleGroup,
		`%s daddr %s iifname != { %s, %s } counter drop comment "DROP DIRECT ACCESS"`,
		table.Family(), epIP, ifNames, n.config.IfName)
```

Code after:
	return nil
}

// filterDirectAccess drops packets addressed directly to the container's IP address,
// when direct routing is not permitted by network configuration.
//
// It is a no-op if:
//   - gateway mode is "nat-unprotected" or "routed".
//   - direct routing is enabled at the daemon level.
//   - "raw" rules are disabled (possibly because the host doesn't have the necessary
//     kernel support).
//
// Packets originating on the bridge's own interface and addressed directly to the
// container are allowed - the host always has direct access to its own containers
// (it doesn't need to use the port mapped to its own addresses, although it can).
//
// "Trusted interfaces" are treated in the same way as the bridge itself.
func (n *network) filterDirectAccess(ctx context.Context, table nftables.TableRef, conf firewaller.NetworkConfigFam, epIP netip.Addr, enable bool) error {
	if n.config.Internal || conf.Unprotected || conf.Routed || n.fw.config.AllowDirectRouting {
		return nil
	}
	updater := table.ChainUpdateFunc(ctx, rawPreroutingChain, enable)
	ifNames := strings.Join(n.config.TrustedHostInterfaces, ", ")
	return updater(ctx, rawPreroutingPortsRuleGroup,
		`%s daddr %s iifname != { %s, %s } counter drop comment "DROP DIRECT ACCESS"`,
		table.Family(), epIP, n.config.IfName, ifNames)
}