moby/libnetwork
Albin Kerouanton 4da19e2dca Clear conntrack entries for published UDP ports
Conntrack entries are created for UDP flows even if there's nowhere to
route these packets (ie. no listening socket and no NAT rules to
apply). Moreover, iptables NAT rules are evaluated by netfilter only
when creating a new conntrack entry.

When Docker adds NAT rules, netfilter will ignore them for any packet
matching a pre-existing conntrack entry. In such case, when
dockerd runs with userland proxy enabled, packets got routed to it and
the main symptom will be bad source IP address (as shown by #44688).

If the publishing container is run through Docker Swarm or in
"standalone" Docker but with no userland proxy, affected packets will
be dropped (eg. routed to nowhere).

As such, Docker needs to flush all conntrack entries for published UDP
ports to make sure NAT rules are correctly applied to all packets.

- Fixes #44688
- Fixes #8795
- Fixes #16720
- Fixes #7540
- Fixes moby/libnetwork#2423
- and probably more.

As a precautionary measure, those conntrack entries are also flushed
when revoking external connectivity to avoid those entries to be reused
when a new sandbox is created (although the kernel should already
prevent such case).

Signed-off-by: Albin Kerouanton <albinker@gmail.com>
(cherry picked from commit b37d34307d)
Signed-off-by: Cory Snider <csnider@mirantis.com>
2023-01-05 14:22:53 -05:00
..
bitseq gofmt GoDoc comments with go1.19 2022-07-13 22:42:29 +02:00
cluster Switch from x/net/context -> context 2018-04-24 14:57:04 -07:00
cmd fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
config Revert "Added API to set ephemeral port allocator range." 2022-06-02 22:56:18 +02:00
datastore gofmt GoDoc comments with go1.19 2022-07-13 22:42:29 +02:00
diagnostic set ReadHeaderTimeout to address G112: Potential Slowloris Attack (gosec) 2022-09-22 12:27:32 +02:00
discoverapi fix nits in comments and log 2016-10-29 19:35:18 +08:00
docs libnetwork: remove consul-related code and tests 2022-01-06 18:45:41 +01:00
driverapi libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
drivers Clear conntrack entries for published UDP ports 2023-01-05 14:22:53 -05:00
drvregistry libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
etchosts refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
idm libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
internal libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
ipam Make the network allocator handle IPv4 blocks too small for network/broadcast addresses. 2021-10-27 13:03:19 +02:00
ipamapi libnetwork/ipamapi: godoc fixes 2021-08-27 16:52:46 +02:00
ipams gofmt GoDoc comments with go1.19 2022-07-13 22:42:29 +02:00
ipamutils panic() instead of logrus.Fatal() in init funcs 2022-04-21 12:15:20 +02:00
iptables Clear conntrack entries for published UDP ports 2023-01-05 14:22:53 -05:00
netlabel libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
netutils Merge pull request #42777 from thaJeztah/update_go_1.17 2021-08-26 21:24:23 +02:00
networkdb linting: suppress false positive for G404 (gosec) 2022-09-06 15:11:42 +02:00
ns Revert "Adjust LockOSThread" 2019-08-15 14:44:03 -07:00
options golangci-lint: update to v1.49.0 2022-09-26 11:58:07 +02:00
osl bump netlink library 2022-06-16 22:25:33 +02:00
portallocator libnetwork/portallocator: un-export consts for defaults 2022-06-02 22:59:32 +02:00
portmapper refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
resolvconf libnetwork/resolvconf: removed unused GetIfChanged() and GetLastModified() 2022-10-01 02:08:44 +02:00
support Fixup libnetwork lint errors 2021-06-01 23:48:32 +00:00
test/integration libnetwork: remove etcd-related code and tests 2022-01-06 18:45:43 +01:00
testutils gofmt GoDoc comments with go1.19 2022-07-13 22:42:29 +02:00
types libnetwork/types: remove TransportPort.FromString() as it's unused 2021-08-27 14:16:32 +02:00
.dockerignore Added back dockerignore 2018-06-22 16:10:22 -07:00
.gitignore Added back dockerignore 2018-06-22 16:10:22 -07:00
agent.go Fixup libnetwork lint errors 2021-06-01 23:48:32 +00:00
agent.pb.go Gracefully remove LB endpoints from services 2018-03-16 15:19:49 -04:00
agent.proto Gracefully remove LB endpoints from services 2018-03-16 15:19:49 -04:00
CHANGELOG.md Spelling fixes 2018-07-12 12:54:44 -07:00
controller.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
default_gateway.go Fixup libnetwork lint errors 2021-06-01 23:48:32 +00:00
default_gateway_freebsd.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
default_gateway_linux.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
default_gateway_windows.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
drivers_freebsd.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
drivers_ipam.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
drivers_linux.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
drivers_windows.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
endpoint.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
endpoint_cnt.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
endpoint_info.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
endpoint_info_unix.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
endpoint_info_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
endpoint_test.go refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
error.go Merge pull request #1616 from chchliang/testnetwork 2017-04-10 13:54:44 -07:00
errors_test.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
firewall_linux.go fix some minor linting issues 2022-07-04 10:15:28 +02:00
firewall_linux_test.go Skip libnetwork integration tests on Windows 2021-06-02 16:53:29 +00:00
firewall_others.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
libnetwork_internal_test.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
libnetwork_linux_test.go refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
libnetwork_test.go libnetwork: fix unhandled errors in tests (ineffassign) 2022-02-08 09:43:27 +01:00
libnetwork_unix_test.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
libnetwork_windows_test.go Skip libnetwork integration tests on Windows 2021-06-02 16:53:29 +00:00
network.go golangci-lint: update to v1.49.0 2022-09-26 11:58:07 +02:00
network_unix.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
network_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
README.md libnetwork: remove CircleCI config and code 2021-06-09 12:31:52 +02:00
resolver.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
resolver_test.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
resolver_unix.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
resolver_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
sandbox.go golangci-lint: update to v1.49.0 2022-09-26 11:58:07 +02:00
sandbox_dns_unix.go refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
sandbox_dns_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
sandbox_externalkey.go sandbox_externalkey.go: split for cross compilation 2015-11-26 00:18:27 +01:00
sandbox_externalkey_unix.go refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
sandbox_externalkey_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
sandbox_store.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
sandbox_test.go Skip libnetwork integration tests on Windows 2021-06-02 16:53:29 +00:00
service.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
service_common.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
service_common_test.go Skip libnetwork integration tests on Windows 2021-06-02 16:53:29 +00:00
service_linux.go Ensure performance tuning is always applied 2022-05-31 11:47:30 -04:00
service_unsupported.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
service_windows.go Log HNS policylist removal failures 2022-04-19 14:21:29 +00:00
store.go libnetwork: remove etcd-related code and tests 2022-01-06 18:45:43 +01:00
store_linux_test.go Fixup libnetwork lint errors 2021-06-01 23:48:32 +00:00
store_test.go refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00

libnetwork - networking for containers

Libnetwork provides a native Go implementation for connecting containers

The goal of libnetwork is to deliver a robust Container Network Model that provides a consistent programming interface and the required network abstractions for applications.

Design

Please refer to the design for more information.

Using libnetwork

There are many networking solutions available to suit a broad range of use-cases. libnetwork uses a driver / plugin model to support all of these solutions while abstracting the complexity of the driver implementations by exposing a simple and consistent Network Model to users.

package main

import (
	"fmt"
	"log"

	"github.com/docker/docker/pkg/reexec"
	"github.com/docker/docker/libnetwork"
	"github.com/docker/docker/libnetwork/config"
	"github.com/docker/docker/libnetwork/netlabel"
	"github.com/docker/docker/libnetwork/options"
)

func main() {
	if reexec.Init() {
		return
	}

	// Select and configure the network driver
	networkType := "bridge"

	// Create a new controller instance
	driverOptions := options.Generic{}
	genericOption := make(map[string]interface{})
	genericOption[netlabel.GenericData] = driverOptions
	controller, err := libnetwork.New(config.OptionDriverConfig(networkType, genericOption))
	if err != nil {
		log.Fatalf("libnetwork.New: %s", err)
	}

	// Create a network for containers to join.
	// NewNetwork accepts Variadic optional arguments that libnetwork and Drivers can use.
	network, err := controller.NewNetwork(networkType, "network1", "")
	if err != nil {
		log.Fatalf("controller.NewNetwork: %s", err)
	}

	// For each new container: allocate IP and interfaces. The returned network
	// settings will be used for container infos (inspect and such), as well as
	// iptables rules for port publishing. This info is contained or accessible
	// from the returned endpoint.
	ep, err := network.CreateEndpoint("Endpoint1")
	if err != nil {
		log.Fatalf("network.CreateEndpoint: %s", err)
	}

	// Create the sandbox for the container.
	// NewSandbox accepts Variadic optional arguments which libnetwork can use.
	sbx, err := controller.NewSandbox("container1",
		libnetwork.OptionHostname("test"),
		libnetwork.OptionDomainname("docker.io"))
	if err != nil {
		log.Fatalf("controller.NewSandbox: %s", err)
	}

	// A sandbox can join the endpoint via the join api.
	err = ep.Join(sbx)
	if err != nil {
		log.Fatalf("ep.Join: %s", err)
	}

	// libnetwork client can check the endpoint's operational data via the Info() API
	epInfo, err := ep.DriverInfo()
	if err != nil {
		log.Fatalf("ep.DriverInfo: %s", err)
	}

	macAddress, ok := epInfo[netlabel.MacAddress]
	if !ok {
		log.Fatalf("failed to get mac address from endpoint info")
	}

	fmt.Printf("Joined endpoint %s (%s) to sandbox %s (%s)\n", ep.Name(), macAddress, sbx.ContainerID(), sbx.Key())
}

Contributing

Want to hack on libnetwork? Docker's contributions guidelines apply.

Code and documentation copyright 2015 Docker, inc. Code released under the Apache 2.0 license. Docs released under Creative commons.