Repository: moby/moby
File: libnetwork/drivers/bridge/internal/iptabler/endpoint.go (Go)

Code before:
//     kernel support).
//
// Packets originating on the bridge's own interface and addressed directly to the
// container are allowed - the host always has direct access to its own containers
// (it doesn't need to use the port mapped to its own addresses, although it can).
//
// "Trusted interfaces" are treated in the same way as the bridge itself.
func (n *Network) filterDirectAccess(ctx context.Context, ipv iptables.IPVersion, config NetworkConfigFam, epIP netip.Addr, enable bool) error {
	if n.Internal || config.Unprotected || config.Routed {
		return nil
	}
	// For config that may change between daemon restarts, make sure rules are
	// removed - if the container was left running when the daemon stopped, and
	// direct routing has since been disabled, the rules need to be deleted when
	// cleanup happens on restart. This also means a change in config over a
	// live-restore restart will take effect.
	if n.ipt.AllowDirectRouting || rawRulesDisabled(ctx) {
		enable = false
	}
	for _, ifName := range n.TrustedHostInterfaces {
		accept := iptables.Rule{IPVer: ipv, Table: iptables.Raw, Chain: "PREROUTING", Args: []string{
			"-d", epIP.String(),
			"-i", ifName,
			"-j", "ACCEPT",
		}}
		if err := appendOrDelChainRule(accept, "DIRECT ACCESS FILTERING - DROP", enable); err != nil {
			return err
		}
	}
	accept := iptables.Rule{IPVer: ipv, Table: iptables.Raw, Chain: "PREROUTING", Args: []string{
		"-d", epIP.String(),
		"!", "-i", n.IfName,
		"-j", "DROP",
	}}
	return appendOrDelChainRule(accept, "DIRECT ACCESS FILTERING - DROP", enable)
}


Review comment (suggestion):
```suggestion
		if err := appendOrDelChainRule(accept, "DIRECT ACCESS FILTERING - ACCEPT", enable); err != nil {
```

Code after:
//     kernel support).
//
// Packets originating on the bridge's own interface and addressed directly to the
// container are allowed - the host always has direct access to its own containers
// (it doesn't need to use the port mapped to its own addresses, although it can).
//
// "Trusted interfaces" are treated in the same way as the bridge itself.
func (n *Network) filterDirectAccess(ctx context.Context, ipv iptables.IPVersion, config NetworkConfigFam, epIP netip.Addr, enable bool) error {
	if n.Internal || config.Unprotected || config.Routed {
		return nil
	}
	// For config that may change between daemon restarts, make sure rules are
	// removed - if the container was left running when the daemon stopped, and
	// direct routing has since been disabled, the rules need to be deleted when
	// cleanup happens on restart. This also means a change in config over a
	// live-restore restart will take effect.
	if n.ipt.AllowDirectRouting || rawRulesDisabled(ctx) {
		enable = false
	}
	for _, ifName := range n.TrustedHostInterfaces {
		accept := iptables.Rule{IPVer: ipv, Table: iptables.Raw, Chain: "PREROUTING", Args: []string{
			"-d", epIP.String(),
			"-i", ifName,
			"-j", "ACCEPT",
		}}
		if err := appendOrDelChainRule(accept, "DIRECT ACCESS FILTERING - ACCEPT", enable); err != nil {
			return err
		}
	}
	accept := iptables.Rule{IPVer: ipv, Table: iptables.Raw, Chain: "PREROUTING", Args: []string{
		"-d", epIP.String(),
		"!", "-i", n.IfName,
		"-j", "DROP",
	}}
	return appendOrDelChainRule(accept, "DIRECT ACCESS FILTERING - DROP", enable)
}