summaryrefslogtreecommitdiff
path: root/libnetwork/service_linux.go
Commit message (Collapse)AuthorAgeFilesLines
* libnetwork: return concrete-typed *EndpointCory Snider2023-01-131-5/+5
| | | | | | | | libnetwork.Endpoint is an interface with a single implementation. https://github.com/golang/go/wiki/CodeReviewComments#interfaces Signed-off-by: Cory Snider <csnider@mirantis.com>
* libnetwork: return concrete-typed *SandboxCory Snider2023-01-131-5/+5
| | | | | | | | | | Basically every exported method which takes a libnetwork.Sandbox argument asserts that the value's concrete type is *sandbox. Passing any other implementation of the interface is a runtime error! This interface is a footgun, and clearly not necessary. Export and use the concrete type instead. Signed-off-by: Cory Snider <csnider@mirantis.com>
* libnetwork: addRedirectRules without reexecCory Snider2023-01-111-136/+34
| | | | Signed-off-by: Cory Snider <csnider@mirantis.com>
* libnetwork: fwmarker without reexecCory Snider2023-01-111-98/+34
| | | | Signed-off-by: Cory Snider <csnider@mirantis.com>
* libnetwork: use strconv instead of fmt.Sprintf()Sebastiaan van Stijn2022-10-081-1/+1
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Ensure performance tuning is always appliedRyan Barry2022-05-311-0/+4
| | | | | | | | | | | | | | | Previously, with the patch from #43146, it was possible for a network configured with a single ingress or load balancer on a distribution which does not have the `ip_vs` kernel module loaded by default to try to apply sysctls which did not exist yet, and subsequently dynamically load the module as part of ipvs/netlink.go. This module is vendored, and not a great place to try to tie back into core libnetwork functionality, so also ensure that the sysctls (which are idempotent) are called after ingress/lb creation once `ipvs` has been initialized. Signed-off-by: Ryan Barry <rbarry@mirantis.com>
* libnetwork: don't use strings.Fields() to improve performanceSebastiaan van Stijn2022-04-201-48/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While looking at this code, I noticed that we were wasting quite some resources by first constructing a string, only to split it again (with `strings.Fields()`) into a string slice. Some conversions were also happening multiple times (int to string, IP-address to string, etc.) Setting up networking is known to be costing a considerable amount of time when starting containers, and while this may only be a small part of that, it doesn't hurt to save some resources (and readability of the code isn't significantly impacted). For example, benchmarking the `redirector()` code before/after: BenchmarkParseOld-4 137646 8398 ns/op 4192 B/op 75 allocs/op BenchmarkParseNew-4 629395 1762 ns/op 2362 B/op 24 allocs/op Average over 10 runs: benchstat old.txt new.txt name old time/op new time/op delta Parse-4 8.43µs ± 2% 1.79µs ± 3% -78.76% (p=0.000 n=9+8) name old alloc/op new alloc/op delta Parse-4 4.19kB ± 0% 2.36kB ± 0% -43.65% (p=0.000 n=10+10) name old allocs/op new allocs/op delta Parse-4 75.0 ± 0% 24.0 ± 0% -68.00% (p=0.000 n=10+10) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* refactor: move from io/ioutil to io and os packageEng Zer Jun2021-08-271-5/+4
| | | | | | | | The io/ioutil package has been deprecated in Go 1.16. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
* Fix gosec complaints in libnetworkBrian Goff2021-06-251-2/+2
| | | | | | | | | These were purposefully ignored before but this goes ahead and "fixes" most of them. Note that none of the things gosec flagged are problematic, just quieting the linter here. Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Fixup libnetwork lint errorsBrian Goff2021-06-011-5/+4
| | | | Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Fix libnetwork importsBrian Goff2021-06-011-2/+2
| | | | | | | | | After moving libnetwork to this repo, we need to update all the import paths for libnetwork to point to docker/docker/libnetwork instead of docker/libnetwork. This change implements that. Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Merge pull request #2585 from scottp-dpaw/lbendpoint_fixSebastiaan van Stijn2020-10-311-3/+4
|\ | | | | service_linux: Fix null dereference in findLBEndpointSandbox
| * service_linux: Fix null dereference in findLBEndpointSandboxScott Percival2020-09-221-3/+4
| | | | | | | | Signed-off-by: Scott Percival <scottp@lastyard.com>
* | added TODOs for open IPv6 pointBenjamin Böhmke2020-07-231-1/+4
| | | | | | | | Signed-off-by: Benjamin Böhmke <benjamin@boehmke.net>
* | Implement NAT IPv6 to fix the issue https://github.com/moby/moby/issues/25407Billy Ridgway2020-07-191-32/+38
|/ | | | | Signed-off-by: Billy Ridgway <wrridgwa@us.ibm.com> Signed-off-by: Benjamin Böhmke <benjamin@boehmke.net>
* Use vendored ipvs packageBrian Goff2020-03-111-1/+1
| | | | | | | | | | | | | | | The ipvs package was moved to a separate repo. The ipvs package is a fairly generic set of helpers for managing IPVS. The ipvs package is used by docker swarm and kubernetes. Because we want to merge libnetwork back into the moby/moby codebase while also not creating more dependencies for other projects on moby/moby itself, it was decided that the best path for ipvs is to live on it's own since there are no other ties to libnetwork. Ref: https://github.com/moby/libnetwork/issues/2522 Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Make DSR an overlay-specific driver "option"Chris Telfer2018-10-111-13/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | Allow DSR to be a configurable option through a generic option to the overlay driver. On the one hand this approach makes sense insofar as only overlay networks can currently perform load balancing. On the other hand, this approach has several issues. First, should we create another type of swarm scope network, this will prevent it working. Second, the service core code is separate from the driver code and the driver code can't influence the core data structures. So the driver code can't set this option itself. Therefore, implementing in this way requires some hack code to test for this option in controller.NewNetwork. A more correct approach would be to make this a generic option for any network. Then the driver could ignore, reject or be unaware of the option depending on the chosen model. This would require changes to: * libnetwork - naturally * the docker API - to carry the option * swarmkit - to propagate the option * the docker CLI - to support the option * moby - to translate the API option into a libnetwork option Given the urgency of requests to address this issue, this approach will be saved for a future iteration. Signed-off-by: Chris Telfer <ctelfer@docker.com>
* Set east-west load balancing to use direct routingChris Telfer2018-10-111-6/+18
| | | | | | | | | Modify the loadbalancing for east-west traffic to use direct routing rather than NAT and update tasks to use direct service return under linux. This avoids hiding the source address of the sender and improves the performance in single-client/single-server tests. Signed-off-by: Chris Telfer <ctelfer@docker.com>
* Rolling back the port configs if failed to programIngress()fanjiyun2018-09-111-17/+39
| | | | Signed-off-by: fanjiyun <fan.jiyun@zte.com.cn>
* Spelling fixesJosh Soref2018-07-121-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * addresses * assigned * at least * attachments * auxiliary * available * cleanup * communicate * communications * configuration * connection * connectivity * destination * encountered * endpoint * example * existing * expansion * expected * external * forwarded * gateway * implementations * implemented * initialize * internally * loses * message * network * occurred * operational * origin * overlapping * reaper * redirector * release * representation * resolver * retrieve * returns * sanbdox * sequence * succesful * synchronizing * update * validates Signed-off-by: Josh Soref <jsoref@gmail.com>
* Use fmt precision to limit string lengthChris Telfer2018-07-051-11/+11
| | | | | | | | | | | | | | | | | | | | | The previous code used string slices to limit the length of certain fields like endpoint or sandbox IDs. This assumes that these strings are at least as long as the slice length. Unfortunately, some sandbox IDs can be smaller than 7 characters. This fix addresses this issue by systematically converting format string calls that were taking fixed-slice arguments to use a precision specifier in the string format itself. From the golang fmt package documentation: For strings, byte slices and byte arrays, however, precision limits the length of the input to be formatted (not the size of the output), truncating if necessary. Normally it is measured in runes, but for these types when formatted with the %x or %X format it is measured in bytes. This nicely fits the desired behavior: it will limit the number of runes considered for string interpolation to the precision value. Signed-off-by: Chris Telfer <ctelfer@docker.com>
* Adjust warnings for transient LB endpoint condsChris Telfer2018-06-281-8/+2
| | | | | | | Add debug and error logs to notify when a load balancing sandbox is not found. This can occur in normal operation during removal. Signed-off-by: Chris Telfer <ctelfer@docker.com>
* Add endpoint load-balancing modeChris Telfer2018-06-281-137/+109
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the heart of the scalability change for services in libnetwork. The present routing mesh adds load-balancing rules for a network to every container connected to the network. This newer approach creates a load-balancing endpoint per network per node. For every service on a network, libnetwork assigns the VIP of the service to the endpoint's interface as an alias. This endpoint must have a unique IP address in order to route return traffic to it. Traffic destined for a service's VIP arrives at the load-balancing endpoint on the VIP and from there, Linux load balances it among backend destinations while SNATing said traffic to the endpoint's unique IP address. The net result of this scheme is that each node in a swarm need only have one set of load balancing state per service instead of one per container on the node. This scheme is very similar to how services currently operate on Windows nodes in libnetwork. It (as with Windows nodes) costs the use of extra IP addresses in a network (one per node) and an extra network hop in the stack, although, always in the stack local to the container. In order to prevent existing deployments from suddenly failing if they failed to allocate sufficient address space to include per-node load-balancing endpoint IP addresses, this patch preserves the existing functionality and activates the new functionality on a per-network basis depending on whether the network has a load-balancing endpoint. Eventually, moby should always set this option when creating new networks and should only omit it for networks created as part of a swarm that are not marked to use endpoint load balancing. This patch also normalizes the code to treat "load" and "balancer" as two separate words from the perspectives of variable/function naming. This means that the 'b' in "balancer" must be capitalized. Signed-off-by: Chris Telfer <ctelfer@docker.com>
* Refactor [add|rm]LBBackend() to use lb structChris Telfer2018-06-281-4/+10
| | | | | | | This was passing extra information and adding confusion about the purpose of the load balancing structure. Signed-off-by: Chris Telfer <ctelfer@docker.com>
* Possible race on ingress programmingFlavio Crisciani2018-06-071-5/+4
| | | | | | | | | | | Make sure that iptables operations on ingress are serialized. Before 2 racing routines trying to create the ingress chain were allowed and one was failing reporting the chain as already existing. The lock guarantees that this condition does not happen anymore Signed-off-by: Flavio Crisciani <flavio.crisciani@docker.com>
* Gracefully remove LB endpoints from servicesChris Telfer2018-03-161-7/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch attempts to allow endpoints to complete servicing connections while being removed from a service. The change adds a flag to the endpoint.deleteServiceInfoFromCluster() method to indicate whether this removal should fully remove connectivity through the load balancer to the endpoint or should just disable directing further connections to the endpoint. If the flag is 'false', then the load balancer assigns a weight of 0 to the endpoint but does not remove it as a linux load balancing destination. It does remove the endpoint as a docker load balancing endpoint but tracks it in a special map of "disabled-but-not- destroyed" load balancing endpoints. This allows traffic to continue flowing, at least under Linux. If the flag is 'true', then the code removes the endpoint entirely as a load balancing destination. The sandbox.DisableService() method invokes deleteServiceInfoFromCluster() with the flag sent to 'false', while the endpoint.sbLeave() method invokes it with the flag set to 'true' to complete the removal on endpoint finalization. Renaming the endpoint invokes deleteServiceInfoFromCluster() with the flag set to 'true' because renaming attempts to completely remove and then re-add each endpoint service entry. The controller.rmServiceBinding() method, which carries out the operation, similarly gets a new flag for whether to fully remove the endpoint. If the flag is false, it does the job of moving the endpoint from the load balancing set to the 'disabled' set. It then removes or de-weights the entry in the OS load balancing table via network.rmLBBackend(). It removes the service entirely via said method ONLY IF there are no more live or disabled load balancing endpoints. Similarly network.addLBBackend() requires slight tweaking to properly manage the disabled set. Finally, this change requires propagating the status of disabled service endpoints via the networkDB. Accordingly, the patch includes both code to generate and handle service update messages. It also augments the service structure with a ServiceDisabled boolean to convey whether an endpoint should ultimately be removed or just disabled. This, naturally, required a rebuild of the protocol buffer code as well. Signed-off-by: Chris Telfer <ctelfer@docker.com>
* Support SCTP port mappingWataru Ishida2018-02-131-0/+6
| | | | | Signed-off-by: Wataru Ishida <ishida.wataru@lab.ntt.co.jp> Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
* Enabling ILB/ELB on windows using per-node, per-network LB endpoint.Pradip Dhara2017-08-291-4/+4
| | | | Signed-off-by: Pradip Dhara <pradipd@microsoft.com>
* Update logrus to v1.0.1Derek McGowan2017-08-071-1/+1
| | | | | | | Fix case sensitivity issue Update docker and runc vendors Signed-off-by: Derek McGowan <derek@mcgstyle.net>
* iptables: jump to DOCKER-USER firstJacob Wen2017-07-201-1/+4
| | | | | | Fixes #1827 Signed-off-by: Jacob Wen <jian.w.wen@oracle.com>
* Service discovery race on serviceBindings delete. Bug on IP reuse (#1808)Flavio Crisciani2017-06-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Correct SetMatrix documentation The SetMatrix is a generic data structure, so the description should not be tight to any specific use Signed-off-by: Flavio Crisciani <flavio.crisciani@docker.com> * Service Discovery reuse name and serviceBindings deletion - Added logic to handle name reuse from different services - Moved the deletion from the serviceBindings map at the end of the rmServiceBindings body to avoid race with new services Signed-off-by: Flavio Crisciani <flavio.crisciani@docker.com> * Avoid race on network cleanup Use the locker to avoid the race between the network deletion and new endpoints being created Signed-off-by: Flavio Crisciani <flavio.crisciani@docker.com> * CleanupServiceBindings to clean the SD records Allow the cleanupServicebindings to take care of the service discovery cleanup. Also avoid to trigger the cleanup for each endpoint from an SD point of view LB and SD will be separated in the future Signed-off-by: Flavio Crisciani <flavio.crisciani@docker.com> * Addressed comments Signed-off-by: Flavio Crisciani <flavio.crisciani@docker.com> * NetworkDB deleteEntry has to happen If there is an error locally guarantee that the delete entry on network DB is still honored Signed-off-by: Flavio Crisciani <flavio.crisciani@docker.com>
* Fixed code issuesFlavio Crisciani2017-06-121-1/+1
| | | | | | Fixed issues highlighted by the new checks Signed-off-by: Flavio Crisciani <flavio.crisciani@docker.com>
* Service discovery logic reworkFlavio Crisciani2017-06-111-2/+7
| | | | | | | | | | | changed the ipMap to SetMatrix to allow transient states Compacted the addSvc and deleteSvc into a one single method Updated the datastructure for backends to allow storing all the information needed to cleanup properly during the cleanupServiceBindings Removed the enable/disable Service logic that was racing with sbLeave/sbJoin logic Add some debug logs to track further race conditions Signed-off-by: Flavio Crisciani <flavio.crisciani@docker.com>
* Fix service logsAlessandro Boch2017-02-011-12/+12
| | | | | | | | - do not error on duplicate service removal - give some context to service logs, this would help debugging related issues Signed-off-by: Alessandro Boch <aboch@docker.com>
* Make virtual service programming more robustAlessandro Boch2017-02-011-10/+6
| | | | | | | | | - Do not relay on software flags to decide when to create the virtual service. Instead query the kernel for presence. So that it cannot happen that a real server creation fails because the virtual server is missing. Signed-off-by: Alessandro Boch <aboch@docker.com>
* Gracefully handle redundant ipvs service create failuresAlessandro Boch2017-01-311-1/+1
| | | | Signed-off-by: Alessandro Boch <aboch@docker.com>
* Fix incorrect error log messageAlessandro Boch2017-01-231-2/+2
| | | | | | - Failed to _add_ firewall mark... should be _delete_ Signed-off-by: Alessandro Boch <aboch@docker.com>
* Add missing locks in agent and service codeAlessandro Boch2016-11-291-1/+1
| | | | Signed-off-by: Alessandro Boch <aboch@docker.com>
* Add a ICMP reply rule for service VIPMadhu Venugopal2016-11-211-0/+3
| | | | | | | | | | Ping on VIP has been behaving inconsistently depending on if a task for a service is local or remote. With this fix, the ICMP echo-request packets to service VIP are replied to by the NAT rule to self Signed-off-by: Madhu Venugopal <madhu@docker.com>
* Revert "Enable ping for service vip address"Madhu Venugopal2016-11-211-26/+2
| | | | | | This reverts commit ddc74ffcedbdf927a6855db611360f9c06658be8. Signed-off-by: Madhu Venugopal <madhu@docker.com>
* Windows overlay driver supportMadhu Venugopal2016-11-031-216/+0
| | | | | | | | | | | | | | | | | 1. Base work was done by msabansal and nwoodmsft from : https://github.com/msabansal/docker/tree/overlay 2. reorganized under drivers/windows/overlay and rebased to libnetwork master 3. Porting overlay common fixes to windows driver * 46f525c * ba8714e * 6368406 4. Windows Service Discovery changes for swarm-mode 5. renaming default windows ipam drivers as "windows" Signed-off-by: Madhu Venugopal <madhu@docker.com> Signed-off-by: msabansal <sabansal@microsoft.com> Signed-off-by: nwoodmsft <Nicholas.Wood@microsoft.com>
* Merge pull request #1501 from sanimej/vipJana Radhakrishnan2016-11-021-2/+26
|\ | | | | Enable ping for service vip address
| * Enable ping for service vip addressSanthosh Manohar2016-10-271-2/+26
| | | | | | | | Signed-off-by: Santhosh Manohar <santhosh@docker.com>
* | Block non exposed port traffic on ingress nw interfacesAlessandro Boch2016-10-271-1/+33
| | | | | | | | Signed-off-by: Alessandro Boch <aboch@docker.com>
* | Avoid controller/service lock AB/BA situationJana Radhakrishnan2016-10-141-1/+7
|/ | | | | | | | Currently there is an instance of controller and service lock being obtained in different order which causes the AB/BA deadlock. Do not ever wrap controller lock around service lock. Signed-off-by: Jana Radhakrishnan <mrjana@docker.com>
* Delay port redirect until packet reaches containerJana Radhakrishnan2016-09-211-34/+95
| | | | | | | | | | | | | With port redirect in the ingress path happening before ipvs in the ingess sandbox, there is a chance of 5-tuple collision in the ipvs connection table for two entirely different services have different PublishedPorts but the same TargetPort. To disambiguate the ipvs connection table, delay the port redirect from PublishedPort to TargetPort until after the loadbalancing has happened in ipvs. To be specific, perform the redirect after the packet enters the real backend container namespace. Signed-off-by: Jana Radhakrishnan <mrjana@docker.com>
* Use complete port configs when plumbing mark rulesJana Radhakrishnan2016-09-211-39/+76
| | | | | | | | | | | | | | | | | Currently, a reference counting scheme is used to reference count all individual port configs that need to be plumbed in the ingress to make sure that in situations where a service with the same set of port configs is getting added or removed doesn't accidentally remove the port config plumbing if the add/remove notifications come out of order. This same reference counting scheme is also used for plumbing the port-based marking rules. But marking rules should not be plumbed based on that because marks are always different for different instantiations of the same service. So fixed the code to plumb port-based mark rules based on the complete set of port configs, while plumbing pure port rules and proxies based on a filter set of port configs based on the reference count. Signed-off-by: Jana Radhakrishnan <mrjana@docker.com>
* Merge pull request #1398 from sanimej/accessAlessandro Boch2016-08-301-5/+67
|\ | | | | Allow reachability across services on the same host
| * Allow reachability across services on different networks in the same hostSanthosh Manohar2016-08-291-5/+67
| | | | | | | | | | | | | | This also allows pubslied services to be accessible from containers on bridge networks on the host Signed-off-by: Santhosh Manohar <santhosh@docker.com>
* | Do not try LB populate on interface-less endpointJana Radhakrishnan2016-08-301-0/+5
| | | | | | | | Signed-off-by: Jana Radhakrishnan <mrjana@docker.com>
View Lorry Controller Status