From e59d1b45636fe1a81220895cfc8aade337695c47 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Wed, 12 Nov 2025 11:39:24 +0100 Subject: [PATCH] libnetwork/drivers/overlay: DiscoverNew: move logic to setKeys, updateKeys Make the DiscoverNew switch only responsible for asserting the correct data type, and push the conversion logic into the setKeys and updateKeys methods. Signed-off-by: Sebastiaan van Stijn --- .../libnetwork/drivers/overlay/encryption.go | 38 ++++++++++++++--- daemon/libnetwork/drivers/overlay/overlay.go | 42 +++---------------- 2 files changed, 38 insertions(+), 42 deletions(-) diff --git a/daemon/libnetwork/drivers/overlay/encryption.go b/daemon/libnetwork/drivers/overlay/encryption.go index 073850c364..8a436b4d79 100644 --- a/daemon/libnetwork/drivers/overlay/encryption.go +++ b/daemon/libnetwork/drivers/overlay/encryption.go @@ -16,6 +16,7 @@ import ( "syscall" "github.com/containerd/log" + "github.com/moby/moby/v2/daemon/libnetwork/discoverapi" "github.com/moby/moby/v2/daemon/libnetwork/drivers/overlay/overlayutils" "github.com/moby/moby/v2/daemon/libnetwork/iptables" "github.com/moby/moby/v2/daemon/libnetwork/ns" @@ -449,7 +450,14 @@ func buildAeadAlgo(k *key, s int) *netlink.XfrmStateAlgo { } } -func (d *driver) setKeys(keys []*key) error { +func (d *driver) setKeys(ctx context.Context, encrData discoverapi.DriverEncryptionConfig) error { + keys := make([]*key, 0, len(encrData.Keys)) + for i := 0; i < len(encrData.Keys); i++ { + keys = append(keys, &key{ + value: encrData.Keys[i], + tag: uint32(encrData.Tags[i]), + }) + } d.encrMu.Lock() defer d.encrMu.Unlock() @@ -459,7 +467,7 @@ func (d *driver) setKeys(keys []*key) error { d.secMap = encrMap{} d.keys = keys - log.G(context.TODO()).WithFields(log.Fields{ + log.G(ctx).WithFields(log.Fields{ "driver": "overlay", "keys": d.keys, }).Debug("Set initial encryption keys") @@ -468,11 +476,31 @@ func (d *driver) setKeys(keys []*key) error { // updateKeys allows to add a new key and/or change the primary key and/or prune an existing key // The primary key is the key used in transmission and will go in first position in the list. -func (d *driver) updateKeys(newKey, primaryKey, pruneKey *key) error { +func (d *driver) updateKeys(ctx context.Context, encrData discoverapi.DriverEncryptionUpdate) error { + var newKey, primaryKey, pruneKey *key + if encrData.Key != nil { + newKey = &key{ + value: encrData.Key, + tag: uint32(encrData.Tag), + } + } + if encrData.Primary != nil { + primaryKey = &key{ + value: encrData.Primary, + tag: uint32(encrData.PrimaryTag), + } + } + if encrData.Prune != nil { + pruneKey = &key{ + value: encrData.Prune, + tag: uint32(encrData.PruneTag), + } + } + d.encrMu.Lock() defer d.encrMu.Unlock() - log.G(context.TODO()).WithFields(log.Fields{ + log.G(ctx).WithFields(log.Fields{ "driver": "overlay", "current": d.keys, "new": newKey, @@ -532,7 +560,7 @@ func (d *driver) updateKeys(newKey, primaryKey, pruneKey *key) error { d.keys = append(d.keys[:delIdx], d.keys[delIdx+1:]...) } - log.G(context.TODO()).WithFields(log.Fields{ + log.G(ctx).WithFields(log.Fields{ "driver": "overlay", "keys": d.keys, }).Debug("Updated encryption keys") diff --git a/daemon/libnetwork/drivers/overlay/overlay.go b/daemon/libnetwork/drivers/overlay/overlay.go index f1f876cb47..e09bce6764 100644 --- a/daemon/libnetwork/drivers/overlay/overlay.go +++ b/daemon/libnetwork/drivers/overlay/overlay.go @@ -11,7 +11,6 @@ import ( "net/netip" "sync" - "github.com/containerd/log" "github.com/moby/moby/v2/daemon/libnetwork/discoverapi" "github.com/moby/moby/v2/daemon/libnetwork/driverapi" "github.com/moby/moby/v2/daemon/libnetwork/scope" @@ -121,49 +120,18 @@ func (d *driver) DiscoverNew(dType discoverapi.DiscoveryType, data any) error { case discoverapi.EncryptionKeysConfig: encrData, ok := data.(discoverapi.DriverEncryptionConfig) if !ok { - return errors.New("invalid encryption key notification data") - } - keys := make([]*key, 0, len(encrData.Keys)) - for i := 0; i < len(encrData.Keys); i++ { - k := &key{ - value: encrData.Keys[i], - tag: uint32(encrData.Tags[i]), - } - keys = append(keys, k) - } - if err := d.setKeys(keys); err != nil { - log.G(context.TODO()).Warn(err) + return fmt.Errorf("invalid encryption key notification data type: %T", data) } + return d.setKeys(context.TODO(), encrData) case discoverapi.EncryptionKeysUpdate: - var newKey, delKey, priKey *key encrData, ok := data.(discoverapi.DriverEncryptionUpdate) if !ok { - return errors.New("invalid encryption key notification data") - } - if encrData.Key != nil { - newKey = &key{ - value: encrData.Key, - tag: uint32(encrData.Tag), - } - } - if encrData.Primary != nil { - priKey = &key{ - value: encrData.Primary, - tag: uint32(encrData.PrimaryTag), - } - } - if encrData.Prune != nil { - delKey = &key{ - value: encrData.Prune, - tag: uint32(encrData.PruneTag), - } - } - if err := d.updateKeys(newKey, priKey, delKey); err != nil { - return err + return fmt.Errorf("invalid encryption key notification data type: %T", data) } + return d.updateKeys(context.TODO(), encrData) default: + return nil } - return nil } // DiscoverDelete is a notification for a discovery delete event, such as a node leaving a cluster