Since commit 4e246efcd, individual portmappers are responsible for
setting up firewall rules and proxying according to their needs.
This change moves the responsibility back to the bridge driver, removing
unnecessary code duplication across portmappers. For now, only the nat
portmapper takes advantage of this.
This partially reverts commit 4e246efcd.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
When an endpoint in a gateway mode "nat" network is selected
as a container's default gateway, the bridge driver sets up
bindings between host and container ports (NAT, userland proxy
etc).
When gateway mode "routed" was added as an alternative to
the default "nat" mode - port bindings followed the same rules.
But, unlike "nat" mode, there's no host port binding to set
up - there's routing between remote client and the container,
so it doesn't matter what the default gateway is.
So, in "routed" mode, set up the rules to make a container's
published ports accessible when the endpoint is added, and
remove those rules when the endpoint is removed (when the
container is disconnected from the endpoint's network).
Port mappings are only provided by ProgramExternalConnectivity,
they can't be set up during the Join. So, include routed
bindings in the port bindings mode that's stored as part of
endpoint state - and use that to work out whether to add or
remove bindings.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The bridge driver currently determines if hairpin mode is enabled by
checking whether the userland proxy is enabled, and if the binary path
is set to a non-empty string. It's used (amongst other things) by the
driver to decide whether 6-to-4 portmappings are supported, while it
normalizes port bindings.
As the userland proxy is going to be handled by the nat portmapper,
proxy-related params will be removed from the bridge driver, but the
port binding normalization will stay in the bridge driver.
So, introduce a new Hairpin config flag, and reimplement the original
logic in the daemon, when creating the bridge config.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The two unexported fields of portBindingReq (ChildHostIP and DisableNAT)
are temporarily exported. DisableNAT will be replaced in a future commit
by a 'Mapper' field indicating which portmapper should be used (e.g.
'nat' or 'routed').
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This new struct allocates ports from the operating system by creating
sockets and binding them. It's based on the existing bindTCPOrUDP and
bindSCTP functions previously defined in the bridge driver. It tries to
detect conflicts on best effort basis, and doesn't guarantee that the
ports it allocates are not in use by other processes.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
