Repository: moby/moby
File: libnetwork/drivers/bridge/bridge_linux.go (Go)

Code before:

	n.Lock()
	defer n.Unlock()
	if ep, ok := n.endpoints[eid]; ok {
		return ep, nil
	}

	return nil, nil
}

// Install/Removes the iptables rules needed to isolate this network
// from each of the other networks
func (n *bridgeNetwork) isolateNetwork(enable bool) error {
	n.Lock()
	thisConfig := n.config
	n.Unlock()

	if thisConfig.Internal {
		return nil
	}

	// Install the rules to isolate this network against each of the other networks
	if n.driver.config.EnableIPTables {
		// Only create the rules if the network has IPv4 enabled. But, always delete
		// rules, in case they were set up by an older daemon that didn't check whether
		// the network has IPv4.
		if !enable || thisConfig.EnableIPv4 {
			if err := setINC(iptables.IPv4, thisConfig.BridgeName, thisConfig.GwModeIPv4, enable); err != nil {
				return err
			}
		}
	}
	if n.driver.config.EnableIP6Tables {
		// Only create the rules if the network has IPv6 enabled. But, always delete
		// rules, in case they were set up by an older daemon that didn't check whether
		// the network has IPv6.
		if !enable || thisConfig.EnableIPv6 {
			if err := setINC(iptables.IPv6, thisConfig.BridgeName, thisConfig.GwModeIPv6, enable); err != nil {
				return err
			}
		}
	}

	return nil
}

func (d *driver) configure(option map[string]interface{}) error {
	var config configuration
	switch opt := option[netlabel.GenericData].(type) {
	case options.Generic:
		opaqueConfig, err := options.GenerateFromModel(opt, &configuration{})

Review comment (suggestion):
I find this version more confusing than the previous was, and now the comment right before `if n.driver.config.EnableIPTables` contradicts the inner comment as it talks about "installing" while the inner comment mentions the delete case.

But that's usual level of bikeshedding I guess, so whatever feels best for you seems okay to me.

Code after:

	n.Lock()
	defer n.Unlock()
	if ep, ok := n.endpoints[eid]; ok {
		return ep, nil
	}

	return nil, nil
}

// Install (enable=true) or remove (enable=false) the iptables rules needed to isolate this network
// from each of the other bridge networks
func (n *bridgeNetwork) isolateNetwork(enable bool) error {
	n.Lock()
	thisConfig := n.config
	n.Unlock()

	if thisConfig.Internal {
		return nil
	}

	if n.driver.config.EnableIPTables {
		// Only create the rules if the network has IPv4 enabled. But, always delete
		// rules, in case they were set up by an older daemon that didn't check whether
		// the network has IPv4.
		if !enable || thisConfig.EnableIPv4 {
			if err := setINC(iptables.IPv4, thisConfig.BridgeName, thisConfig.GwModeIPv4, enable); err != nil {
				return err
			}
		}
	}
	if n.driver.config.EnableIP6Tables {
		// Only create the rules if the network has IPv6 enabled. But, always delete
		// rules, in case they were set up by an older daemon that didn't check whether
		// the network has IPv6.
		if !enable || thisConfig.EnableIPv6 {
			if err := setINC(iptables.IPv6, thisConfig.BridgeName, thisConfig.GwModeIPv6, enable); err != nil {
				return err
			}
		}
	}

	return nil
}

func (d *driver) configure(option map[string]interface{}) error {
	var config configuration
	switch opt := option[netlabel.GenericData].(type) {
	case options.Generic:
		opaqueConfig, err := options.GenerateFromModel(opt, &configuration{})
		if err != nil {