summaryrefslogtreecommitdiff
path: root/libnetwork
Commit message (Collapse)AuthorAgeFilesLines
* libnetwork/docs: fix broken linkSebastiaan van Stijn2023-05-101-1/+1
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork: update example in README.mdSebastiaan van Stijn2023-05-101-6/+1
| | | | | | Align the example with the code updated in 4e0319c87857f180b01f9b072603cc385d7fcee1. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* [chore] clean up reexec.Init() callsCory Snider2023-05-094-33/+0
| | | | | | | | | | | | | | | | | Now that most uses of reexec have been replaced with non-reexec solutions, most of the reexec.Init() calls peppered throughout the test suites are unnecessary. Furthermore, most of the reexec.Init() calls in test code neglects to check the return value to determine whether to exit, which would result in the reexec'ed subprocesses proceeding to run the tests, which would reexec another subprocess which would proceed to run the tests, recursively. (That would explain why every reexec callback used to unconditionally call os.Exit() instead of returning...) Remove unneeded reexec.Init() calls from test and example code which no longer needs it, and fix the reexec.Init() calls which are not inert to exit after a reexec callback is invoked. Signed-off-by: Cory Snider <csnider@mirantis.com>
* libnetwork/osl: unify stubs for NeighOptionSebastiaan van Stijn2023-04-285-11/+9
| | | | | | Use the same signature for all platforms, but stub the neigh type. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork/osl: unify stubs for IfaceOptionSebastiaan van Stijn2023-04-285-11/+9
| | | | | | Use the same signature for all platforms, but stub the nwIface type. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork/osl: rename var that collided with importSebastiaan van Stijn2023-04-281-6/+6
| | | | | | Also renaming another var for consistency ':-) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork: add missing stub for getInitializers()Sebastiaan van Stijn2023-04-281-0/+8
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork: fix stubsSebastiaan van Stijn2023-04-281-9/+8
| | | | | | | | | - sandbox, endpoint changed in c71555f03042ca531e24f6368d7e8c128774926f, but missed updating the stubs. - add missing stub for Controller.cleanupServiceDiscovery() - While at it also doing some minor (formatting) changes. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork: overlayutils: remove redundant init()Sebastiaan van Stijn2023-04-281-6/+2
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork: inline sendKey() into SetExternalKey()Sebastiaan van Stijn2023-04-281-23/+5
| | | | | | | | | | | This function included a defer to close the net.Conn if an error occurred, but the calling function (SetExternalKey()) also had a defer to close it unconditionally. Rewrite it to use json.NewEncoder(), which accepts a writer, and inline the code. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork: setKey(): remove intermediate bufferSebastiaan van Stijn2023-04-281-5/+1
| | | | | | Use json.NewDecoder() instead, which accepts a reader. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork: don't register "libnetwork-setkey" re-exec on non-unixSebastiaan van Stijn2023-04-284-59/+24
| | | | | | | It's a no-op on Windows and other non-Linux, non-FreeBSD platforms, so there's no need to register the re-exec. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork: processSetKeyReexec: don't use logrus.Fatal()Sebastiaan van Stijn2023-04-281-1/+2
| | | | | | | | Just print the error and os.Exit() instead, which makes it more explicit that we're exiting, and there's no need to decorate the error. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork: processSetKeyReexec() remove defer()Sebastiaan van Stijn2023-04-281-13/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Split the function into a "backing" function that returns an error, and the re-exec entrypoint, which handles the error to provide a more idiomatic approach. This was part of a larger change accross multiple re-exec functions (now removed). For history's sake; here's the description for that; The `reexec.Register()` function accepts reexec entrypoints, which are a `func()` without return (matching a binary's `main()` function). As these functions cannot return an error, it's the entrypoint's responsibility to handle any error, and to indicate failures through `os.Exit()`. I noticed that some of these entrypoint functions had `defer()` statements, but called `os.Exit()` either explicitly or implicitly (e.g. through `logrus.Fatal()`). defer statements are not executed if `os.Exit()` is called, which rendered these statements useless. While I doubt these were problematic (I expect files to be closed when the process exists, and `runtime.LockOSThread()` to not have side-effects after exit), it also didn't seem to "hurt" to call these as was expected by the function. This patch rewrites some of the entrypoints to split them into a "backing function" that can return an error (being slightly more iodiomatic Go) and an wrapper function to act as entrypoint (which can handle the error and exit the executable). To some extend, I'm wondering if we should change the signatures of the entrypoints to return an error so that `reexec.Init()` can handle (or return) the errors, so that logging can be handled more consistently (currently, some some use logrus, some just print); this would also keep logging out of some packages, as well as allows us to provide more metadata about the error (which reexec produced the error for example). A quick search showed that there's some external consumers of pkg/reexec, so I kept this for a future discussion / exercise. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork/resolvconf: fix some minor (linting) issuesSebastiaan van Stijn2023-04-261-9/+10
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork/resolvconf: improve tests for BuildSebastiaan van Stijn2023-04-261-15/+18
| | | | | | | | - Verify the content to be equal, not "contains"; this output should be predictable. - Also verify the content returned by the function to match. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork/resolvconf: refactor tests for readabilitySebastiaan van Stijn2023-04-261-66/+188
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork/resolvconf: allow tests to be run on unixSebastiaan van Stijn2023-04-261-0/+3
| | | | | | | | Looks like the intent is to exclude windows (which wouldn't have /etc/resolv.conf nor systemd), but most tests would run fine elsewhere. This allows running the tests on macOS for local testing. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork/resolvconf: use t.TempDir(), change t.Fatal to t.ErrorSebastiaan van Stijn2023-04-261-27/+27
| | | | | | | Use t.TempDir() for convenience, and change some t.Fatal's to Errors, so that all tests can run instead of failing early. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork/resolvconf: fix TestGet() testing wrong pathSebastiaan van Stijn2023-04-261-6/+6
| | | | | | | | | | | The test was assuming that the "source" file was always "/etc/resolv.conf", but the `Get()` function uses `Path()` to find the location of resolv.conf, which may be different. While at it, also changed some `t.Fatalf()` to `t.Errorf()`, and renamed some variables for clarity. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork/resolvconf: use []byte for hash instead of stringSebastiaan van Stijn2023-04-265-24/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After my last change, I noticed that the hash is used as a []byte in most cases (other than tests). This patch updates the type to use a []byte, which (although unlikely very important) also improves performance: Compared to the previous version: benchstat new.txt new2.txt name old time/op new time/op delta HashData-10 128ns ± 1% 116ns ± 1% -9.77% (p=0.000 n=20+20) name old alloc/op new alloc/op delta HashData-10 208B ± 0% 88B ± 0% -57.69% (p=0.000 n=20+20) name old allocs/op new allocs/op delta HashData-10 3.00 ± 0% 2.00 ± 0% -33.33% (p=0.000 n=20+20) And compared to the original version: benchstat old.txt new2.txt name old time/op new time/op delta HashData-10 201ns ± 1% 116ns ± 1% -42.39% (p=0.000 n=18+20) name old alloc/op new alloc/op delta HashData-10 416B ± 0% 88B ± 0% -78.85% (p=0.000 n=20+20) name old allocs/op new allocs/op delta HashData-10 6.00 ± 0% 2.00 ± 0% -66.67% (p=0.000 n=20+20) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork/resolvconf: simplify hashData() and improve performanceSebastiaan van Stijn2023-04-264-36/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The code seemed overly complicated, requiring a reader to be constructed, where in all cases, the data was already available in a variable. This patch simplifies the utility to not require a reader, which also makes it a bit more performant: go install golang.org/x/perf/cmd/benchstat@latest GO111MODULE=off go test -run='^$' -bench=. -count=20 > old.txt GO111MODULE=off go test -run='^$' -bench=. -count=20 > new.txt benchstat old.txt new.txt name old time/op new time/op delta HashData-10 201ns ± 1% 128ns ± 1% -36.16% (p=0.000 n=18+20) name old alloc/op new alloc/op delta HashData-10 416B ± 0% 208B ± 0% -50.00% (p=0.000 n=20+20) name old allocs/op new allocs/op delta HashData-10 6.00 ± 0% 3.00 ± 0% -50.00% (p=0.000 n=20+20) A small change was made in `Build()`, which previously returned the resolv.conf data, even if the function failed to write it. In the new variation, `nil` is consistently returned on failures. Note that in various places, the hash is not even used, so we may be able to simplify things more after this. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Merge pull request #45308 from corhere/libnet/overlay-bpf-ipv6Sebastiaan van Stijn2023-04-262-10/+240
|\ | | | | libnetwork/drivers/overlay: make VNI matcher IPv6-compatible
| * libn/d/overlay: make VNI matcher IPv6-compatibleCory Snider2023-04-241-10/+13
| | | | | | | | | | | | | | | | Use Linux BPF extensions to locate the offset of the VXLAN header within the packet so that the same BPF program works with VXLAN packets received over either IPv4 or IPv6. Signed-off-by: Cory Snider <csnider@mirantis.com>
| * libn/d/overlay: test the VNI BPF matcher on IPv4Cory Snider2023-04-241-0/+227
| | | | | | | | Signed-off-by: Cory Snider <csnider@mirantis.com>
* | Merge pull request #45366 from akerouanton/fix-docker0-PreferredPoolBrian Goff2023-04-251-2/+8
|\ \ | |/ |/| daemon: set docker0 subpool as the IPAM pool
| * daemon: set docker0 subpool as the IPAM poolAlbin Kerouanton2023-04-251-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since cc19eba (backported to v23.0.4), the PreferredPool for docker0 is set only when the user provides the bip config parameter or when the default bridge already exist. That means, if a user provides the fixed-cidr parameter on a fresh install or reboot their computer/server without bip set, dockerd throw the following error when it starts: > failed to start daemon: Error initializing network controller: Error > creating default "bridge" network: failed to parse pool request for > address space "LocalDefault" pool "" subpool "100.64.0.0/26": Invalid > Address SubPool See #45356. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
* | Merge pull request #45310 from corhere/libn/delete-network-more-atomicallyBjorn Neergaard2023-04-201-3/+0
|\ \ | | | | | | libnetwork: clean up inDelete network atomically
| * | libnetwork: clean up inDelete network atomicallyCory Snider2023-04-111-3/+0
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The (*network).ipamRelease function nils out the network's IPAM info fields, putting the network struct into an inconsistent state. The network-restore startup code panics if it tries to restore a network from a struct which has fewer IPAM config entries than IPAM info entries. Therefore (*network).delete contains a critical section: by persisting the network to the store after ipamRelease(), the datastore will contain an inconsistent network until the deletion operation completes and finishes deleting the network from the datastore. If for any reason the deletion operation is interrupted between ipamRelease() and deleteFromStore(), the daemon will crash on startup when it tries to restore the network. Updating the datastore after releasing the network's IPAM pools may have served a purpose in the past, when a global datastore was used for intra-cluster communication and the IPAM allocator had persistent global state, but nowadays there is no global datastore and the IPAM allocator has no persistent state whatsoever. Remove the vestigial datastore update as it is no longer necessary and only serves to cause problems. If the network deletion is interrupted before the network is deleted from the datastore, the deletion will resume during the next daemon startup, including releasing the IPAM pools. Signed-off-by: Cory Snider <csnider@mirantis.com>
* | libnet/d/overlay: clean up iptables rules on network deleteAlbin Kerouanton2023-04-171-0/+19
|/ | | | | | | | | | | This commit removes iptables rules configured for secure overlay networks when a network is deleted. Prior to this commit, only CreateNetwork() was taking care of removing stale iptables rules. If one of the iptables rule can't be removed, the erorr is logged but it doesn't prevent network deletion. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
* Merge pull request #44965 from akerouanton/libnetwork-dead-codeSebastiaan van Stijn2023-04-1113-1870/+86
|\ | | | | libnetwork/overlay: remove dead code
| * libnetwork/overlay: remove host modeAlbin Kerouanton2023-04-063-296/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linux kernel prior to v3.16 was not supporting netns for vxlan interfaces. As such, moby/libnetwork#821 introduced a "host mode" to the overlay driver. The related kernel fix is available for rhel7 users since v7.2. This mode could be forced through the use of the env var _OVERLAY_HOST_MODE. However this env var has never been documented and is not referenced in any blog post, so there's little chance many people rely on it. Moreover, this host mode is deemed as an implementation details by maintainers. As such, we can consider it dead and we can remove it without a prior deprecation warning. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork/overlay: remove KVObject implementationAlbin Kerouanton2023-04-062-252/+5
| | | | | | | | | | | | | | | | Since 0fa873c, there's no function writing overlay networks to some datastore. As such, overlay network struct doesn't need to implement KVObject interface. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork/overlay: don't lock network when accessing subnet vniAlbin Kerouanton2023-04-061-6/+0
| | | | | | | | | | | | | | | | Since a few commits, subnet's vni don't change during the lifetime of the subnet struct, so there's no need to lock the network before accessing it. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork: remove local store from overlay driverAlbin Kerouanton2023-04-064-47/+0
| | | | | | | | | | | | | | Since the previous commit, data from the local store are never read, thus proving it was only used for Classic Swarm. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork/overlay: remove live-restore supportAlbin Kerouanton2023-04-064-120/+24
| | | | | | | | | | | | | | | | The overlay driver in Swarm v2 mode doesn't support live-restore, ie. the daemon won't even start if the node is part of a Swarm cluster and live-restore is enabled. This feature was only used by Swarm Classic. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork/overlay: remove vni allocationAlbin Kerouanton2023-04-064-86/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | VNI allocations made by the overlay driver were only used by Classic Swarm. With Swarm v2 mode, the driver ovmanager is responsible of allocating & releasing them. Previously, vxlanIdm was initialized when a global store was available but since 142b522, no global store can be instantiated. As such, releaseVxlanID actually does actually nothing and iptables rules are never removed. The last line of dead code detected by golangci-lint is now gone. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork/overlay: remove Serf-based clusteringAlbin Kerouanton2023-04-066-578/+6
| | | | | | | | | | | | | | | | | | | | Prior to 0fa873c, the serf-based event loop was started when a global store was available. Since there's no more global store, this event loop and all its associated code is dead. Most dead code detected by golangci-lint in prior commits is now gone. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork/netlabel: remove dead codeAlbin Kerouanton2023-04-062-43/+2
| | | | | | | | | | | | | | | | | | | | | | | | - LocalKVProvider, LocalKVProviderURL, LocalKVProviderConfig, GlobalKVProvider, GlobalKVProviderURL and GlobalKVProviderConfig are all unused since moby/libnetwork@be2b6962 (moby/libnetwork#908). - GlobalKVClient is unused since 0fa873c and c8d2c6e. - MakeKVProvider, MakeKVProviderURL and MakeKVProviderConfig are unused since 96cfb076 (moby/moby#44683). - MakeKVClient is unused since 142b5229 (moby/moby#44875). Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork/netutils: remove dead codeAlbin Kerouanton2023-04-061-52/+0
| | | | | | | | | | | | | | | | | | - GetIfaceAddr is unused since moby/libnetwork@e51ead59 (moby/libnetwork#670). - ValidateAlias and ParseAlias are unused since moby/moby@0645eb84 (moby/moby#42539). Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork: remove unused props from windows overlay driverAlbin Kerouanton2023-04-061-31/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The overlay driver was creating a global store whenever netlabel.GlobalKVClient was specified in its config argument. This specific label is unused anymore since 142b522 (moby/moby#44875). It was also creating a local store whenever netlabel.LocalKVClient was specificed in its config argument. This store is unused since moby/libnetwork@9e72136 (moby/libnetwork#1636). Finally, the sync.Once properties are never used and thus can be deleted. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork: remove global store from overlay driverAlbin Kerouanton2023-04-063-188/+3
| | | | | | | | | | | | | | | | | | | | | | The overlay driver was creating a global store whenever netlabel.GlobalKVClient was specified in its config argument. This specific label is not used anymore since 142b522 (moby/moby#44875). golangci-lint now detects dead code. This will be fixed in subsequent commits. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork: remove ovrouter cmdAlbin Kerouanton2023-04-062-177/+0
| | | | | | | | | | | | | | | | | | | | This command was useful when overlay networks based on external KV store was developed but is unused nowadays. As the last reference to OverlayBindInterface and OverlayNeighborIP netlabels are in the ovrouter cmd, they're removed too. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
* | libn/d/overlay: only program xt_bpf rulesCory Snider2023-04-054-76/+17
|/ | | | | | | | Drop support for platforms which only have xt_u32 but not xt_bpf. No attempt is made to clean up old xt_u32 iptables rules left over from a previous daemon instance. Signed-off-by: Cory Snider <csnider@mirantis.com>
* Merge pull request from GHSA-232p-vwff-86mpSebastiaan van Stijn2023-04-048-55/+231
|\ | | | | libnetwork: ensure encryption is mandatory on encrypted overlay networks
| * libnet/d/overlay: insert the input-drop ruleCory Snider2023-03-221-7/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FirewallD creates the root INPUT chain with a default-accept policy and a terminal rule which rejects all packets not accepted by any prior rule. Any subsequent rules appended to the chain are therefore inert. The administrator would have to open the VXLAN UDP port to make overlay networks work at all, which would result in all VXLAN traffic being accepted and defeating our attempts to enforce encryption on encrypted overlay networks. Insert the rule to drop unencrypted VXLAN packets tagged for encrypted overlay networks at the top of the INPUT chain so that enforcement of mandatory encryption takes precedence over any accept rules configured by the administrator. Continue to append the accept rule to the bottom of the chain so as not to override any administrator-configured drop rules. Signed-off-by: Cory Snider <csnider@mirantis.com>
| * libnet/d/overlay: add BPF-powered VNI matcherCory Snider2023-03-155-9/+112
| | | | | | | | | | | | | | | | | | | | | | | | Some newer distros such as RHEL 9 have stopped making the xt_u32 kernel module available with the kernels they ship. They do ship the xt_bpf kernel module, which can do everything xt_u32 can and more. Add an alternative implementation of the iptables match rule which uses xt_bpf to implement exactly the same logic as the u32 filter using a BPF program. Try programming the BPF-powered rules as a fallback when programming the u32-powered rules fails. Signed-off-by: Cory Snider <csnider@mirantis.com>
| * libnet/d/overlay: extract VNI match rule builderCory Snider2023-03-152-8/+34
| | | | | | | | | | | | | | | | | | | | The iptables rule clause used to match on the VNI of VXLAN datagrams looks like line noise to the uninitiated. It doesn't help that the expression is repeated twice and neither copy has any commentary. DRY out the rule builder to a common function, and document what the rule does and how it works. Signed-off-by: Cory Snider <csnider@mirantis.com>
| * libn/d/overlay: enforce encryption on sandbox initCory Snider2023-03-154-32/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The iptables rules which make encryption mandatory on an encrypted overlay network are only programmed once there is a second node participating in the network. This leaves single-node encrypted overlay networks vulnerable to packet injection. Furthermore, failure to program the rules is not treated as a fatal error. Program the iptables rules to make encryption mandatory before creating the VXLAN link to guarantee that there is no window of time where incoming cleartext VXLAN packets for the network would be accepted, or outgoing cleartext packets be transmitted. Only create the VXLAN link if programming the rules succeeds to ensure that it fails closed. Signed-off-by: Cory Snider <csnider@mirantis.com>
| * libnet/d/overlay: document some encryption codeCory Snider2023-03-151-8/+43
| | | | | | | | | | | | | | | | | | The overlay-network encryption code is woefully under-documented, which is especially problematic as it operates on under-documented kernel interfaces. Document what I have puzzled out of the implementation for the benefit of the next poor soul to touch this code. Signed-off-by: Cory Snider <csnider@mirantis.com>
View Lorry Controller Status