1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
moby--moby/libnetwork
Sebastiaan van Stijn 997ec12ec8
set ReadHeaderTimeout to address G112: Potential Slowloris Attack (gosec)
After discussing in the maintainers meeting, we concluded that Slowloris attacks
are not a real risk other than potentially having some additional goroutines
lingering around, so setting a long timeout to satisfy the linter, and to at
least have "some" timeout.

    libnetwork/diagnostic/server.go:96:10: G112: Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server (gosec)
        srv := &http.Server{
            Addr:    net.JoinHostPort(ip, strconv.Itoa(port)),
            Handler: s,
        }
    api/server/server.go:60:10: G112: Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server (gosec)
                srv: &http.Server{
                    Addr: addr,
                },
    daemon/metrics_unix.go:34:13: G114: Use of net/http serve function that has no support for setting timeouts (gosec)
            if err := http.Serve(l, mux); err != nil && !strings.Contains(err.Error(), "use of closed network connection") {
                      ^
    cmd/dockerd/metrics.go:27:13: G114: Use of net/http serve function that has no support for setting timeouts (gosec)
            if err := http.Serve(l, mux); err != nil && !strings.Contains(err.Error(), "use of closed network connection") {
                      ^

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 55fd77f724)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-09-22 12:27:32 +02:00
..
bitseq gofmt GoDoc comments with go1.19 2022-07-13 22:42:29 +02:00
cluster
cmd fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
config Revert "Added API to set ephemeral port allocator range." 2022-06-02 22:56:18 +02:00
datastore gofmt GoDoc comments with go1.19 2022-07-13 22:42:29 +02:00
diagnostic set ReadHeaderTimeout to address G112: Potential Slowloris Attack (gosec) 2022-09-22 12:27:32 +02:00
discoverapi
docs libnetwork: remove consul-related code and tests 2022-01-06 18:45:41 +01:00
driverapi libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
drivers libnetwork/drivers/ipvlan: fix missing IpvlanFlag field in config JSON 2022-08-24 13:46:31 +02:00
drvregistry libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
etchosts refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
idm libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
internal libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
ipam Make the network allocator handle IPv4 blocks too small for network/broadcast addresses. 2021-10-27 13:03:19 +02:00
ipamapi libnetwork/ipamapi: godoc fixes 2021-08-27 16:52:46 +02:00
ipams gofmt GoDoc comments with go1.19 2022-07-13 22:42:29 +02:00
ipamutils panic() instead of logrus.Fatal() in init funcs 2022-04-21 12:15:20 +02:00
iptables libnetwork: skip firewalld management for rootless 2022-07-15 13:40:07 +02:00
netlabel libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
netutils Merge pull request #42777 from thaJeztah/update_go_1.17 2021-08-26 21:24:23 +02:00
networkdb linting: suppress false positive for G404 (gosec) 2022-09-06 15:11:42 +02:00
ns
options fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
osl bump netlink library 2022-06-16 22:25:33 +02:00
portallocator libnetwork/portallocator: un-export consts for defaults 2022-06-02 22:59:32 +02:00
portmapper refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
resolvconf update to golang 1.19 2022-09-07 22:11:46 +02:00
support
test/integration libnetwork: remove etcd-related code and tests 2022-01-06 18:45:43 +01:00
testutils gofmt GoDoc comments with go1.19 2022-07-13 22:42:29 +02:00
types libnetwork/types: remove TransportPort.FromString() as it's unused 2021-08-27 14:16:32 +02:00
.dockerignore
.gitignore
agent.go
agent.pb.go
agent.proto
CHANGELOG.md
controller.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
default_gateway.go
default_gateway_freebsd.go
default_gateway_linux.go
default_gateway_windows.go
drivers_freebsd.go
drivers_ipam.go
drivers_linux.go
drivers_windows.go
endpoint.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
endpoint_cnt.go
endpoint_info.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
endpoint_info_unix.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
endpoint_info_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
endpoint_test.go refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
error.go
errors_test.go
firewall_linux.go fix some minor linting issues 2022-07-04 10:15:28 +02:00
firewall_linux_test.go
firewall_others.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
libnetwork_internal_test.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
libnetwork_linux_test.go refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
libnetwork_test.go libnetwork: fix unhandled errors in tests (ineffassign) 2022-02-08 09:43:27 +01:00
libnetwork_unix_test.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
libnetwork_windows_test.go
network.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
network_unix.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
network_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
README.md
resolver.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
resolver_test.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
resolver_unix.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
resolver_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
sandbox.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
sandbox_dns_unix.go refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
sandbox_dns_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
sandbox_externalkey.go
sandbox_externalkey_unix.go refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
sandbox_externalkey_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
sandbox_store.go
sandbox_test.go
service.go
service_common.go fix formatting of "nolint" tags for go1.19 2022-07-15 13:45:13 +02:00
service_common_test.go
service_linux.go Ensure performance tuning is always applied 2022-05-31 11:47:30 -04:00
service_unsupported.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
service_windows.go Log HNS policylist removal failures 2022-04-19 14:21:29 +00:00
store.go libnetwork: remove etcd-related code and tests 2022-01-06 18:45:43 +01:00
store_linux_test.go
store_test.go refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00

libnetwork - networking for containers

Libnetwork provides a native Go implementation for connecting containers

The goal of libnetwork is to deliver a robust Container Network Model that provides a consistent programming interface and the required network abstractions for applications.

Design

Please refer to the design for more information.

Using libnetwork

There are many networking solutions available to suit a broad range of use-cases. libnetwork uses a driver / plugin model to support all of these solutions while abstracting the complexity of the driver implementations by exposing a simple and consistent Network Model to users.

package main

import (
	"fmt"
	"log"

	"github.com/docker/docker/pkg/reexec"
	"github.com/docker/docker/libnetwork"
	"github.com/docker/docker/libnetwork/config"
	"github.com/docker/docker/libnetwork/netlabel"
	"github.com/docker/docker/libnetwork/options"
)

func main() {
	if reexec.Init() {
		return
	}

	// Select and configure the network driver
	networkType := "bridge"

	// Create a new controller instance
	driverOptions := options.Generic{}
	genericOption := make(map[string]interface{})
	genericOption[netlabel.GenericData] = driverOptions
	controller, err := libnetwork.New(config.OptionDriverConfig(networkType, genericOption))
	if err != nil {
		log.Fatalf("libnetwork.New: %s", err)
	}

	// Create a network for containers to join.
	// NewNetwork accepts Variadic optional arguments that libnetwork and Drivers can use.
	network, err := controller.NewNetwork(networkType, "network1", "")
	if err != nil {
		log.Fatalf("controller.NewNetwork: %s", err)
	}

	// For each new container: allocate IP and interfaces. The returned network
	// settings will be used for container infos (inspect and such), as well as
	// iptables rules for port publishing. This info is contained or accessible
	// from the returned endpoint.
	ep, err := network.CreateEndpoint("Endpoint1")
	if err != nil {
		log.Fatalf("network.CreateEndpoint: %s", err)
	}

	// Create the sandbox for the container.
	// NewSandbox accepts Variadic optional arguments which libnetwork can use.
	sbx, err := controller.NewSandbox("container1",
		libnetwork.OptionHostname("test"),
		libnetwork.OptionDomainname("docker.io"))
	if err != nil {
		log.Fatalf("controller.NewSandbox: %s", err)
	}

	// A sandbox can join the endpoint via the join api.
	err = ep.Join(sbx)
	if err != nil {
		log.Fatalf("ep.Join: %s", err)
	}

	// libnetwork client can check the endpoint's operational data via the Info() API
	epInfo, err := ep.DriverInfo()
	if err != nil {
		log.Fatalf("ep.DriverInfo: %s", err)
	}

	macAddress, ok := epInfo[netlabel.MacAddress]
	if !ok {
		log.Fatalf("failed to get mac address from endpoint info")
	}

	fmt.Printf("Joined endpoint %s (%s) to sandbox %s (%s)\n", ep.Name(), macAddress, sbx.ContainerID(), sbx.Key())
}

Contributing

Want to hack on libnetwork? Docker's contributions guidelines apply.

Code and documentation copyright 2015 Docker, inc. Code released under the Apache 2.0 license. Docs released under Creative commons.