kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Fix bug in datapath key rotation in 1-1 NAT case

Browse source 
- It was not using the advertise IP to construct the SPI

Signed-off-by: Alessandro Boch <aboch@docker.com>
This commit is contained in:
Alessandro Boch 2017-02-10 18:02:28 -08:00
parent 1ee6e5b30b
commit 4a04857a68
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
libnetwork/drivers/overlay/encryption.go
View file

@ -413,6 +413,7 @@ func (d *driver) updateKeys(newKey, primary, pruneKey *key) error {
priIdx = -1 priIdx = -1
delIdx = -1 delIdx = -1
lIP = net.ParseIP(d.bindAddress) lIP = net.ParseIP(d.bindAddress)
aIP = net.ParseIP(d.advertiseAddress)
) )
d.Lock() d.Lock()
@ -440,7 +441,7 @@ func (d *driver) updateKeys(newKey, primary, pruneKey *key) error {
d.secMapWalk(func(rIPs string, spis []*spi) ([]*spi, bool) { d.secMapWalk(func(rIPs string, spis []*spi) ([]*spi, bool) {
rIP := net.ParseIP(rIPs) rIP := net.ParseIP(rIPs)
return updateNodeKey(lIP, rIP, spis, d.keys, newIdx, priIdx, delIdx), false return updateNodeKey(lIP, aIP, rIP, spis, d.keys, newIdx, priIdx, delIdx), false
}) })
d.Lock() d.Lock()
@ -471,7 +472,7 @@ func (d *driver) updateKeys(newKey, primary, pruneKey *key) error {
*********************************************************/ *********************************************************/
// Spis and keys are sorted in such away the one in position 0 is the primary // Spis and keys are sorted in such away the one in position 0 is the primary
func updateNodeKey(lIP, rIP net.IP, idxs []*spi, curKeys []*key, newIdx, priIdx, delIdx int) []*spi { func updateNodeKey(lIP, aIP, rIP net.IP, idxs []*spi, curKeys []*key, newIdx, priIdx, delIdx int) []*spi {
logrus.Debugf("Updating keys for node: %s (%d,%d,%d)", rIP, newIdx, priIdx, delIdx) logrus.Debugf("Updating keys for node: %s (%d,%d,%d)", rIP, newIdx, priIdx, delIdx)
spis := idxs spis := idxs
@ -480,8 +481,8 @@ func updateNodeKey(lIP, rIP net.IP, idxs []*spi, curKeys []*key, newIdx, priIdx,
// add new // add new
if newIdx != -1 { if newIdx != -1 {
spis = append(spis, &spi{ spis = append(spis, &spi{
forward: buildSPI(lIP, rIP, curKeys[newIdx].tag), forward: buildSPI(aIP, rIP, curKeys[newIdx].tag),
reverse: buildSPI(rIP, lIP, curKeys[newIdx].tag), reverse: buildSPI(rIP, aIP, curKeys[newIdx].tag),
}) })
} }