From 6c1ec9c28f9240280f4f3adf6364fb19343d6df2 Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Mon, 9 Sep 2013 20:41:15 +0000 Subject: [PATCH] Add destination to iptables conf --- container.go | 4 ++ iptables/iptables.go | 9 ++-- network.go | 27 +++++----- network_test.go | 95 -------------------------------- utils.go | 8 +++ utils_test.go | 126 +++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 158 insertions(+), 111 deletions(-) diff --git a/container.go b/container.go index 968c5f51d..3f16c909f 100644 --- a/container.go +++ b/container.go @@ -915,6 +915,7 @@ func (container *Container) allocateNetwork(hostConfig *HostConfig) error { } if container.Config.PortSpecs != nil { + utils.Debugf("Migrating port mappings for container: %s", strings.Join(container.Config.PortSpecs, ", ")) if err := migratePortMappings(container.Config); err != nil { return err } @@ -944,6 +945,9 @@ func (container *Container) allocateNetwork(hostConfig *HostConfig) error { for port := range portSpecs { binding := bindings[port] + if len(binding) == 0 { + binding = append(binding, PortBinding{}) + } for i := 0; i < len(binding); i++ { b := binding[i] nat, err := iface.AllocatePort(port, b) diff --git a/iptables/iptables.go b/iptables/iptables.go index fca25dd20..5974d4d9c 100644 --- a/iptables/iptables.go +++ b/iptables/iptables.go @@ -51,11 +51,14 @@ func RemoveExistingChain(name string) error { return chain.Remove() } -func (c *Chain) Forward(action Action, port int, proto, dest_addr string, dest_port int) error { +func (c *Chain) Forward(action Action, ip net.IP, port int, proto, dest_addr string, dest_port int) error { return Raw("-t", "nat", fmt.Sprint(action), c.Name, - "-p", proto, "--dport", strconv.Itoa(port), + "-p", proto, + "-d", ip.String(), + "--dport", strconv.Itoa(port), "!", "-i", c.Bridge, - "-j", "DNAT", "--to-destination", net.JoinHostPort(dest_addr, strconv.Itoa(dest_port))) + "-j", "DNAT", + "--to-destination", net.JoinHostPort(dest_addr, strconv.Itoa(dest_port))) } func (c *Chain) Prerouting(action Action, args ...string) error { diff --git a/network.go b/network.go index 8d2bd9392..84354b5c4 100644 --- a/network.go +++ b/network.go @@ -214,19 +214,19 @@ type PortMapper struct { defaultIp net.IP } -func (mapper *PortMapper) Map(port int, backendAddr net.Addr, proxyIp net.IP) error { +func (mapper *PortMapper) Map(ip net.IP, port int, backendAddr net.Addr) error { if _, isTCP := backendAddr.(*net.TCPAddr); isTCP { backendPort := backendAddr.(*net.TCPAddr).Port backendIP := backendAddr.(*net.TCPAddr).IP if mapper.iptables != nil { - if err := mapper.iptables.Forward(iptables.Add, port, "tcp", backendIP.String(), backendPort); err != nil { + if err := mapper.iptables.Forward(iptables.Add, ip, port, "tcp", backendIP.String(), backendPort); err != nil { return err } } mapper.tcpMapping[port] = backendAddr.(*net.TCPAddr) - proxy, err := proxy.NewProxy(&net.TCPAddr{IP: proxyIp, Port: port}, backendAddr) + proxy, err := proxy.NewProxy(&net.TCPAddr{IP: ip, Port: port}, backendAddr) if err != nil { - mapper.Unmap(port, "tcp") + mapper.Unmap(ip, port, "tcp") return err } mapper.tcpProxies[port] = proxy @@ -235,14 +235,14 @@ func (mapper *PortMapper) Map(port int, backendAddr net.Addr, proxyIp net.IP) er backendPort := backendAddr.(*net.UDPAddr).Port backendIP := backendAddr.(*net.UDPAddr).IP if mapper.iptables != nil { - if err := mapper.iptables.Forward(iptables.Add, port, "udp", backendIP.String(), backendPort); err != nil { + if err := mapper.iptables.Forward(iptables.Add, ip, port, "udp", backendIP.String(), backendPort); err != nil { return err } } mapper.udpMapping[port] = backendAddr.(*net.UDPAddr) - proxy, err := proxy.NewProxy(&net.UDPAddr{IP: proxyIp, Port: port}, backendAddr) + proxy, err := proxy.NewProxy(&net.UDPAddr{IP: ip, Port: port}, backendAddr) if err != nil { - mapper.Unmap(port, "udp") + mapper.Unmap(ip, port, "udp") return err } mapper.udpProxies[port] = proxy @@ -251,7 +251,7 @@ func (mapper *PortMapper) Map(port int, backendAddr net.Addr, proxyIp net.IP) er return nil } -func (mapper *PortMapper) Unmap(port int, proto string) error { +func (mapper *PortMapper) Unmap(ip net.IP, port int, proto string) error { if proto == "tcp" { backendAddr, ok := mapper.tcpMapping[port] if !ok { @@ -262,7 +262,7 @@ func (mapper *PortMapper) Unmap(port int, proto string) error { delete(mapper.tcpProxies, port) } if mapper.iptables != nil { - if err := mapper.iptables.Forward(iptables.Delete, port, proto, backendAddr.IP.String(), backendAddr.Port); err != nil { + if err := mapper.iptables.Forward(iptables.Delete, ip, port, proto, backendAddr.IP.String(), backendAddr.Port); err != nil { return err } } @@ -277,7 +277,7 @@ func (mapper *PortMapper) Unmap(port int, proto string) error { delete(mapper.udpProxies, port) } if mapper.iptables != nil { - if err := mapper.iptables.Forward(iptables.Delete, port, proto, backendAddr.IP.String(), backendAddr.Port); err != nil { + if err := mapper.iptables.Forward(iptables.Delete, ip, port, proto, backendAddr.IP.String(), backendAddr.Port); err != nil { return err } } @@ -503,7 +503,7 @@ func (iface *NetworkInterface) AllocatePort(port Port, binding PortBinding) (*Na } backend := &net.TCPAddr{IP: iface.IPNet.IP, Port: containerPort} - if err := iface.manager.portMapper.Map(extPort, backend, ip); err != nil { + if err := iface.manager.portMapper.Map(ip, extPort, backend); err != nil { iface.manager.tcpPortAllocator.Release(extPort) return nil, err } @@ -514,7 +514,7 @@ func (iface *NetworkInterface) AllocatePort(port Port, binding PortBinding) (*Na return nil, err } backend := &net.UDPAddr{IP: iface.IPNet.IP, Port: containerPort} - if err := iface.manager.portMapper.Map(extPort, backend, ip); err != nil { + if err := iface.manager.portMapper.Map(ip, extPort, backend); err != nil { iface.manager.udpPortAllocator.Release(extPort) return nil, err } @@ -546,8 +546,9 @@ func (iface *NetworkInterface) Release() { log.Printf("Unable to get host port: %s", err) continue } + ip := net.ParseIP(nat.Binding.HostIp) utils.Debugf("Unmaping %s/%s", nat.Port.Proto, nat.Binding.HostPort) - if err := iface.manager.portMapper.Unmap(hostPort, nat.Port.Proto()); err != nil { + if err := iface.manager.portMapper.Unmap(ip, hostPort, nat.Port.Proto()); err != nil { log.Printf("Unable to unmap port %s: %s", nat, err) } if nat.Port.Proto() == "tcp" { diff --git a/network_test.go b/network_test.go index de469d93c..a0492b490 100644 --- a/network_test.go +++ b/network_test.go @@ -5,101 +5,6 @@ import ( "testing" ) -//func TestParseNat(t *testing.T) { -// if nat, err := parseNat("4500"); err == nil { -// if nat.Frontend != 0 || nat.Backend != 4500 || nat.Proto != "tcp" { -// t.Errorf("-p 4500 should produce 0->4500/tcp, got %d->%d/%s", -// nat.Frontend, nat.Backend, nat.Proto) -// } -// } else { -// t.Fatal(err) -// } -// -// if nat, err := parseNat(":4501"); err == nil { -// if nat.Frontend != 4501 || nat.Backend != 4501 || nat.Proto != "tcp" { -// t.Errorf("-p :4501 should produce 4501->4501/tcp, got %d->%d/%s", -// nat.Frontend, nat.Backend, nat.Proto) -// } -// } else { -// t.Fatal(err) -// } -// -// if nat, err := parseNat("4502:4503"); err == nil { -// if nat.Frontend != 4502 || nat.Backend != 4503 || nat.Proto != "tcp" { -// t.Errorf("-p 4502:4503 should produce 4502->4503/tcp, got %d->%d/%s", -// nat.Frontend, nat.Backend, nat.Proto) -// } -// } else { -// t.Fatal(err) -// } -// -// if nat, err := parseNat("4502:4503/tcp"); err == nil { -// if nat.Frontend != 4502 || nat.Backend != 4503 || nat.Proto != "tcp" { -// t.Errorf("-p 4502:4503/tcp should produce 4502->4503/tcp, got %d->%d/%s", -// nat.Frontend, nat.Backend, nat.Proto) -// } -// } else { -// t.Fatal(err) -// } -// -// if nat, err := parseNat("4502:4503/udp"); err == nil { -// if nat.Frontend != 4502 || nat.Backend != 4503 || nat.Proto != "udp" { -// t.Errorf("-p 4502:4503/udp should produce 4502->4503/udp, got %d->%d/%s", -// nat.Frontend, nat.Backend, nat.Proto) -// } -// } else { -// t.Fatal(err) -// } -// -// if nat, err := parseNat(":4503/udp"); err == nil { -// if nat.Frontend != 4503 || nat.Backend != 4503 || nat.Proto != "udp" { -// t.Errorf("-p :4503/udp should produce 4503->4503/udp, got %d->%d/%s", -// nat.Frontend, nat.Backend, nat.Proto) -// } -// } else { -// t.Fatal(err) -// } -// -// if nat, err := parseNat(":4503/tcp"); err == nil { -// if nat.Frontend != 4503 || nat.Backend != 4503 || nat.Proto != "tcp" { -// t.Errorf("-p :4503/tcp should produce 4503->4503/tcp, got %d->%d/%s", -// nat.Frontend, nat.Backend, nat.Proto) -// } -// } else { -// t.Fatal(err) -// } -// -// if nat, err := parseNat("4503/tcp"); err == nil { -// if nat.Frontend != 0 || nat.Backend != 4503 || nat.Proto != "tcp" { -// t.Errorf("-p 4503/tcp should produce 0->4503/tcp, got %d->%d/%s", -// nat.Frontend, nat.Backend, nat.Proto) -// } -// } else { -// t.Fatal(err) -// } -// -// if nat, err := parseNat("4503/udp"); err == nil { -// if nat.Frontend != 0 || nat.Backend != 4503 || nat.Proto != "udp" { -// t.Errorf("-p 4503/udp should produce 0->4503/udp, got %d->%d/%s", -// nat.Frontend, nat.Backend, nat.Proto) -// } -// } else { -// t.Fatal(err) -// } -// -// if _, err := parseNat("4503/tcpgarbage"); err == nil { -// t.Fatal(err) -// } -// -// if _, err := parseNat("4503/tcp/udp"); err == nil { -// t.Fatal(err) -// } -// -// if _, err := parseNat("4503/"); err == nil { -// t.Fatal(err) -// } -//} - func TestPortAllocation(t *testing.T) { allocator, err := newPortAllocator() if err != nil { diff --git a/utils.go b/utils.go index 16fe4da4c..4ddb5f577 100644 --- a/utils.go +++ b/utils.go @@ -29,6 +29,7 @@ func CompareConfig(a, b *Config) bool { len(a.Dns) != len(b.Dns) || len(a.Env) != len(b.Env) || len(a.PortSpecs) != len(b.PortSpecs) || + len(a.ExposedPorts) != len(b.ExposedPorts) || len(a.Entrypoint) != len(b.Entrypoint) || len(a.Volumes) != len(b.Volumes) { return false @@ -54,6 +55,11 @@ func CompareConfig(a, b *Config) bool { return false } } + for k := range a.ExposedPorts { + if _, exists := b.ExposedPorts[k]; !exists { + return false + } + } for i := 0; i < len(a.Entrypoint); i++ { if a.Entrypoint[i] != b.Entrypoint[i] { return false @@ -97,8 +103,10 @@ func MergeConfig(userConf, imageConf *Config) { userConf.ExposedPorts[port] = struct{}{} } } + userConf.PortSpecs = nil } if imageConf.PortSpecs != nil && len(imageConf.PortSpecs) > 0 { + utils.Debugf("Migrating image port specs to containter: %s", strings.Join(imageConf.PortSpecs, ", ")) if userConf.ExposedPorts == nil { userConf.ExposedPorts = make(map[Port]struct{}) } diff --git a/utils_test.go b/utils_test.go index efce0d572..a3a9e5c6a 100644 --- a/utils_test.go +++ b/utils_test.go @@ -280,3 +280,129 @@ func TestParseLxcConfOpt(t *testing.T) { } } } + +func TestParseNetworkOptsPrivateOnly(t *testing.T) { + ports, bindings, err := parsePortSpecs([]string{"192.168.1.100::80"}) + if err != nil { + t.Fatal(err) + } + if len(ports) != 1 { + t.Logf("Expected 1 got %d", len(ports)) + t.FailNow() + } + if len(bindings) != 1 { + t.Logf("Expected 1 got %d", len(bindings)) + t.FailNow() + } + for k := range ports { + if k.Proto() != "tcp" { + t.Logf("Expected tcp got %s", k.Proto()) + t.Fail() + } + if k.Port() != "80" { + t.Logf("Expected 80 got %s", k.Port()) + t.Fail() + } + b, exists := bindings[k] + if !exists { + t.Log("Binding does not exist") + t.FailNow() + } + if len(b) != 1 { + t.Logf("Expected 1 got %d", len(b)) + t.FailNow() + } + s := b[0] + if s.HostPort != "" { + t.Logf("Expected \"\" got %s", s.HostPort) + t.Fail() + } + if s.HostIp != "192.168.1.100" { + t.Fail() + } + } +} + +func TestParseNetworkOptsPublic(t *testing.T) { + ports, bindings, err := parsePortSpecs([]string{"192.168.1.100:8080:80"}) + if err != nil { + t.Fatal(err) + } + if len(ports) != 1 { + t.Logf("Expected 1 got %d", len(ports)) + t.FailNow() + } + if len(bindings) != 1 { + t.Logf("Expected 1 got %d", len(bindings)) + t.FailNow() + } + for k := range ports { + if k.Proto() != "tcp" { + t.Logf("Expected tcp got %s", k.Proto()) + t.Fail() + } + if k.Port() != "80" { + t.Logf("Expected 80 got %s", k.Port()) + t.Fail() + } + b, exists := bindings[k] + if !exists { + t.Log("Binding does not exist") + t.FailNow() + } + if len(b) != 1 { + t.Logf("Expected 1 got %d", len(b)) + t.FailNow() + } + s := b[0] + if s.HostPort != "8080" { + t.Logf("Expected 8080 got %s", s.HostPort) + t.Fail() + } + if s.HostIp != "192.168.1.100" { + t.Fail() + } + } +} + +func TestParseNetworkOptsUdp(t *testing.T) { + ports, bindings, err := parsePortSpecs([]string{"192.168.1.100::6000/udp"}) + if err != nil { + t.Fatal(err) + } + if len(ports) != 1 { + t.Logf("Expected 1 got %d", len(ports)) + t.FailNow() + } + if len(bindings) != 1 { + t.Logf("Expected 1 got %d", len(bindings)) + t.FailNow() + } + for k := range ports { + if k.Proto() != "udp" { + t.Logf("Expected udp got %s", k.Proto()) + t.Fail() + } + if k.Port() != "6000" { + t.Logf("Expected 6000 got %s", k.Port()) + t.Fail() + } + b, exists := bindings[k] + if !exists { + t.Log("Binding does not exist") + t.FailNow() + } + if len(b) != 1 { + t.Logf("Expected 1 got %d", len(b)) + t.FailNow() + } + s := b[0] + if s.HostPort != "" { + t.Logf("Expected \"\" got %s", s.HostPort) + t.Fail() + } + if s.HostIp != "192.168.1.100" { + t.Fail() + } + } +}