summaryrefslogtreecommitdiff
path: root/libnetwork/drivers/overlay
Commit message (Collapse)AuthorAgeFilesLines
* libnetwork: overlayutils: remove redundant init()Sebastiaan van Stijn2023-04-281-6/+2
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libn/d/overlay: make VNI matcher IPv6-compatibleCory Snider2023-04-241-10/+13
| | | | | | | | Use Linux BPF extensions to locate the offset of the VXLAN header within the packet so that the same BPF program works with VXLAN packets received over either IPv4 or IPv6. Signed-off-by: Cory Snider <csnider@mirantis.com>
* libn/d/overlay: test the VNI BPF matcher on IPv4Cory Snider2023-04-241-0/+227
| | | | Signed-off-by: Cory Snider <csnider@mirantis.com>
* libnet/d/overlay: clean up iptables rules on network deleteAlbin Kerouanton2023-04-171-0/+19
| | | | | | | | | | | This commit removes iptables rules configured for secure overlay networks when a network is deleted. Prior to this commit, only CreateNetwork() was taking care of removing stale iptables rules. If one of the iptables rule can't be removed, the erorr is logged but it doesn't prevent network deletion. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
* Merge pull request #44965 from akerouanton/libnetwork-dead-codeSebastiaan van Stijn2023-04-119-1569/+84
|\ | | | | libnetwork/overlay: remove dead code
| * libnetwork/overlay: remove host modeAlbin Kerouanton2023-04-063-296/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linux kernel prior to v3.16 was not supporting netns for vxlan interfaces. As such, moby/libnetwork#821 introduced a "host mode" to the overlay driver. The related kernel fix is available for rhel7 users since v7.2. This mode could be forced through the use of the env var _OVERLAY_HOST_MODE. However this env var has never been documented and is not referenced in any blog post, so there's little chance many people rely on it. Moreover, this host mode is deemed as an implementation details by maintainers. As such, we can consider it dead and we can remove it without a prior deprecation warning. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork/overlay: remove KVObject implementationAlbin Kerouanton2023-04-062-252/+5
| | | | | | | | | | | | | | | | Since 0fa873c, there's no function writing overlay networks to some datastore. As such, overlay network struct doesn't need to implement KVObject interface. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork/overlay: don't lock network when accessing subnet vniAlbin Kerouanton2023-04-061-6/+0
| | | | | | | | | | | | | | | | Since a few commits, subnet's vni don't change during the lifetime of the subnet struct, so there's no need to lock the network before accessing it. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork: remove local store from overlay driverAlbin Kerouanton2023-04-064-47/+0
| | | | | | | | | | | | | | Since the previous commit, data from the local store are never read, thus proving it was only used for Classic Swarm. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork/overlay: remove live-restore supportAlbin Kerouanton2023-04-064-120/+24
| | | | | | | | | | | | | | | | The overlay driver in Swarm v2 mode doesn't support live-restore, ie. the daemon won't even start if the node is part of a Swarm cluster and live-restore is enabled. This feature was only used by Swarm Classic. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork/overlay: remove vni allocationAlbin Kerouanton2023-04-064-86/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | VNI allocations made by the overlay driver were only used by Classic Swarm. With Swarm v2 mode, the driver ovmanager is responsible of allocating & releasing them. Previously, vxlanIdm was initialized when a global store was available but since 142b522, no global store can be instantiated. As such, releaseVxlanID actually does actually nothing and iptables rules are never removed. The last line of dead code detected by golangci-lint is now gone. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork/overlay: remove Serf-based clusteringAlbin Kerouanton2023-04-066-578/+6
| | | | | | | | | | | | | | | | | | | | Prior to 0fa873c, the serf-based event loop was started when a global store was available. Since there's no more global store, this event loop and all its associated code is dead. Most dead code detected by golangci-lint in prior commits is now gone. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork/netlabel: remove dead codeAlbin Kerouanton2023-04-061-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | - LocalKVProvider, LocalKVProviderURL, LocalKVProviderConfig, GlobalKVProvider, GlobalKVProviderURL and GlobalKVProviderConfig are all unused since moby/libnetwork@be2b6962 (moby/libnetwork#908). - GlobalKVClient is unused since 0fa873c and c8d2c6e. - MakeKVProvider, MakeKVProviderURL and MakeKVProviderConfig are unused since 96cfb076 (moby/moby#44683). - MakeKVClient is unused since 142b5229 (moby/moby#44875). Signed-off-by: Albin Kerouanton <albinker@gmail.com>
| * libnetwork: remove global store from overlay driverAlbin Kerouanton2023-04-063-188/+3
| | | | | | | | | | | | | | | | | | | | | | The overlay driver was creating a global store whenever netlabel.GlobalKVClient was specified in its config argument. This specific label is not used anymore since 142b522 (moby/moby#44875). golangci-lint now detects dead code. This will be fixed in subsequent commits. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
* | libn/d/overlay: only program xt_bpf rulesCory Snider2023-04-054-76/+17
|/ | | | | | | | Drop support for platforms which only have xt_u32 but not xt_bpf. No attempt is made to clean up old xt_u32 iptables rules left over from a previous daemon instance. Signed-off-by: Cory Snider <csnider@mirantis.com>
* Merge pull request from GHSA-232p-vwff-86mpSebastiaan van Stijn2023-04-048-55/+231
|\ | | | | libnetwork: ensure encryption is mandatory on encrypted overlay networks
| * libnet/d/overlay: insert the input-drop ruleCory Snider2023-03-221-7/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FirewallD creates the root INPUT chain with a default-accept policy and a terminal rule which rejects all packets not accepted by any prior rule. Any subsequent rules appended to the chain are therefore inert. The administrator would have to open the VXLAN UDP port to make overlay networks work at all, which would result in all VXLAN traffic being accepted and defeating our attempts to enforce encryption on encrypted overlay networks. Insert the rule to drop unencrypted VXLAN packets tagged for encrypted overlay networks at the top of the INPUT chain so that enforcement of mandatory encryption takes precedence over any accept rules configured by the administrator. Continue to append the accept rule to the bottom of the chain so as not to override any administrator-configured drop rules. Signed-off-by: Cory Snider <csnider@mirantis.com>
| * libnet/d/overlay: add BPF-powered VNI matcherCory Snider2023-03-155-9/+112
| | | | | | | | | | | | | | | | | | | | | | | | Some newer distros such as RHEL 9 have stopped making the xt_u32 kernel module available with the kernels they ship. They do ship the xt_bpf kernel module, which can do everything xt_u32 can and more. Add an alternative implementation of the iptables match rule which uses xt_bpf to implement exactly the same logic as the u32 filter using a BPF program. Try programming the BPF-powered rules as a fallback when programming the u32-powered rules fails. Signed-off-by: Cory Snider <csnider@mirantis.com>
| * libnet/d/overlay: extract VNI match rule builderCory Snider2023-03-152-8/+34
| | | | | | | | | | | | | | | | | | | | The iptables rule clause used to match on the VNI of VXLAN datagrams looks like line noise to the uninitiated. It doesn't help that the expression is repeated twice and neither copy has any commentary. DRY out the rule builder to a common function, and document what the rule does and how it works. Signed-off-by: Cory Snider <csnider@mirantis.com>
| * libn/d/overlay: enforce encryption on sandbox initCory Snider2023-03-154-32/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The iptables rules which make encryption mandatory on an encrypted overlay network are only programmed once there is a second node participating in the network. This leaves single-node encrypted overlay networks vulnerable to packet injection. Furthermore, failure to program the rules is not treated as a fatal error. Program the iptables rules to make encryption mandatory before creating the VXLAN link to guarantee that there is no window of time where incoming cleartext VXLAN packets for the network would be accepted, or outgoing cleartext packets be transmitted. Only create the VXLAN link if programming the rules succeeds to ensure that it fails closed. Signed-off-by: Cory Snider <csnider@mirantis.com>
| * libnet/d/overlay: document some encryption codeCory Snider2023-03-151-8/+43
| | | | | | | | | | | | | | | | | | The overlay-network encryption code is woefully under-documented, which is especially problematic as it operates on under-documented kernel interfaces. Document what I have puzzled out of the implementation for the benefit of the next poor soul to touch this code. Signed-off-by: Cory Snider <csnider@mirantis.com>
* | libn/i/setmatrix: make generic and constructorlessCory Snider2023-03-291-8/+5
| | | | | | | | | | | | | | | | | | | | Allow SetMatrix to be used as a value type with a ready-to-use zero value. SetMatrix values are already non-copyable by virtue of having a mutex field so there is no harm in allowing non-pointer values to be used as local variables or struct fields. Any attempts to pass around by-value copies, e.g. as function arguments, will be flagged by go vet. Signed-off-by: Cory Snider <csnider@mirantis.com>
* | Merge pull request #45164 from corhere/libnet/peer-op-function-callBrian Goff2023-03-272-100/+21
|\ \ | |/ |/| libnetwork/d/overlay: handle peer ops directly
| * libnetwork/d/overlay: handle peer ops directlyCory Snider2023-03-142-100/+21
| | | | | | | | | | | | | | | | | | Funneling the peer operations into an unbuffered channel only serves to achieve the same result as a mutex, using a lot more boilerplate and indirection. Get rid of the boilerplate and unnecessary indirection by using a mutex and calling the operations directly. Signed-off-by: Cory Snider <csnider@mirantis.com>
* | libnetwork/i/setmatrix: devirtualizeCory Snider2023-03-141-1/+1
|/ | | | | | There is only one implementation. Get rid of the interface. Signed-off-by: Cory Snider <csnider@mirantis.com>
* libnetwork: drop DatastoreConfig discovery typeCory Snider2023-01-271-13/+0
| | | | | | | | | | | | | | | The DatastoreConfig discovery type is unused. Remove the constant and any resulting dead code. Today's biggest loser is the IPAM Allocator: DatastoreConfig was the only type of discovery event it was listening for, and there was no other place where a non-nil datastore could be passed into the allocator. Strip out all the dead persistence code from Allocator, leaving it as purely an in-memory implementation. There is no more need to check the consistency of the allocator's bit-sequences as there is no persistent storage for inconsistent bit sequences to be loaded from. Signed-off-by: Cory Snider <csnider@mirantis.com>
* libnet: convert to new-style driver registrationCory Snider2023-01-273-9/+16
| | | | | | | | | | | | | | | | | Per the Interface Segregation Principle, network drivers should not have to depend on GetPluginGetter methods they do not use. The remote network driver is the only one which needs a PluginGetter, and it is already special-cased in Controller so there is no sense warping the interfaces to achieve a foolish consistency. Replace all other network drivers' Init functions with Register functions which take a driverapi.Registerer argument instead of a driverapi.DriverCallback. Add back in Init wrapper functions for only the drivers which Swarmkit references so that Swarmkit can continue to build. Refactor the libnetwork Controller to use the new drvregistry.Networks and drvregistry.IPAMs driver registries in place of the legacy ones. Signed-off-by: Cory Snider <csnider@mirantis.com>
* libnetwork/netutils: refactor GenerateRandomNameBjorn Neergaard2023-01-241-1/+1
| | | | | | | | | GenerateRandomName now uses length to represent the overall length of the string; this will help future users avoid creating interface names that are too long for the kernel to accept by mistake. The test coverage is increased and cleaned up using gotest.tools. Signed-off-by: Bjorn Neergaard <bneergaard@mirantis.com>
* libnetwork: set default VLAN without reexecCory Snider2023-01-111-79/+59
| | | | Signed-off-by: Cory Snider <csnider@mirantis.com>
* libnetwork: Clean up sysfs-based operationsAlbin Kerouanton2023-01-111-0/+2
| | | | | | | | | | | - The oldest kernel version currently supported is v3.10. Bridge parameters can be set through netlink since v3.8 (see torvalds/linux@25c71c7). As such, we don't need to fallback to sysfs to set hairpin mode. - `scanInterfaceStats()` is never called, so no need to keep it alive. - Document why `default_pvid` is set through sysfs Signed-off-by: Albin Kerouanton <albinker@gmail.com>
* libnetwork/drivers/overlay: getBridgeNamePrefix() simplify reading of ↵Sebastiaan van Stijn2022-11-291-2/+2
| | | | | | | | | resolv.conf We only need the content here, not the checksum, so simplifying the code by just using os.ReadFile(). Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Merge pull request #44356 from corhere/libnetwork-namespace-correctnessSebastiaan van Stijn2022-11-032-14/+28
|\ | | | | libnetwork: fix restoring thread network namespaces
| * libnetwork: drop InitOSContext()Cory Snider2022-10-251-10/+0
| | | | | | | | | | | | The function is a no-op on all platforms. Signed-off-by: Cory Snider <csnider@mirantis.com>
| * libnet/d/overlay: restore thread netnsCory Snider2022-10-251-4/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | func (*network) watchMiss() correctly locks its goroutine to an OS thread before changing the thread's network namespace, but neglects to restore the thread's network namespace before unlocking. Fix this oversight by unlocking iff the thread's network namespace is successfully restored. Prevent the watchMiss goroutine from being locked to the main thread to avoid the issues which would arise if such a situation was to occur. Signed-off-by: Cory Snider <csnider@mirantis.com>
* | Merge pull request #44256 from thaJeztah/redundant_sprintfsSebastiaan van Stijn2022-10-251-2/+2
|\ \ | |/ |/| replace redundant fmt.Sprintf() with strconv
| * libnetwork: use strconv instead of fmt.Sprintf()Sebastiaan van Stijn2022-10-081-2/+2
| | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | libnetwork/drivers/overlay: use filepath.WalkDir instead of filepath.WalkSebastiaan van Stijn2022-10-091-7/+7
|/ | | | | | | WalkDir is more performant as it doesn't perform an os.Lstat on every visited file or directory. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork: use object-literal for some structsSebastiaan van Stijn2022-10-021-15/+13
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork: fix empty-lines (revive)Sebastiaan van Stijn2022-09-266-22/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | libnetwork/etchosts/etchosts_test.go:167:54: empty-lines: extra empty line at the end of a block (revive) libnetwork/osl/route_linux.go:185:74: empty-lines: extra empty line at the start of a block (revive) libnetwork/osl/sandbox_linux_test.go:323:36: empty-lines: extra empty line at the start of a block (revive) libnetwork/bitseq/sequence.go:412:48: empty-lines: extra empty line at the start of a block (revive) libnetwork/datastore/datastore_test.go:67:46: empty-lines: extra empty line at the end of a block (revive) libnetwork/datastore/mock_store.go:34:60: empty-lines: extra empty line at the end of a block (revive) libnetwork/iptables/firewalld.go:202:44: empty-lines: extra empty line at the end of a block (revive) libnetwork/iptables/firewalld_test.go:76:36: empty-lines: extra empty line at the end of a block (revive) libnetwork/iptables/iptables.go:256:67: empty-lines: extra empty line at the end of a block (revive) libnetwork/iptables/iptables.go:303:128: empty-lines: extra empty line at the start of a block (revive) libnetwork/networkdb/cluster.go:183:72: empty-lines: extra empty line at the end of a block (revive) libnetwork/ipams/null/null_test.go:44:38: empty-lines: extra empty line at the end of a block (revive) libnetwork/drivers/macvlan/macvlan_store.go:45:52: empty-lines: extra empty line at the end of a block (revive) libnetwork/ipam/allocator_test.go:1058:39: empty-lines: extra empty line at the start of a block (revive) libnetwork/drivers/bridge/port_mapping.go:88:111: empty-lines: extra empty line at the end of a block (revive) libnetwork/drivers/bridge/link.go:26:90: empty-lines: extra empty line at the end of a block (revive) libnetwork/drivers/bridge/setup_ipv6_test.go:17:34: empty-lines: extra empty line at the end of a block (revive) libnetwork/drivers/bridge/setup_ip_tables.go:392:4: empty-lines: extra empty line at the start of a block (revive) libnetwork/drivers/bridge/bridge.go:804:50: empty-lines: extra empty line at the start of a block (revive) libnetwork/drivers/overlay/ov_serf.go:183:29: empty-lines: extra empty line at the start of a block (revive) libnetwork/drivers/overlay/ov_utils.go:81:64: empty-lines: extra empty line at the end of a block (revive) libnetwork/drivers/overlay/peerdb.go:172:67: empty-lines: extra empty line at the start of a block (revive) libnetwork/drivers/overlay/peerdb.go:209:67: empty-lines: extra empty line at the start of a block (revive) libnetwork/drivers/overlay/peerdb.go:344:89: empty-lines: extra empty line at the start of a block (revive) libnetwork/drivers/overlay/peerdb.go:436:63: empty-lines: extra empty line at the start of a block (revive) libnetwork/drivers/overlay/overlay.go:183:36: empty-lines: extra empty line at the start of a block (revive) libnetwork/drivers/overlay/encryption.go:69:28: empty-lines: extra empty line at the end of a block (revive) libnetwork/drivers/overlay/ov_network.go:563:81: empty-lines: extra empty line at the start of a block (revive) libnetwork/default_gateway.go:32:43: empty-lines: extra empty line at the start of a block (revive) libnetwork/errors_test.go:9:40: empty-lines: extra empty line at the start of a block (revive) libnetwork/service_common.go:184:64: empty-lines: extra empty line at the end of a block (revive) libnetwork/endpoint.go:161:55: empty-lines: extra empty line at the end of a block (revive) libnetwork/store.go:320:33: empty-lines: extra empty line at the end of a block (revive) libnetwork/store_linux_test.go:11:38: empty-lines: extra empty line at the end of a block (revive) libnetwork/sandbox.go:571:36: empty-lines: extra empty line at the start of a block (revive) libnetwork/service_common.go:317:246: empty-lines: extra empty line at the start of a block (revive) libnetwork/endpoint.go:550:17: empty-lines: extra empty line at the end of a block (revive) libnetwork/sandbox_dns_unix.go:213:106: empty-lines: extra empty line at the start of a block (revive) libnetwork/controller.go:676:85: empty-lines: extra empty line at the end of a block (revive) libnetwork/agent.go:876:60: empty-lines: extra empty line at the end of a block (revive) libnetwork/resolver.go:324:69: empty-lines: extra empty line at the end of a block (revive) libnetwork/network.go:1153:92: empty-lines: extra empty line at the end of a block (revive) libnetwork/network.go:1955:67: empty-lines: extra empty line at the start of a block (revive) libnetwork/network.go:2235:9: empty-lines: extra empty line at the start of a block (revive) libnetwork/libnetwork_internal_test.go:336:26: empty-lines: extra empty line at the start of a block (revive) libnetwork/resolver_test.go:76:35: empty-lines: extra empty line at the end of a block (revive) libnetwork/libnetwork_test.go:303:38: empty-lines: extra empty line at the end of a block (revive) libnetwork/libnetwork_test.go:985:46: empty-lines: extra empty line at the end of a block (revive) libnetwork/ipam/allocator_test.go:1263:37: empty-lines: extra empty line at the start of a block (revive) libnetwork/errors_test.go:9:40: empty-lines: extra empty line at the end of a block (revive) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* bump netlink libraryMartin Braun2022-06-162-2/+2
| | | | | | | | | bump netlink to 1.2.1 change usages of netlink handle .Delete() to Close() remove superfluous replace in vendor.mod make requires of github.com/Azure/go-ansiterm direct Signed-off-by: Martin Braun <braun@neuroforge.de>
* libnetwork/overlay:fix join sandbox deadlockMartin Dojcak2022-03-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Operations performed on overlay network sandboxes are handled by dispatching operations send through a channel. This allows for asynchronous operations to be performed which, since they are not called from within another function, are able to operate in an idempotent manner with a known/measurable starting state from which an identical series of iterative actions can be performed. However, it was possible in some cases for an operation dispatched from this channel to write a message back to the channel in the case of joining a network when a sufficient volume of sandboxes were operated on. A goroutine which is simultaneously reading and writing to an unbuffered channel can deadlock if it sends a message to a channel then waits for it to be consumed and completed, since the only available goroutine is more or less "talking to itself". In order to break this deadlock, in the observed race, a goroutine is now created to send the message to the channel. Signed-off-by: Martin Dojcak <martin.dojcak@lablabs.io> Signed-off-by: Ryan Barry <rbarry@mirantis.com>
* libnetwork: replace consul with boltdb in testSebastiaan van Stijn2022-01-061-6/+22
| | | | | | Based on randomLocalStore() in libnetwork/ipam/allocator_test.go Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* refactor: move from io/ioutil to io and os packageEng Zer Jun2021-08-271-2/+1
| | | | | | | | The io/ioutil package has been deprecated in Go 1.16. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
* Update to Go 1.17.0, and gofmt with Go 1.17Sebastiaan van Stijn2021-08-2412-0/+12
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* libnetwork: remove unused "testutils" importsSebastiaan van Stijn2021-08-183-4/+0
| | | | | | | Perhaps the testutils package in the past had an `init()` function to set up specific things, but it no longer has. so these imports were doing nothing. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Fix gosec complaints in libnetworkBrian Goff2021-06-252-3/+6
| | | | | | | | | These were purposefully ignored before but this goes ahead and "fixes" most of them. Note that none of the things gosec flagged are problematic, just quieting the linter here. Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Fixup libnetwork lint errorsBrian Goff2021-06-017-10/+11
| | | | Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Fix some windows issues in libnetwork testsBrian Goff2021-06-0111-0/+22
| | | | | | Fix build constraints for linux-only network drivers Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Fix libnetwork importsBrian Goff2021-06-0113-54/+54
| | | | | | | | | After moving libnetwork to this repo, we need to update all the import paths for libnetwork to point to docker/docker/libnetwork instead of docker/libnetwork. This change implements that. Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Merge pull request #2572 from bboehmke/ipv6_natArko Dasgupta2020-10-292-19/+33
|\ | | | | Enable IPv6 NAT (rebase of #2023)
View Lorry Controller Status