package docker import ( "encoding/binary" "errors" "fmt" "github.com/dotcloud/docker/iptables" "github.com/dotcloud/docker/pkg/netlink" "github.com/dotcloud/docker/proxy" "github.com/dotcloud/docker/utils" "log" "net" "strconv" "sync" "syscall" "unsafe" ) const ( DefaultNetworkBridge = "docker0" DisableNetworkBridge = "none" DefaultNetworkMtu = 1500 portRangeStart = 49153 portRangeEnd = 65535 siocBRADDBR = 0x89a0 ) // Calculates the first and last IP addresses in an IPNet func networkRange(network *net.IPNet) (net.IP, net.IP) { netIP := network.IP.To4() firstIP := netIP.Mask(network.Mask) lastIP := net.IPv4(0, 0, 0, 0).To4() for i := 0; i < len(lastIP); i++ { lastIP[i] = netIP[i] | ^network.Mask[i] } return firstIP, lastIP } // Detects overlap between one IPNet and another func networkOverlaps(netX *net.IPNet, netY *net.IPNet) bool { firstIP, _ := networkRange(netX) if netY.Contains(firstIP) { return true } firstIP, _ = networkRange(netY) if netX.Contains(firstIP) { return true } return false } // Converts a 4 bytes IP into a 32 bit integer func ipToInt(ip net.IP) int32 { return int32(binary.BigEndian.Uint32(ip.To4())) } // Converts 32 bit integer into a 4 bytes IP address func intToIP(n int32) net.IP { b := make([]byte, 4) binary.BigEndian.PutUint32(b, uint32(n)) return net.IP(b) } // Given a netmask, calculates the number of available hosts func networkSize(mask net.IPMask) int32 { m := net.IPv4Mask(0, 0, 0, 0) for i := 0; i < net.IPv4len; i++ { m[i] = ^mask[i] } return int32(binary.BigEndian.Uint32(m)) + 1 } func checkRouteOverlaps(networks []*net.IPNet, dockerNetwork *net.IPNet) error { for _, network := range networks { if networkOverlaps(dockerNetwork, network) { return fmt.Errorf("Network %s is already routed: '%s'", dockerNetwork, network) } } return nil } func checkNameserverOverlaps(nameservers []string, dockerNetwork *net.IPNet) error { if len(nameservers) > 0 { for _, ns := range nameservers { _, nsNetwork, err := net.ParseCIDR(ns) if err != nil { return err } if networkOverlaps(dockerNetwork, nsNetwork) { return fmt.Errorf("%s overlaps nameserver %s", dockerNetwork, nsNetwork) } } } return nil } // CreateBridgeIface creates a network bridge interface on the host system with the name `ifaceName`, // and attempts to configure it with an address which doesn't conflict with any other interface on the host. // If it can't find an address which doesn't conflict, it will return an error. func CreateBridgeIface(config *DaemonConfig) error { addrs := []string{ // Here we don't follow the convention of using the 1st IP of the range for the gateway. // This is to use the same gateway IPs as the /24 ranges, which predate the /16 ranges. // In theory this shouldn't matter - in practice there's bound to be a few scripts relying // on the internal addressing or other stupid things like that. // The shouldn't, but hey, let's not break them unless we really have to. "172.17.42.1/16", // Don't use 172.16.0.0/16, it conflicts with EC2 DNS 172.16.0.23 "10.0.42.1/16", // Don't even try using the entire /8, that's too intrusive "10.1.42.1/16", "10.42.42.1/16", "172.16.42.1/24", "172.16.43.1/24", "172.16.44.1/24", "10.0.42.1/24", "10.0.43.1/24", "192.168.42.1/24", "192.168.43.1/24", "192.168.44.1/24", } nameservers := []string{} resolvConf, _ := utils.GetResolvConf() // we don't check for an error here, because we don't really care // if we can't read /etc/resolv.conf. So instead we skip the append // if resolvConf is nil. It either doesn't exist, or we can't read it // for some reason. if resolvConf != nil { nameservers = append(nameservers, utils.GetNameserversAsCIDR(resolvConf)...) } var ifaceAddr string if len(config.BridgeIp) != 0 { _, _, err := net.ParseCIDR(config.BridgeIp) if err != nil { return err } ifaceAddr = config.BridgeIp } else { for _, addr := range addrs { _, dockerNetwork, err := net.ParseCIDR(addr) if err != nil { return err } routes, err := netlink.NetworkGetRoutes() if err != nil { return err } if err := checkRouteOverlaps(routes, dockerNetwork); err == nil { if err := checkNameserverOverlaps(nameservers, dockerNetwork); err == nil { ifaceAddr = addr break } } else { utils.Debugf("%s: %s", addr, err) } } } if ifaceAddr == "" { return fmt.Errorf("Could not find a free IP address range for interface '%s'. Please configure its address manually and run 'docker -b %s'", config.BridgeIface, config.BridgeIface) } utils.Debugf("Creating bridge %s with network %s", config.BridgeIface, ifaceAddr) if err := createBridgeIface(config.BridgeIface); err != nil { return err } iface, err := net.InterfaceByName(config.BridgeIface) if err != nil { return err } ipAddr, ipNet, err := net.ParseCIDR(ifaceAddr) if err != nil { return err } if netlink.NetworkLinkAddIp(iface, ipAddr, ipNet); err != nil { return fmt.Errorf("Unable to add private network: %s", err) } if err := netlink.NetworkLinkUp(iface); err != nil { return fmt.Errorf("Unable to start network bridge: %s", err) } return nil } // Create the actual bridge device. This is more backward-compatible than // netlink.NetworkLinkAdd and works on RHEL 6. func createBridgeIface(name string) error { s, err := syscall.Socket(syscall.AF_INET6, syscall.SOCK_STREAM, syscall.IPPROTO_IP) if err != nil { utils.Debugf("Bridge socket creation failed IPv6 probably not enabled: %v", err) s, err = syscall.Socket(syscall.AF_INET, syscall.SOCK_STREAM, syscall.IPPROTO_IP) if err != nil { return fmt.Errorf("Error creating bridge creation socket: %s", err) } } defer syscall.Close(s) nameBytePtr, err := syscall.BytePtrFromString(name) if err != nil { return fmt.Errorf("Error converting bridge name %s to byte array: %s", name, err) } if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, uintptr(s), siocBRADDBR, uintptr(unsafe.Pointer(nameBytePtr))); err != 0 { return fmt.Errorf("Error creating bridge: %s", err) } return nil } // Return the IPv4 address of a network interface func getIfaceAddr(name string) (net.Addr, error) { iface, err := net.InterfaceByName(name) if err != nil { return nil, err } addrs, err := iface.Addrs() if err != nil { return nil, err } var addrs4 []net.Addr for _, addr := range addrs { ip := (addr.(*net.IPNet)).IP if ip4 := ip.To4(); len(ip4) == net.IPv4len { addrs4 = append(addrs4, addr) } } switch { case len(addrs4) == 0: return nil, fmt.Errorf("Interface %v has no IP addresses", name) case len(addrs4) > 1: fmt.Printf("Interface %v has more than 1 IPv4 address. Defaulting to using %v\n", name, (addrs4[0].(*net.IPNet)).IP) } return addrs4[0], nil } // Port mapper takes care of mapping external ports to containers by setting // up iptables rules. // It keeps track of all mappings and is able to unmap at will type PortMapper struct { tcpMapping map[string]*net.TCPAddr tcpProxies map[string]proxy.Proxy udpMapping map[string]*net.UDPAddr udpProxies map[string]proxy.Proxy iptables *iptables.Chain defaultIp net.IP proxyFactoryFunc func(net.Addr, net.Addr) (proxy.Proxy, error) } func (mapper *PortMapper) Map(ip net.IP, port int, backendAddr net.Addr) error { mapKey := (&net.TCPAddr{Port: port, IP: ip}).String() if _, exists := mapper.tcpProxies[mapKey]; exists { return fmt.Errorf("Port %s is already in use", mapKey) } if _, isTCP := backendAddr.(*net.TCPAddr); isTCP { backendPort := backendAddr.(*net.TCPAddr).Port backendIP := backendAddr.(*net.TCPAddr).IP if mapper.iptables != nil { if err := mapper.iptables.Forward(iptables.Add, ip, port, "tcp", backendIP.String(), backendPort); err != nil { return err } } mapper.tcpMapping[mapKey] = backendAddr.(*net.TCPAddr) proxy, err := mapper.proxyFactoryFunc(&net.TCPAddr{IP: ip, Port: port}, backendAddr) if err != nil { mapper.Unmap(ip, port, "tcp") return err } mapper.tcpProxies[mapKey] = proxy go proxy.Run() } else { backendPort := backendAddr.(*net.UDPAddr).Port backendIP := backendAddr.(*net.UDPAddr).IP if mapper.iptables != nil { if err := mapper.iptables.Forward(iptables.Add, ip, port, "udp", backendIP.String(), backendPort); err != nil { return err } } mapper.udpMapping[mapKey] = backendAddr.(*net.UDPAddr) proxy, err := mapper.proxyFactoryFunc(&net.UDPAddr{IP: ip, Port: port}, backendAddr) if err != nil { mapper.Unmap(ip, port, "udp") return err } mapper.udpProxies[mapKey] = proxy go proxy.Run() } return nil } func (mapper *PortMapper) Unmap(ip net.IP, port int, proto string) error { mapKey := (&net.TCPAddr{Port: port, IP: ip}).String() if proto == "tcp" { backendAddr, ok := mapper.tcpMapping[mapKey] if !ok { return fmt.Errorf("Port tcp/%s is not mapped", mapKey) } if proxy, exists := mapper.tcpProxies[mapKey]; exists { proxy.Close() delete(mapper.tcpProxies, mapKey) } if mapper.iptables != nil { if err := mapper.iptables.Forward(iptables.Delete, ip, port, proto, backendAddr.IP.String(), backendAddr.Port); err != nil { return err } } delete(mapper.tcpMapping, mapKey) } else { backendAddr, ok := mapper.udpMapping[mapKey] if !ok { return fmt.Errorf("Port udp/%s is not mapped", mapKey) } if proxy, exists := mapper.udpProxies[mapKey]; exists { proxy.Close() delete(mapper.udpProxies, mapKey) } if mapper.iptables != nil { if err := mapper.iptables.Forward(iptables.Delete, ip, port, proto, backendAddr.IP.String(), backendAddr.Port); err != nil { return err } } delete(mapper.udpMapping, mapKey) } return nil } func newPortMapper(config *DaemonConfig) (*PortMapper, error) { // We can always try removing the iptables if err := iptables.RemoveExistingChain("DOCKER"); err != nil { return nil, err } var chain *iptables.Chain if config.EnableIptables { var err error chain, err = iptables.NewChain("DOCKER", config.BridgeIface) if err != nil { return nil, fmt.Errorf("Failed to create DOCKER chain: %s", err) } } mapper := &PortMapper{ tcpMapping: make(map[string]*net.TCPAddr), tcpProxies: make(map[string]proxy.Proxy), udpMapping: make(map[string]*net.UDPAddr), udpProxies: make(map[string]proxy.Proxy), iptables: chain, defaultIp: config.DefaultIp, proxyFactoryFunc: proxy.NewProxy, } return mapper, nil } // Port allocator: Automatically allocate and release networking ports type PortAllocator struct { sync.Mutex inUse map[string]struct{} fountain chan int quit chan bool } func (alloc *PortAllocator) runFountain() { for { for port := portRangeStart; port < portRangeEnd; port++ { select { case alloc.fountain <- port: case quit := <-alloc.quit: if quit { return } } } } } // FIXME: Release can no longer fail, change its prototype to reflect that. func (alloc *PortAllocator) Release(addr net.IP, port int) error { mapKey := (&net.TCPAddr{Port: port, IP: addr}).String() utils.Debugf("Releasing %d", port) alloc.Lock() delete(alloc.inUse, mapKey) alloc.Unlock() return nil } func (alloc *PortAllocator) Acquire(addr net.IP, port int) (int, error) { mapKey := (&net.TCPAddr{Port: port, IP: addr}).String() utils.Debugf("Acquiring %s", mapKey) if port == 0 { // Allocate a port from the fountain for port := range alloc.fountain { if _, err := alloc.Acquire(addr, port); err == nil { return port, nil } } return -1, fmt.Errorf("Port generator ended unexpectedly") } alloc.Lock() defer alloc.Unlock() if _, inUse := alloc.inUse[mapKey]; inUse { return -1, fmt.Errorf("Port already in use: %d", port) } alloc.inUse[mapKey] = struct{}{} return port, nil } func (alloc *PortAllocator) Close() error { alloc.quit <- true close(alloc.quit) close(alloc.fountain) return nil } func newPortAllocator() (*PortAllocator, error) { allocator := &PortAllocator{ inUse: make(map[string]struct{}), fountain: make(chan int), quit: make(chan bool), } go allocator.runFountain() return allocator, nil } // IP allocator: Automatically allocate and release networking ports type IPAllocator struct { network *net.IPNet queueAlloc chan allocatedIP queueReleased chan net.IP inUse map[int32]struct{} quit chan bool } type allocatedIP struct { ip net.IP err error } func (alloc *IPAllocator) run() { firstIP, _ := networkRange(alloc.network) ipNum := ipToInt(firstIP) ownIP := ipToInt(alloc.network.IP) size := networkSize(alloc.network.Mask) pos := int32(1) max := size - 2 // -1 for the broadcast address, -1 for the gateway address for { var ( newNum int32 inUse bool ) // Find first unused IP, give up after one whole round for attempt := int32(0); attempt < max; attempt++ { newNum = ipNum + pos pos = pos%max + 1 // The network's IP is never okay to use if newNum == ownIP { continue } if _, inUse = alloc.inUse[newNum]; !inUse { // We found an unused IP break } } ip := allocatedIP{ip: intToIP(newNum)} if inUse { ip.err = errors.New("No unallocated IP available") } select { case quit := <-alloc.quit: if quit { return } case alloc.queueAlloc <- ip: alloc.inUse[newNum] = struct{}{} case released := <-alloc.queueReleased: r := ipToInt(released) delete(alloc.inUse, r) if inUse { // If we couldn't allocate a new IP, the released one // will be the only free one now, so instantly use it // next time pos = r - ipNum } else { // Use same IP as last time if pos == 1 { pos = max } else { pos-- } } } } } func (alloc *IPAllocator) Acquire() (net.IP, error) { ip := <-alloc.queueAlloc return ip.ip, ip.err } func (alloc *IPAllocator) Release(ip net.IP) { alloc.queueReleased <- ip } func (alloc *IPAllocator) Close() error { alloc.quit <- true close(alloc.quit) close(alloc.queueAlloc) close(alloc.queueReleased) return nil } func newIPAllocator(network *net.IPNet) *IPAllocator { alloc := &IPAllocator{ network: network, queueAlloc: make(chan allocatedIP), queueReleased: make(chan net.IP), inUse: make(map[int32]struct{}), quit: make(chan bool), } go alloc.run() return alloc } // Network interface represents the networking stack of a container type NetworkInterface struct { IPNet net.IPNet Gateway net.IP manager *NetworkManager extPorts []*Nat disabled bool } // Allocate an external port and map it to the interface func (iface *NetworkInterface) AllocatePort(port Port, binding PortBinding) (*Nat, error) { if iface.disabled { return nil, fmt.Errorf("Trying to allocate port for interface %v, which is disabled", iface) // FIXME } ip := iface.manager.portMapper.defaultIp if binding.HostIp != "" { ip = net.ParseIP(binding.HostIp) } else { binding.HostIp = ip.String() } nat := &Nat{ Port: port, Binding: binding, } containerPort, err := parsePort(port.Port()) if err != nil { return nil, err } hostPort, _ := parsePort(nat.Binding.HostPort) if nat.Port.Proto() == "tcp" { extPort, err := iface.manager.tcpPortAllocator.Acquire(ip, hostPort) if err != nil { return nil, err } backend := &net.TCPAddr{IP: iface.IPNet.IP, Port: containerPort} if err := iface.manager.portMapper.Map(ip, extPort, backend); err != nil { iface.manager.tcpPortAllocator.Release(ip, extPort) return nil, err } nat.Binding.HostPort = strconv.Itoa(extPort) } else { extPort, err := iface.manager.udpPortAllocator.Acquire(ip, hostPort) if err != nil { return nil, err } backend := &net.UDPAddr{IP: iface.IPNet.IP, Port: containerPort} if err := iface.manager.portMapper.Map(ip, extPort, backend); err != nil { iface.manager.udpPortAllocator.Release(ip, extPort) return nil, err } nat.Binding.HostPort = strconv.Itoa(extPort) } iface.extPorts = append(iface.extPorts, nat) return nat, nil } type Nat struct { Port Port Binding PortBinding } func (n *Nat) String() string { return fmt.Sprintf("%s:%s:%s/%s", n.Binding.HostIp, n.Binding.HostPort, n.Port.Port(), n.Port.Proto()) } // Release: Network cleanup - release all resources func (iface *NetworkInterface) Release() { if iface.disabled { return } for _, nat := range iface.extPorts { hostPort, err := parsePort(nat.Binding.HostPort) if err != nil { log.Printf("Unable to get host port: %s", err) continue } ip := net.ParseIP(nat.Binding.HostIp) utils.Debugf("Unmaping %s/%s:%s", nat.Port.Proto, ip.String(), nat.Binding.HostPort) if err := iface.manager.portMapper.Unmap(ip, hostPort, nat.Port.Proto()); err != nil { log.Printf("Unable to unmap port %s: %s", nat, err) } if nat.Port.Proto() == "tcp" { if err := iface.manager.tcpPortAllocator.Release(ip, hostPort); err != nil { log.Printf("Unable to release port %s", nat) } } else if nat.Port.Proto() == "udp" { if err := iface.manager.udpPortAllocator.Release(ip, hostPort); err != nil { log.Printf("Unable to release port %s: %s", nat, err) } } } iface.manager.ipAllocator.Release(iface.IPNet.IP) } // Network Manager manages a set of network interfaces // Only *one* manager per host machine should be used type NetworkManager struct { bridgeIface string bridgeNetwork *net.IPNet ipAllocator *IPAllocator tcpPortAllocator *PortAllocator udpPortAllocator *PortAllocator portMapper *PortMapper disabled bool } // Allocate a network interface func (manager *NetworkManager) Allocate() (*NetworkInterface, error) { if manager.disabled { return &NetworkInterface{disabled: true}, nil } var ip net.IP var err error ip, err = manager.ipAllocator.Acquire() if err != nil { return nil, err } // avoid duplicate IP ipNum := ipToInt(ip) firstIP := manager.ipAllocator.network.IP.To4().Mask(manager.ipAllocator.network.Mask) firstIPNum := ipToInt(firstIP) + 1 if firstIPNum == ipNum { ip, err = manager.ipAllocator.Acquire() if err != nil { return nil, err } } iface := &NetworkInterface{ IPNet: net.IPNet{IP: ip, Mask: manager.bridgeNetwork.Mask}, Gateway: manager.bridgeNetwork.IP, manager: manager, } return iface, nil } func (manager *NetworkManager) Close() error { if manager.disabled { return nil } err1 := manager.tcpPortAllocator.Close() err2 := manager.udpPortAllocator.Close() err3 := manager.ipAllocator.Close() if err1 != nil { return err1 } if err2 != nil { return err2 } return err3 } func newNetworkManager(config *DaemonConfig) (*NetworkManager, error) { if config.BridgeIface == DisableNetworkBridge { manager := &NetworkManager{ disabled: true, } return manager, nil } addr, err := getIfaceAddr(config.BridgeIface) if err != nil { // If the iface is not found, try to create it if err := CreateBridgeIface(config); err != nil { return nil, err } addr, err = getIfaceAddr(config.BridgeIface) if err != nil { return nil, err } } network := addr.(*net.IPNet) // Configure iptables for link support if config.EnableIptables { // Enable NAT natArgs := []string{"POSTROUTING", "-t", "nat", "-s", addr.String(), "!", "-d", addr.String(), "-j", "MASQUERADE"} if !iptables.Exists(natArgs...) { if output, err := iptables.Raw(append([]string{"-A"}, natArgs...)...); err != nil { return nil, fmt.Errorf("Unable to enable network bridge NAT: %s", err) } else if len(output) != 0 { return nil, fmt.Errorf("Error iptables postrouting: %s", output) } } // Accept incoming packets for existing connections existingArgs := []string{"FORWARD", "-o", config.BridgeIface, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"} if !iptables.Exists(existingArgs...) { if output, err := iptables.Raw(append([]string{"-I"}, existingArgs...)...); err != nil { return nil, fmt.Errorf("Unable to allow incoming packets: %s", err) } else if len(output) != 0 { return nil, fmt.Errorf("Error iptables allow incoming: %s", output) } } // Accept all non-intercontainer outgoing packets outgoingArgs := []string{"FORWARD", "-i", config.BridgeIface, "!", "-o", config.BridgeIface, "-j", "ACCEPT"} if !iptables.Exists(outgoingArgs...) { if output, err := iptables.Raw(append([]string{"-I"}, outgoingArgs...)...); err != nil { return nil, fmt.Errorf("Unable to allow outgoing packets: %s", err) } else if len(output) != 0 { return nil, fmt.Errorf("Error iptables allow outgoing: %s", output) } } args := []string{"FORWARD", "-i", config.BridgeIface, "-o", config.BridgeIface, "-j"} acceptArgs := append(args, "ACCEPT") dropArgs := append(args, "DROP") if !config.InterContainerCommunication { iptables.Raw(append([]string{"-D"}, acceptArgs...)...) if !iptables.Exists(dropArgs...) { utils.Debugf("Disable inter-container communication") if output, err := iptables.Raw(append([]string{"-I"}, dropArgs...)...); err != nil { return nil, fmt.Errorf("Unable to prevent intercontainer communication: %s", err) } else if len(output) != 0 { return nil, fmt.Errorf("Error disabling intercontainer communication: %s", output) } } } else { iptables.Raw(append([]string{"-D"}, dropArgs...)...) if !iptables.Exists(acceptArgs...) { utils.Debugf("Enable inter-container communication") if output, err := iptables.Raw(append([]string{"-I"}, acceptArgs...)...); err != nil { return nil, fmt.Errorf("Unable to allow intercontainer communication: %s", err) } else if len(output) != 0 { return nil, fmt.Errorf("Error enabling intercontainer communication: %s", output) } } } } ipAllocator := newIPAllocator(network) tcpPortAllocator, err := newPortAllocator() if err != nil { return nil, err } udpPortAllocator, err := newPortAllocator() if err != nil { return nil, err } portMapper, err := newPortMapper(config) if err != nil { return nil, err } manager := &NetworkManager{ bridgeIface: config.BridgeIface, bridgeNetwork: network, ipAllocator: ipAllocator, tcpPortAllocator: tcpPortAllocator, udpPortAllocator: udpPortAllocator, portMapper: portMapper, } return manager, nil }