moby/libnetwork
Albin Kerouanton b7d1e98ae7
libnet/d/bridge: Allow IPv6 ICC from any IP address
IPv6 ipt rules are exactly the same as IPv4 rules, although both
protocol don't use the same networking model. This has bad consequences,
for instance: 1. the current v6 rules disallow Neighbor
Solication/Advertisement ; 2. multicast addresses can't be used ; 3.
link-local addresses are blocked too.

To solve this, this commit changes the following rules:

```
-A DOCKER-ISOLATION-STAGE-1 ! -s fdf1:a844:380c:b247::/64 -o br-21502e5b2c6c -j DROP
-A DOCKER-ISOLATION-STAGE-1 ! -d fdf1:a844:380c:b247::/64 -i br-21502e5b2c6c -j DROP
```

into:

```
-A DOCKER-ISOLATION-STAGE-1 ! -s fdf1:a844:380c:b247::/64 ! -i br-21502e5b2c6c   -o br-21502e5b2c6c -j DROP
-A DOCKER-ISOLATION-STAGE-1 ! -d fdf1:a844:380c:b247::/64   -i br-21502e5b2c6c ! -o br-21502e5b2c6c -j DROP
```

These rules only limit the traffic ingressing/egressing the bridge, but
not traffic between veth on the same bridge.

Note that, the Kernel takes care of dropping invalid IPv6 packets, eg.
loopback spoofing, thus these rules don't need to be more specific.

Solve #45460.

Signed-off-by: Albin Kerouanton <albinker@gmail.com>
(cherry picked from commit da9e44a620)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-08-13 21:53:40 +02:00
..
bitmap Migrate away from things deprecated in Go 1.20 2023-02-15 12:30:32 -05:00
bitseq libnetwork/bit{seq,map}: delete CheckConsistency() 2023-01-27 11:47:43 -05:00
cluster Switch from x/net/context -> context 2018-04-24 14:57:04 -07:00
cmd [chore] clean up reexec.Init() calls 2023-05-11 16:31:41 +02:00
config libnetwork/config: remove vestiges of global scope 2023-01-26 17:56:29 -05:00
datastore libnetwork/config: remove vestiges of global scope 2023-01-26 17:56:29 -05:00
diagnostic set ReadHeaderTimeout to address G112: Potential Slowloris Attack (gosec) 2022-09-22 12:13:28 +02:00
discoverapi libnetwork: drop DatastoreConfig discovery type 2023-01-27 11:47:43 -05:00
docs libnetwork: remove consul-related code and tests 2022-01-06 18:45:41 +01:00
driverapi libnetwork/drvregistry: split up the registries 2023-01-27 11:47:42 -05:00
drivers libnet/d/bridge: Allow IPv6 ICC from any IP address 2023-08-13 21:53:40 +02:00
drvregistry libnetwork/drvregistry: split up the registries 2023-01-27 11:47:42 -05:00
etchosts libnetwork: use strings.Cut() and minor refactor 2022-12-21 11:09:03 +01:00
idm libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
internal libn/i/setmatrix: make generic and constructorless 2023-03-29 13:31:12 -04:00
ipam libnet/ipam: use netip types internally 2023-02-23 18:10:01 -05:00
ipamapi libnetwork: drop DatastoreConfig discovery type 2023-01-27 11:47:43 -05:00
ipams libnetwork: drop DatastoreConfig discovery type 2023-01-27 11:47:43 -05:00
ipamutils libnw/ipamutils: make local defaults immutable 2023-01-26 14:56:12 -05:00
ipbits libnet/ipam: use netip types internally 2023-02-23 18:10:01 -05:00
iptables rootless: move ./rootless to ./pkg/rootless 2023-01-09 16:26:06 +01:00
netlabel libnetwork/netlabel: remove dead code 2023-04-06 19:51:56 +02:00
netutils libnetwork/netutils: remove dead code 2023-04-06 19:33:04 +02:00
networkdb libnet/networkdb: fix nil-dereference panic in test 2023-02-23 14:31:48 -05:00
ns libnetwork/osl: clean up Linux InvokeFunc() 2022-10-25 13:35:44 -04:00
options golangci-lint: update to v1.49.0 2022-09-23 23:31:27 +02:00
osl libnetwork: fix sandbox restore 2023-05-30 15:47:20 -04:00
portallocator libnet/d/bridge: use fresh PortAllocator in tests 2022-11-08 17:58:06 -05:00
portmapper Lock OS threads when exec'ing with Pdeathsig 2022-10-05 12:18:03 -04:00
resolvconf libnetwork/resolvconf: fix some minor (linting) issues 2023-04-26 22:49:50 +02:00
support Fixup libnetwork lint errors 2021-06-01 23:48:32 +00:00
testutils libnetwork: check for netns leaks from prior tests 2023-05-23 11:31:28 -04:00
types libnetwork: use strconv instead of fmt.Sprintf() 2022-10-08 17:41:39 +02:00
.dockerignore Added back dockerignore 2018-06-22 16:10:22 -07:00
.gitignore Added back dockerignore 2018-06-22 16:10:22 -07:00
agent.go libnetwork: return concrete-typed *Endpoint 2023-01-13 14:19:06 -05:00
agent.pb.go Gracefully remove LB endpoints from services 2018-03-16 15:19:49 -04:00
agent.proto Gracefully remove LB endpoints from services 2018-03-16 15:19:49 -04:00
controller.go libn/i/setmatrix: make generic and constructorless 2023-03-29 13:31:12 -04:00
default_gateway.go libnetwork: return concrete-typed *Endpoint 2023-01-13 14:19:06 -05:00
default_gateway_freebsd.go libnetwork: return concrete-typed *Controller 2023-01-13 14:09:37 -05:00
default_gateway_linux.go libnetwork: return concrete-typed *Controller 2023-01-13 14:09:37 -05:00
default_gateway_windows.go libnetwork: return concrete-typed *Controller 2023-01-13 14:09:37 -05:00
drivers_freebsd.go libnet: convert to new-style driver registration 2023-01-27 11:47:42 -05:00
drivers_ipam.go libnet: un-plumb datastores from IPAM inits 2023-01-27 11:47:42 -05:00
drivers_linux.go libnet: convert to new-style driver registration 2023-01-27 11:47:42 -05:00
drivers_unsupported.go libnetwork: add missing stub for getInitializers() 2023-04-28 20:18:33 +02:00
drivers_windows.go libnet: convert to new-style driver registration 2023-01-27 11:47:42 -05:00
endpoint.go libnetwork: remove more datastore scope plumbing 2023-01-26 17:56:40 -05:00
endpoint_cnt.go libnetwork: remove more datastore scope plumbing 2023-01-26 17:56:40 -05:00
endpoint_info.go libnetwork: return concrete-typed *Endpoint 2023-01-13 14:19:06 -05:00
endpoint_info_unix.go libnetwork: return concrete-typed *Endpoint 2023-01-13 14:19:06 -05:00
endpoint_info_windows.go libnetwork: return concrete-typed *Endpoint 2023-01-13 14:19:06 -05:00
endpoint_test.go libnetwork: return concrete-typed *Controller 2023-01-13 14:09:37 -05:00
error.go libnetwork: remove more datastore scope plumbing 2023-01-26 17:56:40 -05:00
errors_test.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
firewall_linux.go libnetwork: Support IPv6 in arrangeUserFilterRule() (redux) 2023-01-14 19:11:44 -07:00
firewall_linux_test.go libnetwork: Support IPv6 in arrangeUserFilterRule() (redux) 2023-01-14 19:11:44 -07:00
firewall_others.go libnetwork: return concrete-typed *Controller 2023-01-13 14:09:37 -05:00
libnetwork_internal_test.go libn/i/setmatrix: make generic and constructorless 2023-03-29 13:31:12 -04:00
libnetwork_linux_test.go libnetwork: return concrete-typed *Endpoint 2023-01-13 14:19:06 -05:00
libnetwork_test.go [chore] clean up reexec.Init() calls 2023-05-11 16:31:41 +02:00
libnetwork_unix_test.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
libnetwork_windows_test.go Skip libnetwork integration tests on Windows 2021-06-02 16:53:29 +00:00
network.go libnetwork: clean up inDelete network atomically 2023-04-11 19:00:59 -04:00
network_unix.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
network_windows.go libnetwork: drop (resolver).resolverKey field 2023-01-11 12:14:32 -05:00
README.md libnetwork: use example.com for tests and examples 2023-01-10 15:27:58 +01:00
resolver.go libnetwork: leave global logger alone in tests 2023-05-23 11:31:28 -04:00
resolver_test.go libnetwork: check for netns leaks from prior tests 2023-05-23 11:31:28 -04:00
resolver_unix.go libn: fix resolver restore w/ chatty 'iptables -C' 2023-05-30 15:49:17 -04:00
resolver_windows.go libnetwork: devirtualize Resolver type 2023-02-16 19:05:59 -05:00
sandbox.go libnetwork: fix sandbox restore 2023-05-30 15:47:20 -04:00
sandbox_dns_unix.go libnetwork/resolvconf: use []byte for hash instead of string 2023-04-26 22:49:47 +02:00
sandbox_dns_windows.go libnetwork: return concrete-typed *Sandbox 2023-01-13 14:19:06 -05:00
sandbox_externalkey_unix.go libnetwork: inline sendKey() into SetExternalKey() 2023-04-28 16:44:54 +02:00
sandbox_externalkey_unsupported.go libnetwork: don't register "libnetwork-setkey" re-exec on non-unix 2023-04-28 16:44:54 +02:00
sandbox_store.go libnetwork: log why osl sandbox restore failed 2023-05-30 15:47:20 -04:00
sandbox_test.go libnetwork: return concrete-typed *Controller 2023-01-13 14:09:37 -05:00
service.go libn/i/setmatrix: make generic and constructorless 2023-03-29 13:31:12 -04:00
service_common.go libn/i/setmatrix: make generic and constructorless 2023-03-29 13:31:12 -04:00
service_common_test.go libnetwork: return concrete-typed *Sandbox 2023-01-13 14:19:06 -05:00
service_linux.go libnetwork: return concrete-typed *Endpoint 2023-01-13 14:19:06 -05:00
service_unsupported.go libnetwork: fix stubs 2023-04-28 20:18:33 +02:00
service_windows.go libnetwork: return concrete-typed *Endpoint 2023-01-13 14:19:06 -05:00
store.go libnetwork: remove more datastore scope plumbing 2023-01-26 17:56:40 -05:00
store_linux_test.go libnetwork: use string-literals for easier grep'ing 2023-07-15 00:50:47 +02:00
store_test.go libnetwork: use string-literals for easier grep'ing 2023-07-15 00:50:47 +02:00

libnetwork - networking for containers

Libnetwork provides a native Go implementation for connecting containers

The goal of libnetwork is to deliver a robust Container Network Model that provides a consistent programming interface and the required network abstractions for applications.

Design

Please refer to the design for more information.

Using libnetwork

There are many networking solutions available to suit a broad range of use-cases. libnetwork uses a driver / plugin model to support all of these solutions while abstracting the complexity of the driver implementations by exposing a simple and consistent Network Model to users.

package main

import (
	"fmt"
	"log"

	"github.com/docker/docker/pkg/reexec"
	"github.com/docker/docker/libnetwork"
	"github.com/docker/docker/libnetwork/config"
	"github.com/docker/docker/libnetwork/netlabel"
	"github.com/docker/docker/libnetwork/options"
)

func main() {
	if reexec.Init() {
		return
	}

	// Select and configure the network driver
	networkType := "bridge"

	// Create a new controller instance
	driverOptions := options.Generic{}
	genericOption := make(map[string]interface{})
	genericOption[netlabel.GenericData] = driverOptions
	controller, err := libnetwork.New(config.OptionDriverConfig(networkType, genericOption))
	if err != nil {
		log.Fatalf("libnetwork.New: %s", err)
	}

	// Create a network for containers to join.
	// NewNetwork accepts Variadic optional arguments that libnetwork and Drivers can use.
	network, err := controller.NewNetwork(networkType, "network1", "")
	if err != nil {
		log.Fatalf("controller.NewNetwork: %s", err)
	}

	// For each new container: allocate IP and interfaces. The returned network
	// settings will be used for container infos (inspect and such), as well as
	// iptables rules for port publishing. This info is contained or accessible
	// from the returned endpoint.
	ep, err := network.CreateEndpoint("Endpoint1")
	if err != nil {
		log.Fatalf("network.CreateEndpoint: %s", err)
	}

	// Create the sandbox for the container.
	// NewSandbox accepts Variadic optional arguments which libnetwork can use.
	sbx, err := controller.NewSandbox("container1",
		libnetwork.OptionHostname("test"),
		libnetwork.OptionDomainname("example.com"))
	if err != nil {
		log.Fatalf("controller.NewSandbox: %s", err)
	}

	// A sandbox can join the endpoint via the join api.
	err = ep.Join(sbx)
	if err != nil {
		log.Fatalf("ep.Join: %s", err)
	}

	// libnetwork client can check the endpoint's operational data via the Info() API
	epInfo, err := ep.DriverInfo()
	if err != nil {
		log.Fatalf("ep.DriverInfo: %s", err)
	}

	macAddress, ok := epInfo[netlabel.MacAddress]
	if !ok {
		log.Fatalf("failed to get mac address from endpoint info")
	}

	fmt.Printf("Joined endpoint %s (%s) to sandbox %s (%s)\n", ep.Name(), macAddress, sbx.ContainerID(), sbx.Key())
}

Contributing

Want to hack on libnetwork? Docker's contributions guidelines apply.

Code and documentation copyright 2015 Docker, inc. Code released under the Apache 2.0 license. Docs released under Creative commons.