Add destination to iptables conf

2026-08-26 09:36:04 +00:00 · 2013-09-09 20:41:15 +00:00
parent 46c82d0391
commit 6c1ec9c28f
6 changed files with 158 additions and 111 deletions
@@ -915,6 +915,7 @@ func (container *Container) allocateNetwork(hostConfig *HostConfig) error {
 	}

 	if container.Config.PortSpecs != nil {
+		utils.Debugf("Migrating port mappings for container: %s", strings.Join(container.Config.PortSpecs, ", "))
 		if err := migratePortMappings(container.Config); err != nil {
 			return err
 		}
@@ -944,6 +945,9 @@ func (container *Container) allocateNetwork(hostConfig *HostConfig) error {

 	for port := range portSpecs {
 		binding := bindings[port]
+		if len(binding) == 0 {
+			binding = append(binding, PortBinding{})
+		}
 		for i := 0; i < len(binding); i++ {
 			b := binding[i]
 			nat, err := iface.AllocatePort(port, b)
@@ -51,11 +51,14 @@ func RemoveExistingChain(name string) error {
 	return chain.Remove()
 }

-func (c *Chain) Forward(action Action, port int, proto, dest_addr string, dest_port int) error {
+func (c *Chain) Forward(action Action, ip net.IP, port int, proto, dest_addr string, dest_port int) error {
 	return Raw("-t", "nat", fmt.Sprint(action), c.Name,
-		"-p", proto, "--dport", strconv.Itoa(port),
+		"-p", proto,
+		"-d", ip.String(),
+		"--dport", strconv.Itoa(port),
 		"!", "-i", c.Bridge,
-		"-j", "DNAT", "--to-destination", net.JoinHostPort(dest_addr, strconv.Itoa(dest_port)))
+		"-j", "DNAT",
+		"--to-destination", net.JoinHostPort(dest_addr, strconv.Itoa(dest_port)))
 }

 func (c *Chain) Prerouting(action Action, args ...string) error {
@@ -214,19 +214,19 @@ type PortMapper struct {
 	defaultIp net.IP
 }

-func (mapper *PortMapper) Map(port int, backendAddr net.Addr, proxyIp net.IP) error {
+func (mapper *PortMapper) Map(ip net.IP, port int, backendAddr net.Addr) error {
 	if _, isTCP := backendAddr.(*net.TCPAddr); isTCP {
 		backendPort := backendAddr.(*net.TCPAddr).Port
 		backendIP := backendAddr.(*net.TCPAddr).IP
 		if mapper.iptables != nil {
-			if err := mapper.iptables.Forward(iptables.Add, port, "tcp", backendIP.String(), backendPort); err != nil {
+			if err := mapper.iptables.Forward(iptables.Add, ip, port, "tcp", backendIP.String(), backendPort); err != nil {
 				return err
 			}
 		}
 		mapper.tcpMapping[port] = backendAddr.(*net.TCPAddr)
-		proxy, err := proxy.NewProxy(&net.TCPAddr{IP: proxyIp, Port: port}, backendAddr)
+		proxy, err := proxy.NewProxy(&net.TCPAddr{IP: ip, Port: port}, backendAddr)
 		if err != nil {
-			mapper.Unmap(port, "tcp")
+			mapper.Unmap(ip, port, "tcp")
 			return err
 		}
 		mapper.tcpProxies[port] = proxy
@@ -235,14 +235,14 @@ func (mapper *PortMapper) Map(port int, backendAddr net.Addr, proxyIp net.IP) er
 		backendPort := backendAddr.(*net.UDPAddr).Port
 		backendIP := backendAddr.(*net.UDPAddr).IP
 		if mapper.iptables != nil {
-			if err := mapper.iptables.Forward(iptables.Add, port, "udp", backendIP.String(), backendPort); err != nil {
+			if err := mapper.iptables.Forward(iptables.Add, ip, port, "udp", backendIP.String(), backendPort); err != nil {
 				return err
 			}
 		}
 		mapper.udpMapping[port] = backendAddr.(*net.UDPAddr)
-		proxy, err := proxy.NewProxy(&net.UDPAddr{IP: proxyIp, Port: port}, backendAddr)
+		proxy, err := proxy.NewProxy(&net.UDPAddr{IP: ip, Port: port}, backendAddr)
 		if err != nil {
-			mapper.Unmap(port, "udp")
+			mapper.Unmap(ip, port, "udp")
 			return err
 		}
 		mapper.udpProxies[port] = proxy
@@ -251,7 +251,7 @@ func (mapper *PortMapper) Map(port int, backendAddr net.Addr, proxyIp net.IP) er
 	return nil
 }

-func (mapper *PortMapper) Unmap(port int, proto string) error {
+func (mapper *PortMapper) Unmap(ip net.IP, port int, proto string) error {
 	if proto == "tcp" {
 		backendAddr, ok := mapper.tcpMapping[port]
 		if !ok {
@@ -262,7 +262,7 @@ func (mapper *PortMapper) Unmap(port int, proto string) error {
 			delete(mapper.tcpProxies, port)
 		}
 		if mapper.iptables != nil {
-			if err := mapper.iptables.Forward(iptables.Delete, port, proto, backendAddr.IP.String(), backendAddr.Port); err != nil {
+			if err := mapper.iptables.Forward(iptables.Delete, ip, port, proto, backendAddr.IP.String(), backendAddr.Port); err != nil {
 				return err
 			}
 		}
@@ -277,7 +277,7 @@ func (mapper *PortMapper) Unmap(port int, proto string) error {
 			delete(mapper.udpProxies, port)
 		}
 		if mapper.iptables != nil {
-			if err := mapper.iptables.Forward(iptables.Delete, port, proto, backendAddr.IP.String(), backendAddr.Port); err != nil {
+			if err := mapper.iptables.Forward(iptables.Delete, ip, port, proto, backendAddr.IP.String(), backendAddr.Port); err != nil {
 				return err
 			}
 		}
@@ -503,7 +503,7 @@ func (iface *NetworkInterface) AllocatePort(port Port, binding PortBinding) (*Na
 		}

 		backend := &net.TCPAddr{IP: iface.IPNet.IP, Port: containerPort}
-		if err := iface.manager.portMapper.Map(extPort, backend, ip); err != nil {
+		if err := iface.manager.portMapper.Map(ip, extPort, backend); err != nil {
 			iface.manager.tcpPortAllocator.Release(extPort)
 			return nil, err
 		}
@@ -514,7 +514,7 @@ func (iface *NetworkInterface) AllocatePort(port Port, binding PortBinding) (*Na
 			return nil, err
 		}
 		backend := &net.UDPAddr{IP: iface.IPNet.IP, Port: containerPort}
-		if err := iface.manager.portMapper.Map(extPort, backend, ip); err != nil {
+		if err := iface.manager.portMapper.Map(ip, extPort, backend); err != nil {
 			iface.manager.udpPortAllocator.Release(extPort)
 			return nil, err
 		}
@@ -546,8 +546,9 @@ func (iface *NetworkInterface) Release() {
 			log.Printf("Unable to get host port: %s", err)
 			continue
 		}
+		ip := net.ParseIP(nat.Binding.HostIp)
 		utils.Debugf("Unmaping %s/%s", nat.Port.Proto, nat.Binding.HostPort)
-		if err := iface.manager.portMapper.Unmap(hostPort, nat.Port.Proto()); err != nil {
+		if err := iface.manager.portMapper.Unmap(ip, hostPort, nat.Port.Proto()); err != nil {
 			log.Printf("Unable to unmap port %s: %s", nat, err)
 		}
 		if nat.Port.Proto() == "tcp" {
@@ -5,101 +5,6 @@ import (
 	"testing"
 )

-//func TestParseNat(t *testing.T) {
-//	if nat, err := parseNat("4500"); err == nil {
-//		if nat.Frontend != 0 || nat.Backend != 4500 || nat.Proto != "tcp" {
-//			t.Errorf("-p 4500 should produce 0->4500/tcp, got %d->%d/%s",
-//				nat.Frontend, nat.Backend, nat.Proto)
-//		}
-//	} else {
-//		t.Fatal(err)
-//	}
-//
-//	if nat, err := parseNat(":4501"); err == nil {
-//		if nat.Frontend != 4501 || nat.Backend != 4501 || nat.Proto != "tcp" {
-//			t.Errorf("-p :4501 should produce 4501->4501/tcp, got %d->%d/%s",
-//				nat.Frontend, nat.Backend, nat.Proto)
-//		}
-//	} else {
-//		t.Fatal(err)
-//	}
-//
-//	if nat, err := parseNat("4502:4503"); err == nil {
-//		if nat.Frontend != 4502 || nat.Backend != 4503 || nat.Proto != "tcp" {
-//			t.Errorf("-p 4502:4503 should produce 4502->4503/tcp, got %d->%d/%s",
-//				nat.Frontend, nat.Backend, nat.Proto)
-//		}
-//	} else {
-//		t.Fatal(err)
-//	}
-//
-//	if nat, err := parseNat("4502:4503/tcp"); err == nil {
-//		if nat.Frontend != 4502 || nat.Backend != 4503 || nat.Proto != "tcp" {
-//			t.Errorf("-p 4502:4503/tcp should produce 4502->4503/tcp, got %d->%d/%s",
-//				nat.Frontend, nat.Backend, nat.Proto)
-//		}
-//	} else {
-//		t.Fatal(err)
-//	}
-//
-//	if nat, err := parseNat("4502:4503/udp"); err == nil {
-//		if nat.Frontend != 4502 || nat.Backend != 4503 || nat.Proto != "udp" {
-//			t.Errorf("-p 4502:4503/udp should produce 4502->4503/udp, got %d->%d/%s",
-//				nat.Frontend, nat.Backend, nat.Proto)
-//		}
-//	} else {
-//		t.Fatal(err)
-//	}
-//
-//	if nat, err := parseNat(":4503/udp"); err == nil {
-//		if nat.Frontend != 4503 || nat.Backend != 4503 || nat.Proto != "udp" {
-//			t.Errorf("-p :4503/udp should produce 4503->4503/udp, got %d->%d/%s",
-//				nat.Frontend, nat.Backend, nat.Proto)
-//		}
-//	} else {
-//		t.Fatal(err)
-//	}
-//
-//	if nat, err := parseNat(":4503/tcp"); err == nil {
-//		if nat.Frontend != 4503 || nat.Backend != 4503 || nat.Proto != "tcp" {
-//			t.Errorf("-p :4503/tcp should produce 4503->4503/tcp, got %d->%d/%s",
-//				nat.Frontend, nat.Backend, nat.Proto)
-//		}
-//	} else {
-//		t.Fatal(err)
-//	}
-//
-//	if nat, err := parseNat("4503/tcp"); err == nil {
-//		if nat.Frontend != 0 || nat.Backend != 4503 || nat.Proto != "tcp" {
-//			t.Errorf("-p 4503/tcp should produce 0->4503/tcp, got %d->%d/%s",
-//				nat.Frontend, nat.Backend, nat.Proto)
-//		}
-//	} else {
-//		t.Fatal(err)
-//	}
-//
-//	if nat, err := parseNat("4503/udp"); err == nil {
-//		if nat.Frontend != 0 || nat.Backend != 4503 || nat.Proto != "udp" {
-//			t.Errorf("-p 4503/udp should produce 0->4503/udp, got %d->%d/%s",
-//				nat.Frontend, nat.Backend, nat.Proto)
-//		}
-//	} else {
-//		t.Fatal(err)
-//	}
-//
-//	if _, err := parseNat("4503/tcpgarbage"); err == nil {
-//		t.Fatal(err)
-//	}
-//
-//	if _, err := parseNat("4503/tcp/udp"); err == nil {
-//		t.Fatal(err)
-//	}
-//
-//	if _, err := parseNat("4503/"); err == nil {
-//		t.Fatal(err)
-//	}
-//}
-
 func TestPortAllocation(t *testing.T) {
 	allocator, err := newPortAllocator()
 	if err != nil {
@@ -29,6 +29,7 @@ func CompareConfig(a, b *Config) bool {
 		len(a.Dns) != len(b.Dns) ||
 		len(a.Env) != len(b.Env) ||
 		len(a.PortSpecs) != len(b.PortSpecs) ||
+		len(a.ExposedPorts) != len(b.ExposedPorts) ||
 		len(a.Entrypoint) != len(b.Entrypoint) ||
 		len(a.Volumes) != len(b.Volumes) {
 		return false
@@ -54,6 +55,11 @@ func CompareConfig(a, b *Config) bool {
 			return false
 		}
 	}
+	for k := range a.ExposedPorts {
+		if _, exists := b.ExposedPorts[k]; !exists {
+			return false
+		}
+	}
 	for i := 0; i < len(a.Entrypoint); i++ {
 		if a.Entrypoint[i] != b.Entrypoint[i] {
 			return false
@@ -97,8 +103,10 @@ func MergeConfig(userConf, imageConf *Config) {
 				userConf.ExposedPorts[port] = struct{}{}
 			}
 		}
+		userConf.PortSpecs = nil
 	}
 	if imageConf.PortSpecs != nil && len(imageConf.PortSpecs) > 0 {
+		utils.Debugf("Migrating image port specs to containter: %s", strings.Join(imageConf.PortSpecs, ", "))
 		if userConf.ExposedPorts == nil {
 			userConf.ExposedPorts = make(map[Port]struct{})
 		}
@@ -280,3 +280,129 @@ func TestParseLxcConfOpt(t *testing.T) {
 		}
 	}
 }
+
+func TestParseNetworkOptsPrivateOnly(t *testing.T) {
+	ports, bindings, err := parsePortSpecs([]string{"192.168.1.100::80"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ports) != 1 {
+		t.Logf("Expected 1 got %d", len(ports))
+		t.FailNow()
+	}
+	if len(bindings) != 1 {
+		t.Logf("Expected 1 got %d", len(bindings))
+		t.FailNow()
+	}
+	for k := range ports {
+		if k.Proto() != "tcp" {
+			t.Logf("Expected tcp got %s", k.Proto())
+			t.Fail()
+		}
+		if k.Port() != "80" {
+			t.Logf("Expected 80 got %s", k.Port())
+			t.Fail()
+		}
+		b, exists := bindings[k]
+		if !exists {
+			t.Log("Binding does not exist")
+			t.FailNow()
+		}
+		if len(b) != 1 {
+			t.Logf("Expected 1 got %d", len(b))
+			t.FailNow()
+		}
+		s := b[0]
+		if s.HostPort != "" {
+			t.Logf("Expected \"\" got %s", s.HostPort)
+			t.Fail()
+		}
+		if s.HostIp != "192.168.1.100" {
+			t.Fail()
+		}
+	}
+}
+
+func TestParseNetworkOptsPublic(t *testing.T) {
+	ports, bindings, err := parsePortSpecs([]string{"192.168.1.100:8080:80"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ports) != 1 {
+		t.Logf("Expected 1 got %d", len(ports))
+		t.FailNow()
+	}
+	if len(bindings) != 1 {
+		t.Logf("Expected 1 got %d", len(bindings))
+		t.FailNow()
+	}
+	for k := range ports {
+		if k.Proto() != "tcp" {
+			t.Logf("Expected tcp got %s", k.Proto())
+			t.Fail()
+		}
+		if k.Port() != "80" {
+			t.Logf("Expected 80 got %s", k.Port())
+			t.Fail()
+		}
+		b, exists := bindings[k]
+		if !exists {
+			t.Log("Binding does not exist")
+			t.FailNow()
+		}
+		if len(b) != 1 {
+			t.Logf("Expected 1 got %d", len(b))
+			t.FailNow()
+		}
+		s := b[0]
+		if s.HostPort != "8080" {
+			t.Logf("Expected 8080 got %s", s.HostPort)
+			t.Fail()
+		}
+		if s.HostIp != "192.168.1.100" {
+			t.Fail()
+		}
+	}
+}
+
+func TestParseNetworkOptsUdp(t *testing.T) {
+	ports, bindings, err := parsePortSpecs([]string{"192.168.1.100::6000/udp"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ports) != 1 {
+		t.Logf("Expected 1 got %d", len(ports))
+		t.FailNow()
+	}
+	if len(bindings) != 1 {
+		t.Logf("Expected 1 got %d", len(bindings))
+		t.FailNow()
+	}
+	for k := range ports {
+		if k.Proto() != "udp" {
+			t.Logf("Expected udp got %s", k.Proto())
+			t.Fail()
+		}
+		if k.Port() != "6000" {
+			t.Logf("Expected 6000 got %s", k.Port())
+			t.Fail()
+		}
+		b, exists := bindings[k]
+		if !exists {
+			t.Log("Binding does not exist")
+			t.FailNow()
+		}
+		if len(b) != 1 {
+			t.Logf("Expected 1 got %d", len(b))
+			t.FailNow()
+		}
+		s := b[0]
+		if s.HostPort != "" {
+			t.Logf("Expected \"\" got %s", s.HostPort)
+			t.Fail()
+		}
+		if s.HostIp != "192.168.1.100" {
+			t.Fail()
+		}
+	}
+}