0ct0pu5/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Don't try to validate incomplete network config.

Browse source 
Some checks in 'networkConfiguration.Validate()' were not running as
expected, they'd always pass - because 'parseNetworkOptions()' called
it before 'config.processIPAM()' had added IP addresses and gateways.

Signed-off-by: Rob Murray <rob.murray@docker.com>
This commit is contained in:
Rob Murray 2023-12-21 15:16:26 +00:00
parent 52d9b0cb56
commit 437bc829bf
1 changed files with 11 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
libnetwork/drivers/bridge/bridge_linux.go
View file

@ -226,6 +226,10 @@ func (c *networkConfiguration) Validate() error {
return ErrInvalidMtu(c.Mtu)
}
if err := validateIPv6Subnet(c.AddressIPv6); err != nil {
return err
}
// If bridge v4 subnet is specified
if c.AddressIPv4 != nil {
// If default gw is specified, it must be part of bridge subnet
@ -556,13 +560,6 @@ func (c *networkConfiguration) processIPAM(id string, ipamV4Data, ipamV6Data []d
}
}
// TODO(robmry) - move this to networkConfiguration.Validate()
// - but that can't happen until Validate() is called after processIPAM() has set
// up the IP addresses, instead of during parseNetworkOptions().
if err := validateIPv6Subnet(c.AddressIPv6); err != nil {
return err
}
return nil
}
@ -590,11 +587,6 @@ func parseNetworkOptions(id string, option options.Generic) (*networkConfigurati
}
}
// Finally validate the configuration
if err = config.Validate(); err != nil {
return nil, err
}
if config.BridgeName == "" && !config.DefaultBridge {
config.BridgeName = "br-" + id[:12]
}
@ -654,16 +646,22 @@ func (d *driver) CreateNetwork(id string, option map[string]interface{}, nInfo d
}
d.Unlock()
// Parse and validate the config. It should not be conflict with existing networks' config
// Parse the config.
config, err := parseNetworkOptions(id, option)
if err != nil {
return err
}
// Add IP addresses/gateways to the configuration.
if err = config.processIPAM(id, ipV4Data, ipV6Data); err != nil {
return err
}
// Validate the configuration
if err = config.Validate(); err != nil {
return err
}
// start the critical section, from this point onward we are dealing with the list of networks
// so to be consistent we cannot allow that the list changes
d.configNetwork.Lock()