beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #25943 from yongtang/25863-ip-address-validation

Browse source 
Validate `--ip` and `--ip6` for `docker create`
This commit is contained in:
Brian Goff 2016-08-26 12:32:00 -04:00 committed by GitHub
commit 416fc7ffe4
3 changed files with 34 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
daemon/create.go
View file

@ -2,6 +2,7 @@ package daemon
import (
"fmt"
"net"
"strings"
"github.com/Sirupsen/logrus"
@ -244,8 +245,22 @@ func (daemon *Daemon) mergeAndVerifyConfig(config *containertypes.Config, img *i
}
// Checks if the client set configurations for more than one network while creating a container
// Also checks if the IPAMConfig is valid
func (daemon *Daemon) verifyNetworkingConfig(nwConfig *networktypes.NetworkingConfig) error {
if nwConfig == nil || len(nwConfig.EndpointsConfig) <= 1 {
if nwConfig == nil || len(nwConfig.EndpointsConfig) == 0 {
return nil
}
if len(nwConfig.EndpointsConfig) == 1 {
for _, v := range nwConfig.EndpointsConfig {
if v.IPAMConfig != nil {
if v.IPAMConfig.IPv4Address != "" && net.ParseIP(v.IPAMConfig.IPv4Address).To4() == nil {
return errors.NewBadRequestError(fmt.Errorf("invalid IPv4 address: %s", v.IPAMConfig.IPv4Address))
}
if v.IPAMConfig.IPv6Address != "" && net.ParseIP(v.IPAMConfig.IPv6Address).To16() == nil {
return errors.NewBadRequestError(fmt.Errorf("invalid IPv6 address: %s", v.IPAMConfig.IPv6Address))
}
}
}
return nil
}
l := make([]string, 0, len(nwConfig.EndpointsConfig))

1
docs/reference/api/docker_remote_api.md
View file

@ -121,6 +121,7 @@ This section lists each version from latest to oldest. Each listing includes a
* `GET /containers/json` now accepts `removing` as a valid value for the `status` filter.
* `DELETE /volumes/(name)` now accepts a `force` query parameter to force removal of volumes that were already removed out of band by the volume driver plugin.
* `POST /containers/create/` and `POST /containers/(name)/update` now validates restart policies.
* `POST /containers/create` now validates IPAMConfig in NetworkingConfig, and returns error for invalid IPv4 and IPv6 addresses (`--ip` and `--ip6` in `docker create/run`).
### v1.24 API changes

17
integration-cli/docker_cli_network_unix_test.go
View file

@ -1717,3 +1717,20 @@ func (s *DockerNetworkSuite) TestDockerNetworkFlagAlias(c *check.C) {
output, status, _ = dockerCmdWithError("run", "--rm", "--network=user", "--net-alias=foo", "--network-alias=bar", "busybox", "true")
c.Assert(status, checker.Equals, 0, check.Commentf("unexpected status code %d (%s)", status, output))
}
func (s *DockerNetworkSuite) TestDockerNetworkValidateIP(c *check.C) {
_, _, err := dockerCmdWithError("network", "create", "--ipv6", "--subnet=172.28.0.0/16", "--subnet=2001:db8:1234::/64", "mynet")
c.Assert(err, check.IsNil)
assertNwIsAvailable(c, "mynet")
_, _, err = dockerCmdWithError("run", "-d", "--name", "mynet0", "--net=mynet", "--ip", "172.28.99.88", "--ip6", "2001:db8:1234::9988", "busybox", "top")
c.Assert(err, check.IsNil)
c.Assert(waitRun("mynet0"), check.IsNil)
verifyIPAddressConfig(c, "mynet0", "mynet", "172.28.99.88", "2001:db8:1234::9988")
verifyIPAddresses(c, "mynet0", "mynet", "172.28.99.88", "2001:db8:1234::9988")
_, _, err = dockerCmdWithError("run", "--net=mynet", "--ip", "mynet_ip", "--ip6", "2001:db8:1234::9999", "busybox", "top")
c.Assert(err.Error(), checker.Contains, "invalid IPv4 address")
_, _, err = dockerCmdWithError("run", "--net=mynet", "--ip", "172.28.99.99", "--ip6", "mynet_ip6", "busybox", "top")
c.Assert(err.Error(), checker.Contains, "invalid IPv6 address")
}