Repository: moby/moby
File: daemon/libnetwork/drivers/bridge/bridge_linux.go (Go)

Code before:
	}

	d.mu.Lock()
	d.config = config
	d.mu.Unlock()

	// Register for an event when firewalld is reloaded, but take the config lock so
	// that events won't be processed until the initial load from Store is complete.
	d.configNetwork.Lock()
	defer d.configNetwork.Unlock()
	iptables.OnReloaded(d.handleFirewalldReload)

	return d.initStore()
}

var newFirewaller = func(ctx context.Context, config firewaller.Config) (firewaller.Firewaller, error) {
	if nftables.Enabled() {
		fw, err := nftabler.NewNftabler(ctx, config)
		if err != nil {
			return nil, err
		}
		// Without seeing config (interface names, addresses, and so on), the iptabler's
		// cleaner can't clean up network or port-specific rules that may have been added
		// to iptables built-in chains. So, if cleanup is needed, give the cleaner to
		// the nftabler. Then, it'll use it to delete old rules as networks are restored.
		fw.SetFirewallCleaner(iptabler.NewCleaner(ctx, config))
		return fw, nil
	}

	// The nftabler can clean all of its rules in one go. So, even if there's cleanup
	// to do, there's no need to pass a cleaner to the iptabler.
	nftabler.Cleanup(ctx, config)
	return iptabler.NewIptabler(ctx, config)
}

func (d *driver) getNetwork(id string) (*bridgeNetwork, error) {
	d.mu.Lock()
	defer d.mu.Unlock()

	if id == "" {
		return nil, types.InvalidParameterErrorf("invalid network id: %s", id)
	}

	if nw, ok := d.networks[id]; ok {
		return nw, nil
	}

	return nil, types.NotFoundErrorf("network not found: %s", id)
}

func parseNetworkGenericOptions(data interface{}) (*networkConfiguration, error) {

Review comment (suggestion):
Not for this PR, just that my curiosity led me there; this looks to be the only place where we call `fw.SetFirewallCleaner` to a _non nil_ value, and the constructor is above.

Which made me curious if this should be done as part of the constructor, possibly with a `DisableCleaner()`, `DestroyCleaner`, `StopCleaning()` (or whatever) on the `Nftabler` type.


Code after:
	}

	d.mu.Lock()
	d.config = config
	d.mu.Unlock()

	// Register for an event when firewalld is reloaded, but take the config lock so
	// that events won't be processed until the initial load from Store is complete.
	d.configNetwork.Lock()
	defer d.configNetwork.Unlock()
	iptables.OnReloaded(d.handleFirewalldReload)

	return d.initStore()
}

var newFirewaller = func(ctx context.Context, config firewaller.Config) (firewaller.Firewaller, error) {
	if nftables.Enabled() {
		fw, err := nftabler.NewNftabler(ctx, config)
		if err != nil {
			return nil, err
		}
		// Without seeing config (interface names, addresses, and so on), the iptabler's
		// cleaner can't clean up network or port-specific rules that may have been added
		// to iptables built-in chains. So, if cleanup is needed, give the cleaner to
		// the nftabler. Then, it'll use it to delete old rules as networks are restored.
		fw.SetFirewallCleaner(iptabler.NewCleaner(ctx, config))
		return fw, nil
	}

	// The nftabler can clean all of its rules in one go. So, even if there's cleanup
	// to do, there's no need to pass a cleaner to the iptabler.
	nftabler.Cleanup(ctx, config)
	return iptabler.NewIptabler(ctx, config)
}

func (d *driver) getNetwork(id string) (*bridgeNetwork, error) {
	d.mu.Lock()
	defer d.mu.Unlock()

	if id == "" {
		return nil, types.InvalidParameterErrorf("invalid network id: %s", id)
	}

	if nw, ok := d.networks[id]; ok {
		return nw, nil
	}

	return nil, types.NotFoundErrorf("network not found: %s", id)
}

func parseNetworkGenericOptions(data any) (*networkConfiguration, error) {