123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567 |
- package daemon
- import (
- "fmt"
- "net"
- "runtime"
- "sort"
- "strings"
- "sync"
- "github.com/Sirupsen/logrus"
- apierrors "github.com/docker/docker/api/errors"
- "github.com/docker/docker/api/types"
- "github.com/docker/docker/api/types/network"
- clustertypes "github.com/docker/docker/daemon/cluster/provider"
- "github.com/docker/docker/pkg/plugingetter"
- "github.com/docker/docker/runconfig"
- "github.com/docker/libnetwork"
- lncluster "github.com/docker/libnetwork/cluster"
- "github.com/docker/libnetwork/driverapi"
- "github.com/docker/libnetwork/ipamapi"
- networktypes "github.com/docker/libnetwork/types"
- "github.com/pkg/errors"
- "golang.org/x/net/context"
- )
- // NetworkControllerEnabled checks if the networking stack is enabled.
- // This feature depends on OS primitives and it's disabled in systems like Windows.
- func (daemon *Daemon) NetworkControllerEnabled() bool {
- return daemon.netController != nil
- }
- // FindNetwork function finds a network for a given string that can represent network name or id
- func (daemon *Daemon) FindNetwork(idName string) (libnetwork.Network, error) {
- // Find by Name
- n, err := daemon.GetNetworkByName(idName)
- if err != nil && !isNoSuchNetworkError(err) {
- return nil, err
- }
- if n != nil {
- return n, nil
- }
- // Find by id
- return daemon.GetNetworkByID(idName)
- }
- func isNoSuchNetworkError(err error) bool {
- _, ok := err.(libnetwork.ErrNoSuchNetwork)
- return ok
- }
- // GetNetworkByID function returns a network whose ID begins with the given prefix.
- // It fails with an error if no matching, or more than one matching, networks are found.
- func (daemon *Daemon) GetNetworkByID(partialID string) (libnetwork.Network, error) {
- list := daemon.GetNetworksByID(partialID)
- if len(list) == 0 {
- return nil, libnetwork.ErrNoSuchNetwork(partialID)
- }
- if len(list) > 1 {
- return nil, libnetwork.ErrInvalidID(partialID)
- }
- return list[0], nil
- }
- // GetNetworkByName function returns a network for a given network name.
- // If no network name is given, the default network is returned.
- func (daemon *Daemon) GetNetworkByName(name string) (libnetwork.Network, error) {
- c := daemon.netController
- if c == nil {
- return nil, libnetwork.ErrNoSuchNetwork(name)
- }
- if name == "" {
- name = c.Config().Daemon.DefaultNetwork
- }
- return c.NetworkByName(name)
- }
- // GetNetworksByID returns a list of networks whose ID partially matches zero or more networks
- func (daemon *Daemon) GetNetworksByID(partialID string) []libnetwork.Network {
- c := daemon.netController
- if c == nil {
- return nil
- }
- list := []libnetwork.Network{}
- l := func(nw libnetwork.Network) bool {
- if strings.HasPrefix(nw.ID(), partialID) {
- list = append(list, nw)
- }
- return false
- }
- c.WalkNetworks(l)
- return list
- }
- // getAllNetworks returns a list containing all networks
- func (daemon *Daemon) getAllNetworks() []libnetwork.Network {
- return daemon.netController.Networks()
- }
- type ingressJob struct {
- create *clustertypes.NetworkCreateRequest
- ip net.IP
- jobDone chan struct{}
- }
- var (
- ingressWorkerOnce sync.Once
- ingressJobsChannel chan *ingressJob
- ingressID string
- )
- func (daemon *Daemon) startIngressWorker() {
- ingressJobsChannel = make(chan *ingressJob, 100)
- go func() {
- for {
- select {
- case r := <-ingressJobsChannel:
- if r.create != nil {
- daemon.setupIngress(r.create, r.ip, ingressID)
- ingressID = r.create.ID
- } else {
- daemon.releaseIngress(ingressID)
- ingressID = ""
- }
- close(r.jobDone)
- }
- }
- }()
- }
- // enqueueIngressJob adds a ingress add/rm request to the worker queue.
- // It guarantees the worker is started.
- func (daemon *Daemon) enqueueIngressJob(job *ingressJob) {
- ingressWorkerOnce.Do(daemon.startIngressWorker)
- ingressJobsChannel <- job
- }
- // SetupIngress setups ingress networking.
- // The function returns a channel which will signal the caller when the programming is completed.
- func (daemon *Daemon) SetupIngress(create clustertypes.NetworkCreateRequest, nodeIP string) (<-chan struct{}, error) {
- ip, _, err := net.ParseCIDR(nodeIP)
- if err != nil {
- return nil, err
- }
- done := make(chan struct{})
- daemon.enqueueIngressJob(&ingressJob{&create, ip, done})
- return done, nil
- }
- // ReleaseIngress releases the ingress networking.
- // The function returns a channel which will signal the caller when the programming is completed.
- func (daemon *Daemon) ReleaseIngress() (<-chan struct{}, error) {
- done := make(chan struct{})
- daemon.enqueueIngressJob(&ingressJob{nil, nil, done})
- return done, nil
- }
- func (daemon *Daemon) setupIngress(create *clustertypes.NetworkCreateRequest, ip net.IP, staleID string) {
- controller := daemon.netController
- controller.AgentInitWait()
- if staleID != "" && staleID != create.ID {
- daemon.releaseIngress(staleID)
- }
- if _, err := daemon.createNetwork(create.NetworkCreateRequest, create.ID, true); err != nil {
- // If it is any other error other than already
- // exists error log error and return.
- if _, ok := err.(libnetwork.NetworkNameError); !ok {
- logrus.Errorf("Failed creating ingress network: %v", err)
- return
- }
- // Otherwise continue down the call to create or recreate sandbox.
- }
- n, err := daemon.GetNetworkByID(create.ID)
- if err != nil {
- logrus.Errorf("Failed getting ingress network by id after creating: %v", err)
- }
- sb, err := controller.NewSandbox("ingress-sbox", libnetwork.OptionIngress())
- if err != nil {
- if _, ok := err.(networktypes.ForbiddenError); !ok {
- logrus.Errorf("Failed creating ingress sandbox: %v", err)
- }
- return
- }
- ep, err := n.CreateEndpoint("ingress-endpoint", libnetwork.CreateOptionIpam(ip, nil, nil, nil))
- if err != nil {
- logrus.Errorf("Failed creating ingress endpoint: %v", err)
- return
- }
- if err := ep.Join(sb, nil); err != nil {
- logrus.Errorf("Failed joining ingress sandbox to ingress endpoint: %v", err)
- return
- }
- if err := sb.EnableService(); err != nil {
- logrus.Errorf("Failed enabling service for ingress sandbox")
- }
- }
- func (daemon *Daemon) releaseIngress(id string) {
- controller := daemon.netController
- if err := controller.SandboxDestroy("ingress-sbox"); err != nil {
- logrus.Errorf("Failed to delete ingress sandbox: %v", err)
- }
- if id == "" {
- return
- }
- n, err := controller.NetworkByID(id)
- if err != nil {
- logrus.Errorf("failed to retrieve ingress network %s: %v", id, err)
- return
- }
- for _, ep := range n.Endpoints() {
- if err := ep.Delete(true); err != nil {
- logrus.Errorf("Failed to delete endpoint %s (%s): %v", ep.Name(), ep.ID(), err)
- return
- }
- }
- if err := n.Delete(); err != nil {
- logrus.Errorf("Failed to delete ingress network %s: %v", n.ID(), err)
- return
- }
- return
- }
- // SetNetworkBootstrapKeys sets the bootstrap keys.
- func (daemon *Daemon) SetNetworkBootstrapKeys(keys []*networktypes.EncryptionKey) error {
- err := daemon.netController.SetKeys(keys)
- if err == nil {
- // Upon successful key setting dispatch the keys available event
- daemon.cluster.SendClusterEvent(lncluster.EventNetworkKeysAvailable)
- }
- return err
- }
- // UpdateAttachment notifies the attacher about the attachment config.
- func (daemon *Daemon) UpdateAttachment(networkName, networkID, containerID string, config *network.NetworkingConfig) error {
- if daemon.clusterProvider == nil {
- return fmt.Errorf("cluster provider is not initialized")
- }
- if err := daemon.clusterProvider.UpdateAttachment(networkName, containerID, config); err != nil {
- return daemon.clusterProvider.UpdateAttachment(networkID, containerID, config)
- }
- return nil
- }
- // WaitForDetachment makes the cluster manager wait for detachment of
- // the container from the network.
- func (daemon *Daemon) WaitForDetachment(ctx context.Context, networkName, networkID, taskID, containerID string) error {
- if daemon.clusterProvider == nil {
- return fmt.Errorf("cluster provider is not initialized")
- }
- return daemon.clusterProvider.WaitForDetachment(ctx, networkName, networkID, taskID, containerID)
- }
- // CreateManagedNetwork creates an agent network.
- func (daemon *Daemon) CreateManagedNetwork(create clustertypes.NetworkCreateRequest) error {
- _, err := daemon.createNetwork(create.NetworkCreateRequest, create.ID, true)
- return err
- }
- // CreateNetwork creates a network with the given name, driver and other optional parameters
- func (daemon *Daemon) CreateNetwork(create types.NetworkCreateRequest) (*types.NetworkCreateResponse, error) {
- resp, err := daemon.createNetwork(create, "", false)
- if err != nil {
- return nil, err
- }
- return resp, err
- }
- func (daemon *Daemon) createNetwork(create types.NetworkCreateRequest, id string, agent bool) (*types.NetworkCreateResponse, error) {
- if runconfig.IsPreDefinedNetwork(create.Name) && !agent {
- err := fmt.Errorf("%s is a pre-defined network and cannot be created", create.Name)
- return nil, apierrors.NewRequestForbiddenError(err)
- }
- var warning string
- nw, err := daemon.GetNetworkByName(create.Name)
- if err != nil {
- if _, ok := err.(libnetwork.ErrNoSuchNetwork); !ok {
- return nil, err
- }
- }
- if nw != nil {
- // check if user defined CheckDuplicate, if set true, return err
- // otherwise prepare a warning message
- if create.CheckDuplicate {
- return nil, libnetwork.NetworkNameError(create.Name)
- }
- warning = fmt.Sprintf("Network with name %s (id : %s) already exists", nw.Name(), nw.ID())
- }
- c := daemon.netController
- driver := create.Driver
- if driver == "" {
- driver = c.Config().Daemon.DefaultDriver
- }
- nwOptions := []libnetwork.NetworkOption{
- libnetwork.NetworkOptionEnableIPv6(create.EnableIPv6),
- libnetwork.NetworkOptionDriverOpts(create.Options),
- libnetwork.NetworkOptionLabels(create.Labels),
- libnetwork.NetworkOptionAttachable(create.Attachable),
- libnetwork.NetworkOptionIngress(create.Ingress),
- libnetwork.NetworkOptionScope(create.Scope),
- }
- if create.ConfigOnly {
- nwOptions = append(nwOptions, libnetwork.NetworkOptionConfigOnly())
- }
- if create.IPAM != nil {
- ipam := create.IPAM
- v4Conf, v6Conf, err := getIpamConfig(ipam.Config)
- if err != nil {
- return nil, err
- }
- nwOptions = append(nwOptions, libnetwork.NetworkOptionIpam(ipam.Driver, "", v4Conf, v6Conf, ipam.Options))
- }
- if create.Internal {
- nwOptions = append(nwOptions, libnetwork.NetworkOptionInternalNetwork())
- }
- if agent {
- nwOptions = append(nwOptions, libnetwork.NetworkOptionDynamic())
- nwOptions = append(nwOptions, libnetwork.NetworkOptionPersist(false))
- }
- if create.ConfigFrom != nil {
- nwOptions = append(nwOptions, libnetwork.NetworkOptionConfigFrom(create.ConfigFrom.Network))
- }
- n, err := c.NewNetwork(driver, create.Name, id, nwOptions...)
- if err != nil {
- if _, ok := err.(libnetwork.ErrDataStoreNotInitialized); ok {
- return nil, errors.New("This node is not a swarm manager. Use \"docker swarm init\" or \"docker swarm join\" to connect this node to swarm and try again.")
- }
- return nil, err
- }
- daemon.pluginRefCount(driver, driverapi.NetworkPluginEndpointType, plugingetter.Acquire)
- if create.IPAM != nil {
- daemon.pluginRefCount(create.IPAM.Driver, ipamapi.PluginEndpointType, plugingetter.Acquire)
- }
- daemon.LogNetworkEvent(n, "create")
- return &types.NetworkCreateResponse{
- ID: n.ID(),
- Warning: warning,
- }, nil
- }
- func (daemon *Daemon) pluginRefCount(driver, capability string, mode int) {
- var builtinDrivers []string
- if capability == driverapi.NetworkPluginEndpointType {
- builtinDrivers = daemon.netController.BuiltinDrivers()
- } else if capability == ipamapi.PluginEndpointType {
- builtinDrivers = daemon.netController.BuiltinIPAMDrivers()
- }
- for _, d := range builtinDrivers {
- if d == driver {
- return
- }
- }
- if daemon.PluginStore != nil {
- _, err := daemon.PluginStore.Get(driver, capability, mode)
- if err != nil {
- logrus.WithError(err).WithFields(logrus.Fields{"mode": mode, "driver": driver}).Error("Error handling plugin refcount operation")
- }
- }
- }
- func getIpamConfig(data []network.IPAMConfig) ([]*libnetwork.IpamConf, []*libnetwork.IpamConf, error) {
- ipamV4Cfg := []*libnetwork.IpamConf{}
- ipamV6Cfg := []*libnetwork.IpamConf{}
- for _, d := range data {
- iCfg := libnetwork.IpamConf{}
- iCfg.PreferredPool = d.Subnet
- iCfg.SubPool = d.IPRange
- iCfg.Gateway = d.Gateway
- iCfg.AuxAddresses = d.AuxAddress
- ip, _, err := net.ParseCIDR(d.Subnet)
- if err != nil {
- return nil, nil, fmt.Errorf("Invalid subnet %s : %v", d.Subnet, err)
- }
- if ip.To4() != nil {
- ipamV4Cfg = append(ipamV4Cfg, &iCfg)
- } else {
- ipamV6Cfg = append(ipamV6Cfg, &iCfg)
- }
- }
- return ipamV4Cfg, ipamV6Cfg, nil
- }
- // UpdateContainerServiceConfig updates a service configuration.
- func (daemon *Daemon) UpdateContainerServiceConfig(containerName string, serviceConfig *clustertypes.ServiceConfig) error {
- container, err := daemon.GetContainer(containerName)
- if err != nil {
- return err
- }
- container.NetworkSettings.Service = serviceConfig
- return nil
- }
- // ConnectContainerToNetwork connects the given container to the given
- // network. If either cannot be found, an err is returned. If the
- // network cannot be set up, an err is returned.
- func (daemon *Daemon) ConnectContainerToNetwork(containerName, networkName string, endpointConfig *network.EndpointSettings) error {
- if runtime.GOOS == "solaris" {
- return errors.New("docker network connect is unsupported on Solaris platform")
- }
- container, err := daemon.GetContainer(containerName)
- if err != nil {
- return err
- }
- return daemon.ConnectToNetwork(container, networkName, endpointConfig)
- }
- // DisconnectContainerFromNetwork disconnects the given container from
- // the given network. If either cannot be found, an err is returned.
- func (daemon *Daemon) DisconnectContainerFromNetwork(containerName string, networkName string, force bool) error {
- if runtime.GOOS == "solaris" {
- return errors.New("docker network disconnect is unsupported on Solaris platform")
- }
- container, err := daemon.GetContainer(containerName)
- if err != nil {
- if force {
- return daemon.ForceEndpointDelete(containerName, networkName)
- }
- return err
- }
- return daemon.DisconnectFromNetwork(container, networkName, force)
- }
- // GetNetworkDriverList returns the list of plugins drivers
- // registered for network.
- func (daemon *Daemon) GetNetworkDriverList() []string {
- if !daemon.NetworkControllerEnabled() {
- return nil
- }
- pluginList := daemon.netController.BuiltinDrivers()
- managedPlugins := daemon.PluginStore.GetAllManagedPluginsByCap(driverapi.NetworkPluginEndpointType)
- for _, plugin := range managedPlugins {
- pluginList = append(pluginList, plugin.Name())
- }
- pluginMap := make(map[string]bool)
- for _, plugin := range pluginList {
- pluginMap[plugin] = true
- }
- networks := daemon.netController.Networks()
- for _, network := range networks {
- if !pluginMap[network.Type()] {
- pluginList = append(pluginList, network.Type())
- pluginMap[network.Type()] = true
- }
- }
- sort.Strings(pluginList)
- return pluginList
- }
- // DeleteManagedNetwork deletes an agent network.
- func (daemon *Daemon) DeleteManagedNetwork(networkID string) error {
- return daemon.deleteNetwork(networkID, true)
- }
- // DeleteNetwork destroys a network unless it's one of docker's predefined networks.
- func (daemon *Daemon) DeleteNetwork(networkID string) error {
- return daemon.deleteNetwork(networkID, false)
- }
- func (daemon *Daemon) deleteNetwork(networkID string, dynamic bool) error {
- nw, err := daemon.FindNetwork(networkID)
- if err != nil {
- return err
- }
- if runconfig.IsPreDefinedNetwork(nw.Name()) && !dynamic {
- err := fmt.Errorf("%s is a pre-defined network and cannot be removed", nw.Name())
- return apierrors.NewRequestForbiddenError(err)
- }
- if dynamic && !nw.Info().Dynamic() {
- if runconfig.IsPreDefinedNetwork(nw.Name()) {
- // Predefined networks now support swarm services. Make this
- // a no-op when cluster requests to remove the predefined network.
- return nil
- }
- err := fmt.Errorf("%s is not a dynamic network", nw.Name())
- return apierrors.NewRequestForbiddenError(err)
- }
- if err := nw.Delete(); err != nil {
- return err
- }
- // If this is not a configuration only network, we need to
- // update the corresponding remote drivers' reference counts
- if !nw.Info().ConfigOnly() {
- daemon.pluginRefCount(nw.Type(), driverapi.NetworkPluginEndpointType, plugingetter.Release)
- ipamType, _, _, _ := nw.Info().IpamConfig()
- daemon.pluginRefCount(ipamType, ipamapi.PluginEndpointType, plugingetter.Release)
- daemon.LogNetworkEvent(nw, "destroy")
- }
- return nil
- }
- // GetNetworks returns a list of all networks
- func (daemon *Daemon) GetNetworks() []libnetwork.Network {
- return daemon.getAllNetworks()
- }
- // clearAttachableNetworks removes the attachable networks
- // after disconnecting any connected container
- func (daemon *Daemon) clearAttachableNetworks() {
- for _, n := range daemon.GetNetworks() {
- if !n.Info().Attachable() {
- continue
- }
- for _, ep := range n.Endpoints() {
- epInfo := ep.Info()
- if epInfo == nil {
- continue
- }
- sb := epInfo.Sandbox()
- if sb == nil {
- continue
- }
- containerID := sb.ContainerID()
- if err := daemon.DisconnectContainerFromNetwork(containerID, n.ID(), true); err != nil {
- logrus.Warnf("Failed to disconnect container %s from swarm network %s on cluster leave: %v",
- containerID, n.Name(), err)
- }
- }
- if err := daemon.DeleteManagedNetwork(n.ID()); err != nil {
- logrus.Warnf("Failed to remove swarm network %s on cluster leave: %v", n.Name(), err)
- }
- }
- }
|