Fix IPv6 Port Forwarding for the Bridge Driver #2604

arkodg · 2020-12-14T00:03:51Z

Allocate either a IPv4 and/or IPv6 Port Binding (HostIP, HostPort, ContainerIP,
ContainerPort) based on the input and system parameters
Update the userland proxy as well as dummy proxy (inside port mapper) to
specifically listen to either the IPv4 or IPv6 network

Signed-off-by: Arko Dasgupta arko.dasgupta@docker.com

arkodg · 2020-12-14T00:04:33Z

cc @bboehmke

bboehmke

The implementation looks far better and cleaner as my try.

bboehmke · 2020-12-14T08:06:11Z

drivers/bridge/port_mapping.go

-	pb, err := n.allocatePortsInternal(ep.extConnConfig.PortBindings, ep.addr.IP, defHostIP, ulPxyEnabled)
-	if err != nil {
-		return nil, err
+	var containerIPv6 net.IP = nil


Is it necessary to set containerIPv6 explicit to nil?

var containerIPv6 net.IP should already be nil by default

ack, thanks

bboehmke · 2020-12-14T08:09:48Z

drivers/bridge/port_mapping.go

 	}

-	// IPv6 port binding excluding user land proxy
-	if n.driver.config.EnableIP6Tables && ep.addrv6 != nil {


The EnableIP6Tables check was removed completely.

Is there anything that prevents a creation of ip6tables rules in AppendForwardingTableEntry of the portmapper if EnableIP6Tables is not set?

If

libnetwork/drivers/bridge/setup_ip_tables.go

Line 184 in 5c6a95b

n.portMapperV6.SetIptablesChain(natChain, n.getNetworkBridgeName())

is skipped, pm.chain will be nil and will skip the iptables programming

libnetwork/portmapper/mapper_linux.go

Line 42 in 5c6a95b

if pm.chain == nil {

oh I see. That is for sure far cleaner than before.

1. Allocate either a IPv4 and/or IPv6 Port Binding (HostIP, HostPort, ContainerIP, ContainerPort) based on the input and system parameters 2. Update the userland proxy as well as dummy proxy (inside port mapper) to specifically listen on either the IPv4 or IPv6 network Signed-off-by: Arko Dasgupta <arko.dasgupta@docker.com>

bboehmke · 2020-12-15T07:58:21Z

LGTM

arkodg · 2020-12-15T15:18:21Z

thanks @bboehmke can you please formally approve the PR, so I can merge it and vendor it into moby/moby

Brings in moby/libnetwork#2604 Signed-off-by: Arko Dasgupta <arko.dasgupta@docker.com>

Brings in moby/libnetwork#2604 Signed-off-by: Arko Dasgupta <arko.dasgupta@docker.com> Upstream-commit: 78eafdd947db80832c6d0985c81cb56944a23739 Component: engine

thaJeztah · 2020-12-24T09:36:37Z

cmd/proxy/sctp_proxy.go

-	listener, err := sctp.ListenSCTP("sctp", frontendAddr)
+	// detect version of hostIP to bind only to correct version
+	ipVersion := ipv4
+	if frontendAddr.IPAddrs[0].IP.To4() == nil {


@arkodg curious: would this be an issue? https://twitter.com/bradfitz/status/1341979944151207937?s=20

golang/go#37921

we currently don't support IPv4-mapped IPv6 addresses today, we build out a separate ipv4 and ipv6 stack

vin01 · 2021-01-05T12:14:02Z

1. Allocate either a IPv4 and/or IPv6 Port Binding (HostIP, HostPort, ContainerIP,
   ContainerPort) based on the input and system parameters

2. Update the userland proxy as well as dummy proxy (inside port mapper) to
   specifically listen to either the IPv4 or IPv6 network

Signed-off-by: Arko Dasgupta arko.dasgupta@docker.com

This looks like a breaking change since until now docker-proxy has been binding to both v4 and v6 addresses if both are available on the system which I believe made sense.

fbezdeka · 2021-01-05T15:56:30Z

According to the Changelog [1] this is the only network related change in 20.10.2.
Now my IPv6 port forwarding is completely broken.
Downgrading to 20.10.1 fixed it.

There are no docker-proxy processes started. 20.10.1 starts a process for each port-forwarding.

Example:

sudo docker run \
    --hostname gitlab \
    --env 'GITLAB_PORT=443' \
    --env 'GITLAB_HTTPS=true' \
    --publish [<ip>]:2222:22 \
    --publish [<ip>]:8080:80 \
    --publish [<ip>]:8443:443 \
    --name gitlab \
    --restart always \
    --volume /srv/gitlab/config:/etc/gitlab:Z \
    --volume /srv/gitlab/logs:/var/log/gitlab:Z \
    --volume /srv/gitlab/data:/var/opt/gitlab:Z \
    gitlab/gitlab-ce:latest

[1] https://docs.docker.com/engine/release-notes/

pokotiX · 2021-01-05T17:09:16Z

According to the Changelog [1] this is the only network related change in 20.10.2.
Now my IPv6 port forwarding is completely broken.
Downgrading to 20.10.1 fixed it.

There are no docker-proxy processes started. 20.10.1 starts a process for each port-forwarding.

Example:
sudo docker run \
    --hostname gitlab \
    --env 'GITLAB_PORT=443' \
    --env 'GITLAB_HTTPS=true' \
    --publish [<ip>]:2222:22 \
    --publish [<ip>]:8080:80 \
    --publish [<ip>]:8443:443 \
    --name gitlab \
    --restart always \
    --volume /srv/gitlab/config:/etc/gitlab:Z \
    --volume /srv/gitlab/logs:/var/log/gitlab:Z \
    --volume /srv/gitlab/data:/var/opt/gitlab:Z \
    gitlab/gitlab-ce:latest
[1] https://docs.docker.com/engine/release-notes/

I confirm, I have the same problem

arkodg · 2021-01-05T18:04:47Z

@pokotiV @fbezdeka @vin01 can you please raise a separate issue to discuss this
thanks

terencehonles · 2021-01-05T20:48:43Z

@pokotiV @fbezdeka @vin01 can you please raise a separate issue to discuss this
thanks

@arkodg done in #2607 (I believe the title captures the problem that everyone was seeing (it does mine))

arkodg requested a review from thaJeztah December 14, 2020 00:04

bboehmke reviewed Dec 14, 2020

View reviewed changes

bboehmke mentioned this pull request Dec 14, 2020

Vendor in libnetwork changes moby/moby#41783

Merged

arkodg changed the title ~~Fix Port Forwarding for the Bridge Driver~~ Fix IPv6 Port Forwarding for the Bridge Driver Dec 15, 2020

arkodg force-pushed the fix-port-forwarding branch 2 times, most recently from 75f4191 to f0cba0e Compare December 15, 2020 02:30

arkodg force-pushed the fix-port-forwarding branch from f0cba0e to 28576a4 Compare December 15, 2020 02:46

bboehmke approved these changes Dec 15, 2020

View reviewed changes

arkodg merged commit fa125a3 into moby:master Dec 15, 2020

arkodg deleted the fix-port-forwarding branch December 15, 2020 16:25

bboehmke mentioned this pull request Dec 15, 2020

IP6Tables cleanup #2602

Closed

3 tasks

arkodg mentioned this pull request Dec 15, 2020

Vendor in Libnetwork changes moby/moby#41805

Merged

arkodg pushed a commit to arkodg/moby that referenced this pull request Dec 15, 2020

Vendor in Libnetwork changes

78eafdd

Brings in moby/libnetwork#2604 Signed-off-by: Arko Dasgupta <arko.dasgupta@docker.com>

thaJeztah reviewed Dec 24, 2020

View reviewed changes

terencehonles mentioned this pull request Jan 5, 2021

IPv4 and IPv6 addresses are not bound by default anymore #2607

Closed

thaJeztah mentioned this pull request Jan 20, 2021

vendor: docker/libnetwork b3507428be5b458cb0e2b4086b13531fb0706e46 moby/moby#41908

Merged

5 tasks

ravenpride mentioned this pull request Mar 18, 2021

HTTP/HTTPS not accessible via IPv6 mailcow/mailcow-dockerized#4029

Closed

4 tasks

thaJeztah mentioned this pull request Mar 25, 2021

[20.10 backport] vendor: docker/libnetwork b3507428be5b458cb0e2b4086b13531fb0706e46 moby/moby#42205

Merged

5 tasks

Sep	OCT	Nov
	14
2024	2025	2026

Fix IPv6 Port Forwarding for the Bridge Driver #2604

Fix IPv6 Port Forwarding for the Bridge Driver #2604

Uh oh!

Conversation

arkodg commented Dec 14, 2020

Uh oh!

arkodg commented Dec 14, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bboehmke left a comment

Choose a reason for hiding this comment

Uh oh!

bboehmke Dec 14, 2020

Choose a reason for hiding this comment

Uh oh!

arkodg Dec 15, 2020

Choose a reason for hiding this comment

Uh oh!

bboehmke Dec 14, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arkodg Dec 15, 2020

Choose a reason for hiding this comment

Uh oh!

bboehmke Dec 15, 2020

Choose a reason for hiding this comment

Uh oh!

bboehmke commented Dec 15, 2020

Uh oh!

arkodg commented Dec 15, 2020

Uh oh!

thaJeztah Dec 24, 2020

Choose a reason for hiding this comment

Uh oh!

arkodg Jan 5, 2021

Choose a reason for hiding this comment

Uh oh!

vin01 commented Jan 5, 2021

Uh oh!

fbezdeka commented Jan 5, 2021

Uh oh!

pokotiX commented Jan 5, 2021

Uh oh!

arkodg commented Jan 5, 2021

Uh oh!

terencehonles commented Jan 5, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

arkodg commented Dec 14, 2020 •

edited

Loading

bboehmke Dec 14, 2020 •

edited

Loading