github.com/rawahars/moby@v24.0.4+incompatible/libnetwork/drivers/bridge/port_mapping.go (about) 1 //go:build linux 2 // +build linux 3 4 package bridge 5 6 import ( 7 "bytes" 8 "errors" 9 "fmt" 10 "net" 11 "sync" 12 13 "github.com/docker/docker/libnetwork/types" 14 "github.com/ishidawataru/sctp" 15 "github.com/sirupsen/logrus" 16 ) 17 18 func (n *bridgeNetwork) allocatePorts(ep *bridgeEndpoint, reqDefBindIP net.IP, ulPxyEnabled bool) ([]types.PortBinding, error) { 19 if ep.extConnConfig == nil || ep.extConnConfig.PortBindings == nil { 20 return nil, nil 21 } 22 23 defHostIP := net.IPv4zero // 0.0.0.0 24 if reqDefBindIP != nil { 25 defHostIP = reqDefBindIP 26 } 27 28 var containerIPv6 net.IP 29 if ep.addrv6 != nil { 30 containerIPv6 = ep.addrv6.IP 31 } 32 33 pb, err := n.allocatePortsInternal(ep.extConnConfig.PortBindings, ep.addr.IP, containerIPv6, defHostIP, ulPxyEnabled) 34 if err != nil { 35 return nil, err 36 } 37 return pb, nil 38 } 39 40 func (n *bridgeNetwork) allocatePortsInternal(bindings []types.PortBinding, containerIPv4, containerIPv6, defHostIP net.IP, ulPxyEnabled bool) ([]types.PortBinding, error) { 41 bs := make([]types.PortBinding, 0, len(bindings)) 42 for _, c := range bindings { 43 bIPv4 := c.GetCopy() 44 bIPv6 := c.GetCopy() 45 // Allocate IPv4 Port mappings 46 if ok := n.validatePortBindingIPv4(&bIPv4, containerIPv4, defHostIP); ok { 47 if err := n.allocatePort(&bIPv4, ulPxyEnabled); err != nil { 48 // On allocation failure, release previously allocated ports. On cleanup error, just log a warning message 49 if cuErr := n.releasePortsInternal(bs); cuErr != nil { 50 logrus.Warnf("allocation failure for %v, failed to clear previously allocated ipv4 port bindings: %v", bIPv4, cuErr) 51 } 52 return nil, err 53 } 54 bs = append(bs, bIPv4) 55 } 56 57 // skip adding implicit v6 addr, when the kernel was booted with `ipv6.disable=1` 58 // https://github.com/moby/moby/issues/42288 59 isV6Binding := c.HostIP != nil && c.HostIP.To4() == nil 60 if !isV6Binding && !IsV6Listenable() { 61 continue 62 } 63 64 // Allocate IPv6 Port mappings 65 // If the container has no IPv6 address, allow proxying host IPv6 traffic to it 66 // by setting up the binding with the IPv4 interface if the userland proxy is enabled 67 // This change was added to keep backward compatibility 68 containerIP := containerIPv6 69 if ulPxyEnabled && (containerIPv6 == nil) { 70 containerIP = containerIPv4 71 } 72 if ok := n.validatePortBindingIPv6(&bIPv6, containerIP, defHostIP); ok { 73 if err := n.allocatePort(&bIPv6, ulPxyEnabled); err != nil { 74 // On allocation failure, release previously allocated ports. On cleanup error, just log a warning message 75 if cuErr := n.releasePortsInternal(bs); cuErr != nil { 76 logrus.Warnf("allocation failure for %v, failed to clear previously allocated ipv6 port bindings: %v", bIPv6, cuErr) 77 } 78 return nil, err 79 } 80 bs = append(bs, bIPv6) 81 } 82 } 83 return bs, nil 84 } 85 86 // validatePortBindingIPv4 validates the port binding, populates the missing Host IP field and returns true 87 // if this is a valid IPv4 binding, else returns false 88 func (n *bridgeNetwork) validatePortBindingIPv4(bnd *types.PortBinding, containerIPv4, defHostIP net.IP) bool { 89 // Return early if there is a valid Host IP, but its not a IPv4 address 90 if len(bnd.HostIP) > 0 && bnd.HostIP.To4() == nil { 91 return false 92 } 93 // Adjust the host address in the operational binding 94 if len(bnd.HostIP) == 0 { 95 // Return early if the default binding address is an IPv6 address 96 if defHostIP.To4() == nil { 97 return false 98 } 99 bnd.HostIP = defHostIP 100 } 101 bnd.IP = containerIPv4 102 return true 103 } 104 105 // validatePortBindingIPv6 validates the port binding, populates the missing Host IP field and returns true 106 // if this is a valid IPv6 binding, else returns false 107 func (n *bridgeNetwork) validatePortBindingIPv6(bnd *types.PortBinding, containerIP, defHostIP net.IP) bool { 108 // Return early if there is no container endpoint 109 if containerIP == nil { 110 return false 111 } 112 // Return early if there is a valid Host IP, which is a IPv4 address 113 if len(bnd.HostIP) > 0 && bnd.HostIP.To4() != nil { 114 return false 115 } 116 117 // Setup a binding to "::" if Host IP is empty and the default binding IP is 0.0.0.0 118 if len(bnd.HostIP) == 0 { 119 if defHostIP.Equal(net.IPv4zero) { 120 bnd.HostIP = net.IPv6zero 121 // If the default binding IP is an IPv6 address, use it 122 } else if defHostIP.To4() == nil { 123 bnd.HostIP = defHostIP 124 // Return false if default binding ip is an IPv4 address 125 } else { 126 return false 127 } 128 } 129 bnd.IP = containerIP 130 return true 131 } 132 133 func (n *bridgeNetwork) allocatePort(bnd *types.PortBinding, ulPxyEnabled bool) error { 134 var ( 135 host net.Addr 136 err error 137 ) 138 139 // Adjust HostPortEnd if this is not a range. 140 if bnd.HostPortEnd == 0 { 141 bnd.HostPortEnd = bnd.HostPort 142 } 143 144 // Construct the container side transport address 145 container, err := bnd.ContainerAddr() 146 if err != nil { 147 return err 148 } 149 150 portmapper := n.portMapper 151 152 if bnd.HostIP.To4() == nil { 153 portmapper = n.portMapperV6 154 } 155 156 // Try up to maxAllocatePortAttempts times to get a port that's not already allocated. 157 for i := 0; i < maxAllocatePortAttempts; i++ { 158 if host, err = portmapper.MapRange(container, bnd.HostIP, int(bnd.HostPort), int(bnd.HostPortEnd), ulPxyEnabled); err == nil { 159 break 160 } 161 // There is no point in immediately retrying to map an explicitly chosen port. 162 if bnd.HostPort != 0 { 163 logrus.Warnf("Failed to allocate and map port %d-%d: %s", bnd.HostPort, bnd.HostPortEnd, err) 164 break 165 } 166 logrus.Warnf("Failed to allocate and map port: %s, retry: %d", err, i+1) 167 } 168 if err != nil { 169 return err 170 } 171 172 // Save the host port (regardless it was or not specified in the binding) 173 switch netAddr := host.(type) { 174 case *net.TCPAddr: 175 bnd.HostPort = uint16(host.(*net.TCPAddr).Port) 176 return nil 177 case *net.UDPAddr: 178 bnd.HostPort = uint16(host.(*net.UDPAddr).Port) 179 return nil 180 case *sctp.SCTPAddr: 181 bnd.HostPort = uint16(host.(*sctp.SCTPAddr).Port) 182 return nil 183 default: 184 // For completeness 185 return ErrUnsupportedAddressType(fmt.Sprintf("%T", netAddr)) 186 } 187 } 188 189 func (n *bridgeNetwork) releasePorts(ep *bridgeEndpoint) error { 190 return n.releasePortsInternal(ep.portMapping) 191 } 192 193 func (n *bridgeNetwork) releasePortsInternal(bindings []types.PortBinding) error { 194 var errorBuf bytes.Buffer 195 196 // Attempt to release all port bindings, do not stop on failure 197 for _, m := range bindings { 198 if err := n.releasePort(m); err != nil { 199 errorBuf.WriteString(fmt.Sprintf("\ncould not release %v because of %v", m, err)) 200 } 201 } 202 203 if errorBuf.Len() != 0 { 204 return errors.New(errorBuf.String()) 205 } 206 return nil 207 } 208 209 func (n *bridgeNetwork) releasePort(bnd types.PortBinding) error { 210 // Construct the host side transport address 211 host, err := bnd.HostAddr() 212 if err != nil { 213 return err 214 } 215 216 portmapper := n.portMapper 217 218 if bnd.HostIP.To4() == nil { 219 portmapper = n.portMapperV6 220 } 221 222 return portmapper.Unmap(host) 223 } 224 225 var ( 226 v6ListenableCached bool 227 v6ListenableOnce sync.Once 228 ) 229 230 // IsV6Listenable returns true when `[::1]:0` is listenable. 231 // IsV6Listenable returns false mostly when the kernel was booted with `ipv6.disable=1` option. 232 func IsV6Listenable() bool { 233 v6ListenableOnce.Do(func() { 234 ln, err := net.Listen("tcp6", "[::1]:0") 235 if err != nil { 236 // When the kernel was booted with `ipv6.disable=1`, 237 // we get err "listen tcp6 [::1]:0: socket: address family not supported by protocol" 238 // https://github.com/moby/moby/issues/42288 239 logrus.Debugf("port_mapping: v6Listenable=false (%v)", err) 240 } else { 241 v6ListenableCached = true 242 ln.Close() 243 } 244 }) 245 return v6ListenableCached 246 }