Merge pull request #29 from scraperwiki/redirection-fix

Prevent redirection of non-local packets
sensiblecodeio · Dec 12, 2014 · 3e36515 · 3e36515
2 parents 56c0a21 + 1e22208
commit 3e36515
Showing 1 changed file with 9 additions and 4 deletions.
diff --git a/iptables.go b/iptables.go
@@ -35,17 +35,22 @@ func iptables(action Action, chain string, source, target int, ipAddress string)
 		cmd = exec.Command(
 			"iptables", "--insert", chain, "1",
 			"--table", "nat",
-			"--protocol", "tcp", "--match", "tcp",
-			"!", "--destination", ipAddress,
+			"--protocol", "tcp",
+			// Prevent redirection of packets already going to the container
+			"--match", "tcp", "!", "--destination", ipAddress,
+			// Prevent redirection of ports on remote servers
+			// (i.e, don't make google:80 hit our container)
+			"--match", "addrtype", "--dst-type", "LOCAL",
 			"--dport", fmt.Sprint(source),
 			"--jump", "REDIRECT",
 			"--to-ports", fmt.Sprint(target))
 	case DELETE:
 		cmd = exec.Command(
 			"iptables", "--delete", chain,
 			"--table", "nat",
-			"--protocol", "tcp", "--match", "tcp",
-			"!", "--destination", ipAddress,
+			"--protocol", "tcp",
+			"--match", "tcp", "!", "--destination", ipAddress,
+			"--match", "addrtype", "--dst-type", "LOCAL",
 			"--dport", fmt.Sprint(source),
 			"--jump", "REDIRECT",
 			"--to-ports", fmt.Sprint(target))