sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-18 04:39:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

Preserve pre-existing ipsets and roll back partial route ACL installs

Browse Source
This commit is contained in:
Viktor Liu
2026-08-12 17:41:08 +02:00
parent 360e2d4ce1
commit ffd696d75f
3 changed files with 70 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/firewall/iptables/acl_linux.go
+8 -2
View File
@@ -92,6 +92,10 @@ func (m *aclManager) AddPeerFiltering(
return m.addPeerRule(ip, protocol, sPort, dPort, action, "")
}
// A set that is already in the store backs rules installed earlier, so it must
// survive this call's failure.
_, preexisting := m.ipsetStore.ipset(ipsetName)
rules, err := m.addPeerRule(ip, protocol, sPort, dPort, action, ipsetName)
if err == nil {
return rules, nil
@@ -102,10 +106,12 @@ func (m *aclManager) AddPeerFiltering(
return nil, err
}
// The set could not be created or matched. Drop whatever was created and
// The set could not be created or matched. Drop the one this call created and
// retry the rule matching the IP directly; only if that succeeds do we know
// ipset was to blame and latch it off for subsequent rules.
m.discardIPSet(ipsetName)
if !preexisting {
m.discardIPSet(ipsetName)
}
rules, retryErr := m.addPeerRule(ip, protocol, sPort, dPort, action, "")
if retryErr != nil {