kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Remove race in encrypted overlay key update

Browse source 
Multiple simultaneous updates here would leave the driver in a very
inconsistent state.  The disadvantage to this change is that it requires
holding the driver lock while reprogramming the keys.

Signed-off-by: Chris Telfer <ctelfer@docker.com>
This commit is contained in:
Chris Telfer 2018-04-27 11:24:36 -04:00
parent 40b55d2336
commit c97bb41620
1 changed files with 8 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
libnetwork/drivers/overlay/encryption.go
View file

@ -438,7 +438,7 @@ func (d *driver) setKeys(keys []*key) error {
d.keys = keys d.keys = keys
d.secMap = &encrMap{nodes: map[string][]*spi{}} d.secMap = &encrMap{nodes: map[string][]*spi{}}
d.Unlock() d.Unlock()
logrus.Debugf("Initial encryption keys: %v", d.keys) logrus.Debugf("Initial encryption keys: %v", keys)
return nil return nil
} }
@ -458,6 +458,8 @@ func (d *driver) updateKeys(newKey, primary, pruneKey *key) error {
) )
d.Lock() d.Lock()
defer d.Unlock()
// add new // add new
if newKey != nil { if newKey != nil {
d.keys = append(d.keys, newKey) d.keys = append(d.keys, newKey)
@ -471,7 +473,6 @@ func (d *driver) updateKeys(newKey, primary, pruneKey *key) error {
delIdx = i delIdx = i
} }
} }
d.Unlock()
if (newKey != nil && newIdx == -1) || if (newKey != nil && newIdx == -1) ||
(primary != nil && priIdx == -1) || (primary != nil && priIdx == -1) ||
@ -480,17 +481,18 @@ func (d *driver) updateKeys(newKey, primary, pruneKey *key) error {
"(newIdx,priIdx,delIdx):(%d, %d, %d)", newIdx, priIdx, delIdx) "(newIdx,priIdx,delIdx):(%d, %d, %d)", newIdx, priIdx, delIdx)
} }
if priIdx != -1 && priIdx == delIdx {
return types.BadRequestErrorf("attempting to both make a key (index %d) primary and delete it", priIdx)
}
d.secMapWalk(func(rIPs string, spis []*spi) ([]*spi, bool) { d.secMapWalk(func(rIPs string, spis []*spi) ([]*spi, bool) {
rIP := net.ParseIP(rIPs) rIP := net.ParseIP(rIPs)
return updateNodeKey(lIP, aIP, rIP, spis, d.keys, newIdx, priIdx, delIdx), false return updateNodeKey(lIP, aIP, rIP, spis, d.keys, newIdx, priIdx, delIdx), false
}) })
d.Lock()
// swap primary // swap primary
if priIdx != -1 { if priIdx != -1 {
swp := d.keys[0] d.keys[0], d.keys[priIdx] = d.keys[priIdx], d.keys[0]
d.keys[0] = d.keys[priIdx]
d.keys[priIdx] = swp
} }
// prune // prune
if delIdx != -1 { if delIdx != -1 {
@ -499,7 +501,6 @@ func (d *driver) updateKeys(newKey, primary, pruneKey *key) error {
} }
d.keys = append(d.keys[:delIdx], d.keys[delIdx+1:]...) d.keys = append(d.keys[:delIdx], d.keys[delIdx+1:]...)
} }
d.Unlock()
logrus.Debugf("Updated: %v", d.keys) logrus.Debugf("Updated: %v", d.keys)