Bridge driver数据结构如下所示:
type driver struct {
config *configuration
network *bridgeNetwork
natChain *iptables.ChainInfo
filterChain *iptables.ChainInfo
isolationChain *iptables.ChainInfo
networks map[string]*bridgeNetwork
store datastore.DataStore
nlh *netlink.Handle
sync.Mutex
}
// driver/bridge/bridge.go
// Init registers a new instance of bridge driver
1、func Init(dc driverapi.DriverCallback, config map[string]interface{})
- 调用d := newDriver(),初始化driver数据结构
- 调用d.configure(config)对driver进行配置
- 创建c := driverapi.Capability{DataScope: datastore.LocalScope}
- 调用return dc.RegisterDriver(networkType, d, c)
configure数据结构如下所示:
// configuration info for the "bridge" driver
type configuration struct {
EnableIPForwarding bool
EnableIPTables bool
EnableUserlandProxy bool
UserlandProxyPath string
}
// driver/bridge/bridge.go
2、func (d *driver) configure(option map[string]interface{}) error
- 首先从option中解析出config
- 若config.EnableIPTables为真,则先调用removeIPChains(),再调用netChain, filterChain, isolationChain, err = setupIPChain(config)获取各个chain,最后,调用iptables.OnReloaded(func() {logrus.Debugf("Recreating iptables chains on firewall reloaded"); setupIPChain(config)})
- 若config.EnableIPForwarding为真,则调用setupIPForwarding(config.EnableIPTables)
- 接着对d.natChain,d.filterChain,d.isolationChain和d.config分别进行赋值
- 调用err = d.initStore(option)
--------------------------------------------------------- IPTables 配置 --------------------------------------------------------------------
// driver/bridge/setup_ip_tables.go
3、func setupIPChain(config *configuration) (*iptables.ChainInfo, *iptables.ChainInfo, *iptables.ChainInfo, error)
- 设置hairpinMode := !config.EnableUserlanProxy
- 调用netChain, err := iptables.NewChain(DockerChain, iptables.Nat, hairpinMode)
- 调用filterChain, err := iptables.NewChain(DockerChain, iptables.Filter, false),对于isolationChain的调用完全相同
- 调用err := addReturnRule(IsolationChain) ---->为该chain添加返回规则`iptables -I chain -j RETURN`
此函数只是创建了三个chain的实例,并将它们添加到主机中
// iptables/iptables.go
// NewChain adds a new chain to ip tables.
4、func NewChain(name string, table Table, hairpinMode bool) (*ChainInfo, error)
- 用参数填充c := &ChainInfo{},若table为空,则默认置为Filter
- 调用Raw("-t", string(c.Table), "-n", "-L", c.Name)和output, err := Raw("-t", string(c.Table), "-N", c.Name)添加chain,如果不存在的话,Raw函数直接调用iptables系统命令
ChainInfo数据结构如下所示:
// ChainInfo defines the iptables chain type ChainInfo struct {
Name string
Table Table
HairpinMode bool
}
--------------------------------------------------- IP Forward 配置 ----------------------------------------------------
// driver/bridge/set_ip_forwarding.go
5、func setupIPForwarding(enableIPTables bool) error
- 首先调用ipv4ForwardData, err := ioutil.ReadFile(ipv4ForwardConf)获取当前IPv4 forward的状态,其中ipv4ForwardConf=/proc/sys/net/ipv4/ip_forward
- 若ipv4ForwardData[0]不为'1',则调用configureIPForwarding(true),其实就是将ipv4ForwardConf内容写为'1'
- 如果enableIPTables为假,则返回,否则调用iptables.SetDefaultPolicy(iptables.Filter, "FORWARDING", iptables.Drop),并且接着调用iptables.OnReloaded(..)