1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Commit graph

22 commits

Author SHA1 Message Date
Madhu Venugopal
c85473ad37 Merge pull request #1354 from aboch/pol
Few changes in encryption overlay
2017-03-11 18:21:55 -08:00
Alessandro Boch
9272c89bb7 Clear encryption states when joining cluster
- Use the request id for labelling our SAs

Signed-off-by: Alessandro Boch <aboch@docker.com>
2017-03-11 15:52:39 -08:00
Alessandro Boch
91f5b1669e Once a network is encrypted, do not accept clear packets from it
Signed-off-by: Alessandro Boch <aboch@docker.com>
2017-02-18 12:15:54 -08:00
Alessandro Boch
4a04857a68 Fix bug in datapath key rotation in 1-1 NAT case
- It was not using the advertise IP to construct the SPI

Signed-off-by: Alessandro Boch <aboch@docker.com>
2017-02-10 18:33:06 -08:00
Alessandro Boch
bee7d9219f Properly construct CIDR in policy selector
- Current code programs src/dst cidr like 192.168.100.126/128

Signed-off-by: Alessandro Boch <aboch@docker.com>
2017-02-03 23:14:58 -08:00
Daehyeok Mun
7f473c779a Refactoring logrus import and formatting
This fix tries to fix logrus formatting by removing `f` from
`logrus.[Error|Warn|Debug|Fatal|Panic|Info]f` when formatting string
is not present.
Also fix import name to use original project name 'logrus' instead of
'log'

Signed-off-by: Daehyeok Mun <daehyeok@gmail.com>
2016-11-08 12:42:41 -07:00
Alessandro Boch
d4f3963a26 In overlay driver reset any state on setkey()
Signed-off-by: Alessandro Boch <aboch@docker.com>
2016-09-19 14:03:55 -07:00
Madhu Venugopal
f142339334 Merge pull request #1356 from aboch/isb
Fix bug in ipsec key rotation
2016-07-25 19:16:01 -07:00
Alessandro Boch
bc6a60dae5 Fix bug in ipsec key rotation
- which would leave a stale state behind
  at each key rotation.

Signed-off-by: Alessandro Boch <aboch@docker.com>
2016-07-25 16:23:53 -07:00
Alessandro Boch
8bc99ae906 Check for advertise IP when deriving ipsec nodes
- We need to compare the node notification IP with
  the advertise address otherwise when the advertise
  address is different from the local address (this
  is for the public address outside of the host
  that maps 1-to-1 to the local private address)
  the local IP will be acocunted as an ipsec host
  and extra states will be programmed for it.

Signed-off-by: Alessandro Boch <aboch@docker.com>
2016-07-25 12:07:48 -07:00
Alessandro Boch
801bd7b3b2 Allow user to set the overlay network's mtu
- Being a driver specific flag, user needs to
  account for vxlan and, if enabled, ipsec overhead

Signed-off-by: Alessandro Boch <aboch@docker.com>
2016-07-23 22:39:29 -07:00
Alessandro Boch
e415b1f495 Do not use 4 byte ip addresses in encryption code
- Because of a bug in the netlink xfrm code, our code will
  fail to find and remove the states. While we could wait
  for the netlink library fix, there is no longer a need to
  convert the parsed IP addresses to the canonical notation
  given the previous SPI computation (which worked on that
  4 byte address assumption) is now replaced by the fnv hash.
- Also modify driver option that enables ipsec to "encrypted"

Signed-off-by: Alessandro Boch <aboch@docker.com>
2016-07-23 19:00:47 -07:00
Alessandro Boch
6b486d88e6 Merge pull request #1337 from mavenugo/adv-addr
Add advertise-addr support
2016-07-21 09:51:51 -07:00
Madhu Venugopal
6368406c26 Adding Advertise-addr support
With this change, all the auto-detection of the addresses are removed
from libnetwork and the caller takes the responsibilty to have a proper
advertise-addr in various scenarios (including externally facing public
advertise-addr with an internal facing private listen-addr)

Signed-off-by: Madhu Venugopal <madhu@docker.com>
2016-07-21 02:44:25 -07:00
Madhu Venugopal
46caa4c813 Merge pull request #1339 from aboch/sec
Adjust container's veth MTU when encryption is on
2016-07-21 01:43:18 -07:00
Alessandro Boch
6aa25f33d4 Adjust container's veth MTU when encryption is on
Signed-off-by: Alessandro Boch <aboch@docker.com>
2016-07-20 17:13:05 -07:00
Alessandro Boch
ddff1b5a87 Use fnv1-a to construct the SPI
Signed-off-by: Alessandro Boch <aboch@docker.com>
2016-07-20 12:50:33 -07:00
Alessandro Boch
253c103b8c Use aead for dataplane encryption
Signed-off-by: Alessandro Boch <aboch@docker.com>
2016-07-19 11:48:28 -07:00
Santhosh Manohar
8ded762a0b Update key handling logic to process keyring with 3 keys
Signed-off-by: Santhosh Manohar <santhosh@docker.com>
2016-06-11 04:50:25 -07:00
Alessandro Boch
48739b5868 Reduce overlay encryption log noise
Signed-off-by: Alessandro Boch <aboch@docker.com>
2016-06-15 09:25:28 -07:00
Alessandro Boch
41ca84c950 Populate nlHandle and use it on netns restore
- also in overlay/encryprion.go

Signed-off-by: Alessandro Boch <aboch@docker.com>
2016-06-13 23:48:00 -07:00
Alessandro Boch
93b5073a7d Overlay driver to support network layer encryption
Signed-off-by: Alessandro Boch <aboch@docker.com>
2016-06-08 23:38:55 -07:00