Skip to content

Fix container access issue when it moves across hosts #1783

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sanimej wants to merge 1 commit into from
Closed

Fix container access issue when it moves across hosts #1783

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion drivers/overlay/ov_network.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -439,7 +439,7 @@ func (n *network) restoreSubnetSandbox(s *subnet, brName, vxlanName string) erro

Ifaces = make(map[string][]osl.IfaceOption)
vxlanIfaceOption := make([]osl.IfaceOption, 1)
vxlanIfaceOption = append(vxlanIfaceOption, sbox.InterfaceOptions().Master(brName))
vxlanIfaceOption = append(vxlanIfaceOption, sbox.InterfaceOptions().Master(brName), sbox.InterfaceOptions().DisableLearning())
Ifaces[fmt.Sprintf("%s+%s", vxlanName, "vxlan")] = vxlanIfaceOption
err = sbox.Restore(Ifaces, nil, nil, nil)
if err != nil {
Expand Down
44 changes: 32 additions & 12 deletions osl/interface_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,18 +19,19 @@ import (
type IfaceOption func(i *nwIface)

type nwIface struct {
srcName string
dstName string
master string
dstMaster string
mac net.HardwareAddr
address *net.IPNet
addressIPv6 *net.IPNet
ipAliases []*net.IPNet
llAddrs []*net.IPNet
routes []*net.IPNet
bridge bool
ns *networkNamespace
srcName string
dstName string
master string
dstMaster string
mac net.HardwareAddr
address *net.IPNet
addressIPv6 *net.IPNet
ipAliases []*net.IPNet
llAddrs []*net.IPNet
routes []*net.IPNet
bridge bool
ns *networkNamespace
disableLearning bool
sync.Mutex
}

Expand Down Expand Up @@ -130,6 +131,13 @@ func (n *networkNamespace) Interfaces() []Interface {
return ifaces
}

func (i *nwIface) DisableLearning() bool {
i.Lock()
i.Unlock()
Copy link

@aaronlehmann aaronlehmann Jun 2, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was this meant to be deferred? The code doesn't look right as-is.

Copy link
Author

@sanimej sanimej Jun 2, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it should have been defer. Thanks.

As mentioned in the description the flooding to the local ports is better avoided. I have pushed a PR with a different approach to address this issue, #1792. I will close this PR.


return i.disableLearning
}

func (i *nwIface) Remove() error {
i.Lock()
n := i.ns
Expand Down Expand Up @@ -338,6 +346,7 @@ func configureInterface(nlh *netlink.Handle, iface netlink.Link, i *nwIface) err
{setInterfaceMaster, fmt.Sprintf("error setting interface %q master to %q", ifaceName, i.DstMaster())},
{setInterfaceLinkLocalIPs, fmt.Sprintf("error setting interface %q link local IPs to %v", ifaceName, i.LinkLocalAddresses())},
{setInterfaceIPAliases, fmt.Sprintf("error setting interface %q IP Aliases to %v", ifaceName, i.IPAliases())},
{disableLearning, fmt.Sprintf("disabling mac learning failed for interface %q", ifaceName)},
}

for _, config := range ifaceConfigurators {
Expand Down Expand Up @@ -409,6 +418,17 @@ func setInterfaceIPAliases(nlh *netlink.Handle, iface netlink.Link, i *nwIface)
return nil
}

func disableLearning(nlh *netlink.Handle, iface netlink.Link, i *nwIface) error {
if !i.DisableLearning() {
return nil
}
if i.DstMaster() == "" {
return fmt.Errorf("mac learning can be disabled only for slave interfaces")
}

return nlh.LinkSetLearning(iface, false)
}

func setInterfaceName(nlh *netlink.Handle, iface netlink.Link, i *nwIface) error {
return nlh.LinkSetName(iface, i.DstName())
}
Expand Down
6 changes: 6 additions & 0 deletions osl/options_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,3 +77,9 @@ func (n *networkNamespace) Routes(routes []*net.IPNet) IfaceOption {
i.routes = routes
}
}

func (n *networkNamespace) DisableLearning() IfaceOption {
return func(i *nwIface) {
i.disableLearning = true
}
}
4 changes: 4 additions & 0 deletions osl/sandbox.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,10 @@ type IfaceOptionSetter interface {

// Address returns an option setter to set interface routes.
Routes([]*net.IPNet) IfaceOption

// DisableLearning returns an option setter to disable mac learning on a bridge
// interface
DisableLearning() IfaceOption
}

// Info represents all possible information that
Expand Down