Skip to content

Commit

Permalink
Merge pull request #9107 from baude/v3backportdnsnameinternal
Browse files Browse the repository at this point in the history 
[3.0] disable dnsname when --internal
  • Loading branch information
@openshift-merge-robot
openshift-merge-robot authored Jan 26, 2021
2 parents dc2f4c6 + 7e88a57 commit 4dbb58d
Show file tree
Hide file tree
Showing 4 changed files with 96 additions and 62 deletions.
3 changes: 2 additions & 1 deletion docs/source/markdown/podman-network-create.1.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,8 @@ Define a gateway for the subnet. If you want to provide a gateway address, you m

#### **--internal**

Restrict external access of this network
Restrict external access of this network. Note when using this option, the dnsname plugin will be
automatically disabled.

#### **--ip-range**

Expand Down
9 changes: 7 additions & 2 deletions libpod/network/create.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ import (
"github.com/containers/podman/v2/pkg/rootless"
"github.com/containers/podman/v2/pkg/util"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
)

// Create the CNI network
Expand Down Expand Up @@ -226,8 +227,12 @@ func createBridge(name string, options entities.NetworkCreateOptions, runtimeCon
// if we find the dnsname plugin or are rootless, we add configuration for it
// the rootless-cni-infra container has the dnsname plugin always installed
if (HasDNSNamePlugin(runtimeConfig.Network.CNIPluginDirs) || rootless.IsRootless()) && !options.DisableDNS {
// Note: in the future we might like to allow for dynamic domain names
plugins = append(plugins, NewDNSNamePlugin(DefaultPodmanDomainName))
if options.Internal {
logrus.Warnf("dnsname and --internal networks are incompatible. dnsname plugin not configured for network %s", name)
} else {
// Note: in the future we might like to allow for dynamic domain names
plugins = append(plugins, NewDNSNamePlugin(DefaultPodmanDomainName))
}
}
ncList["plugins"] = plugins
b, err := json.MarshalIndent(ncList, "", " ")
Expand Down
111 changes: 69 additions & 42 deletions test/e2e/network_create_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ import (
cniversion "github.com/containernetworking/cni/pkg/version"
"github.com/containers/podman/v2/libpod/network"
. "github.com/containers/podman/v2/test/utils"
"github.com/containers/storage/pkg/stringid"
. "github.com/onsi/ginkgo"
. "github.com/onsi/gomega"
"github.com/pkg/errors"
Expand Down Expand Up @@ -116,40 +117,41 @@ var _ = Describe("Podman network create", func() {
results []network.NcList
)

nc := podmanTest.Podman([]string{"network", "create", "newname"})
netName := "inspectnet-" + stringid.GenerateNonCryptoID()
nc := podmanTest.Podman([]string{"network", "create", netName})
nc.WaitWithDefaultTimeout()
defer podmanTest.removeCNINetwork(netName)
Expect(nc.ExitCode()).To(BeZero())
defer podmanTest.removeCNINetwork("newname")

inspect := podmanTest.Podman([]string{"network", "inspect", "newname"})
inspect := podmanTest.Podman([]string{"network", "inspect", netName})
inspect.WaitWithDefaultTimeout()

err := json.Unmarshal([]byte(inspect.OutputToString()), &results)
Expect(err).To(BeNil())
result := results[0]
Expect(result["name"]).To(Equal("newname"))
Expect(result["name"]).To(Equal(netName))

})

It("podman network create with name and subnet", func() {
var (
results []network.NcList
)
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.12.0/24", "newnetwork"})
netName := "subnet-" + stringid.GenerateNonCryptoID()
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.12.0/24", netName})
nc.WaitWithDefaultTimeout()
defer podmanTest.removeCNINetwork(netName)
Expect(nc.ExitCode()).To(BeZero())

defer podmanTest.removeCNINetwork("newnetwork")

// Inspect the network configuration
inspect := podmanTest.Podman([]string{"network", "inspect", "newnetwork"})
inspect := podmanTest.Podman([]string{"network", "inspect", netName})
inspect.WaitWithDefaultTimeout()

// JSON the network configuration into something usable
err := json.Unmarshal([]byte(inspect.OutputToString()), &results)
Expect(err).To(BeNil())
result := results[0]
Expect(result["name"]).To(Equal("newnetwork"))
Expect(result["name"]).To(Equal(netName))

// JSON the bridge info
bridgePlugin, err := genericPluginsToBridge(result["plugins"], "bridge")
Expand All @@ -161,7 +163,7 @@ var _ = Describe("Podman network create", func() {
// best we can
defer removeNetworkDevice(bridgePlugin.BrName)

try := podmanTest.Podman([]string{"run", "-it", "--rm", "--network", "newnetwork", ALPINE, "sh", "-c", "ip addr show eth0 | awk ' /inet / {print $2}'"})
try := podmanTest.Podman([]string{"run", "-it", "--rm", "--network", netName, ALPINE, "sh", "-c", "ip addr show eth0 | awk ' /inet / {print $2}'"})
try.WaitWithDefaultTimeout()

_, subnet, err := net.ParseCIDR("10.11.12.0/24")
Expand All @@ -178,21 +180,21 @@ var _ = Describe("Podman network create", func() {
var (
results []network.NcList
)
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "fd00:1:2:3:4::/64", "newIPv6network"})
netName := "ipv6-" + stringid.GenerateNonCryptoID()
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "fd00:1:2:3:4::/64", netName})
nc.WaitWithDefaultTimeout()
defer podmanTest.removeCNINetwork(netName)
Expect(nc.ExitCode()).To(BeZero())

defer podmanTest.removeCNINetwork("newIPv6network")

// Inspect the network configuration
inspect := podmanTest.Podman([]string{"network", "inspect", "newIPv6network"})
inspect := podmanTest.Podman([]string{"network", "inspect", netName})
inspect.WaitWithDefaultTimeout()

// JSON the network configuration into something usable
err := json.Unmarshal([]byte(inspect.OutputToString()), &results)
Expect(err).To(BeNil())
result := results[0]
Expect(result["name"]).To(Equal("newIPv6network"))
Expect(result["name"]).To(Equal(netName))

// JSON the bridge info
bridgePlugin, err := genericPluginsToBridge(result["plugins"], "bridge")
Expand All @@ -203,7 +205,7 @@ var _ = Describe("Podman network create", func() {
// best we can
defer removeNetworkDevice(bridgePlugin.BrName)

try := podmanTest.Podman([]string{"run", "-it", "--rm", "--network", "newIPv6network", ALPINE, "sh", "-c", "ip addr show eth0 | grep global | awk ' /inet6 / {print $2}'"})
try := podmanTest.Podman([]string{"run", "-it", "--rm", "--network", netName, ALPINE, "sh", "-c", "ip addr show eth0 | grep global | awk ' /inet6 / {print $2}'"})
try.WaitWithDefaultTimeout()

_, subnet, err := net.ParseCIDR("fd00:1:2:3:4::/64")
Expand All @@ -219,21 +221,21 @@ var _ = Describe("Podman network create", func() {
var (
results []network.NcList
)
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "fd00:4:3:2:1::/64", "--ipv6", "newDualStacknetwork"})
netName := "dual-" + stringid.GenerateNonCryptoID()
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "fd00:4:3:2:1::/64", "--ipv6", netName})
nc.WaitWithDefaultTimeout()
defer podmanTest.removeCNINetwork(netName)
Expect(nc.ExitCode()).To(BeZero())

defer podmanTest.removeCNINetwork("newDualStacknetwork")

// Inspect the network configuration
inspect := podmanTest.Podman([]string{"network", "inspect", "newDualStacknetwork"})
inspect := podmanTest.Podman([]string{"network", "inspect", netName})
inspect.WaitWithDefaultTimeout()

// JSON the network configuration into something usable
err := json.Unmarshal([]byte(inspect.OutputToString()), &results)
Expect(err).To(BeNil())
result := results[0]
Expect(result["name"]).To(Equal("newDualStacknetwork"))
Expect(result["name"]).To(Equal(netName))

// JSON the bridge info
bridgePlugin, err := genericPluginsToBridge(result["plugins"], "bridge")
Expand All @@ -245,7 +247,7 @@ var _ = Describe("Podman network create", func() {
// best we can
defer removeNetworkDevice(bridgePlugin.BrName)

try := podmanTest.Podman([]string{"run", "-it", "--rm", "--network", "newDualStacknetwork", ALPINE, "sh", "-c", "ip addr show eth0 | grep global | awk ' /inet6 / {print $2}'"})
try := podmanTest.Podman([]string{"run", "-it", "--rm", "--network", netName, ALPINE, "sh", "-c", "ip addr show eth0 | grep global | awk ' /inet6 / {print $2}'"})
try.WaitWithDefaultTimeout()

_, subnet, err := net.ParseCIDR("fd00:4:3:2:1::/64")
Expand All @@ -255,74 +257,81 @@ var _ = Describe("Podman network create", func() {
// Ensure that the IP the container got is within the subnet the user asked for
Expect(subnet.Contains(containerIP)).To(BeTrue())
// verify the container has an IPv4 address too (the IPv4 subnet is autogenerated)
try = podmanTest.Podman([]string{"run", "-it", "--rm", "--network", "newDualStacknetwork", ALPINE, "sh", "-c", "ip addr show eth0 | awk ' /inet / {print $2}'"})
try = podmanTest.Podman([]string{"run", "-it", "--rm", "--network", netName, ALPINE, "sh", "-c", "ip addr show eth0 | awk ' /inet / {print $2}'"})
try.WaitWithDefaultTimeout()
containerIP, _, err = net.ParseCIDR(try.OutputToString())
Expect(err).To(BeNil())
Expect(containerIP.To4()).To(Not(BeNil()))
})

It("podman network create with invalid subnet", func() {
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.12.0/17000", "fail"})
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.12.0/17000", stringid.GenerateNonCryptoID()})
nc.WaitWithDefaultTimeout()
Expect(nc).To(ExitWithError())
})

It("podman network create with ipv4 subnet and ipv6 flag", func() {
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.12.0/24", "--ipv6", "fail"})
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.12.0/24", "--ipv6", stringid.GenerateNonCryptoID()})
nc.WaitWithDefaultTimeout()
Expect(nc).To(ExitWithError())
})

It("podman network create with empty subnet and ipv6 flag", func() {
nc := podmanTest.Podman([]string{"network", "create", "--ipv6", "fail"})
nc := podmanTest.Podman([]string{"network", "create", "--ipv6", stringid.GenerateNonCryptoID()})
nc.WaitWithDefaultTimeout()
Expect(nc).To(ExitWithError())
})

It("podman network create with invalid IP", func() {
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.0/17000", "fail"})
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.0/17000", stringid.GenerateNonCryptoID()})
nc.WaitWithDefaultTimeout()
Expect(nc).To(ExitWithError())
})

It("podman network create with invalid gateway for subnet", func() {
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.12.0/24", "--gateway", "192.168.1.1", "fail"})
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.12.0/24", "--gateway", "192.168.1.1", stringid.GenerateNonCryptoID()})
nc.WaitWithDefaultTimeout()
Expect(nc).To(ExitWithError())
})

It("podman network create two networks with same name should fail", func() {
nc := podmanTest.Podman([]string{"network", "create", "samename"})
netName := "same-" + stringid.GenerateNonCryptoID()
nc := podmanTest.Podman([]string{"network", "create", netName})
nc.WaitWithDefaultTimeout()
defer podmanTest.removeCNINetwork(netName)
Expect(nc.ExitCode()).To(BeZero())
defer podmanTest.removeCNINetwork("samename")

ncFail := podmanTest.Podman([]string{"network", "create", "samename"})
ncFail := podmanTest.Podman([]string{"network", "create", netName})
ncFail.WaitWithDefaultTimeout()
Expect(ncFail).To(ExitWithError())
})

It("podman network create two networks with same subnet should fail", func() {
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.13.0/24", "subnet1"})
netName1 := "sub1-" + stringid.GenerateNonCryptoID()
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.13.0/24", netName1})
nc.WaitWithDefaultTimeout()
defer podmanTest.removeCNINetwork(netName1)
Expect(nc.ExitCode()).To(BeZero())
defer podmanTest.removeCNINetwork("subnet1")

ncFail := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.13.0/24", "subnet2"})
netName2 := "sub2-" + stringid.GenerateNonCryptoID()
ncFail := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.13.0/24", netName2})
ncFail.WaitWithDefaultTimeout()
defer podmanTest.removeCNINetwork(netName2)
Expect(ncFail).To(ExitWithError())
})

It("podman network create two IPv6 networks with same subnet should fail", func() {
SkipIfRootless("FIXME It needs the ip6tables modules loaded")
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "fd00:4:4:4:4::/64", "--ipv6", "subnet1v6"})
netName1 := "subipv61-" + stringid.GenerateNonCryptoID()
nc := podmanTest.Podman([]string{"network", "create", "--subnet", "fd00:4:4:4:4::/64", "--ipv6", netName1})
nc.WaitWithDefaultTimeout()
defer podmanTest.removeCNINetwork(netName1)
Expect(nc.ExitCode()).To(BeZero())
defer podmanTest.removeCNINetwork("subnet1v6")

ncFail := podmanTest.Podman([]string{"network", "create", "--subnet", "fd00:4:4:4:4::/64", "--ipv6", "subnet2v6"})
netName2 := "subipv62-" + stringid.GenerateNonCryptoID()
ncFail := podmanTest.Podman([]string{"network", "create", "--subnet", "fd00:4:4:4:4::/64", "--ipv6", netName2})
ncFail.WaitWithDefaultTimeout()
defer podmanTest.removeCNINetwork(netName2)
Expect(ncFail).To(ExitWithError())
})

Expand All @@ -333,11 +342,11 @@ var _ = Describe("Podman network create", func() {
})

It("podman network create with mtu option", func() {
net := "mtu-test"
net := "mtu-test" + stringid.GenerateNonCryptoID()
nc := podmanTest.Podman([]string{"network", "create", "--opt", "mtu=9000", net})
nc.WaitWithDefaultTimeout()
Expect(nc.ExitCode()).To(BeZero())
defer podmanTest.removeCNINetwork(net)
Expect(nc.ExitCode()).To(BeZero())

nc = podmanTest.Podman([]string{"network", "inspect", net})
nc.WaitWithDefaultTimeout()
Expand All @@ -346,11 +355,11 @@ var _ = Describe("Podman network create", func() {
})

It("podman network create with vlan option", func() {
net := "vlan-test"
net := "vlan-test" + stringid.GenerateNonCryptoID()
nc := podmanTest.Podman([]string{"network", "create", "--opt", "vlan=9", net})
nc.WaitWithDefaultTimeout()
Expect(nc.ExitCode()).To(BeZero())
defer podmanTest.removeCNINetwork(net)
Expect(nc.ExitCode()).To(BeZero())

nc = podmanTest.Podman([]string{"network", "inspect", net})
nc.WaitWithDefaultTimeout()
Expand All @@ -359,10 +368,28 @@ var _ = Describe("Podman network create", func() {
})

It("podman network create with invalid option", func() {
net := "invalid-test"
net := "invalid-test" + stringid.GenerateNonCryptoID()
nc := podmanTest.Podman([]string{"network", "create", "--opt", "foo=bar", net})
nc.WaitWithDefaultTimeout()
defer podmanTest.removeCNINetwork(net)
Expect(nc).To(ExitWithError())
})

It("podman network create with internal should not have dnsname", func() {
net := "internal-test" + stringid.GenerateNonCryptoID()
nc := podmanTest.Podman([]string{"network", "create", "--internal", net})
nc.WaitWithDefaultTimeout()
defer podmanTest.removeCNINetwork(net)
Expect(nc.ExitCode()).To(BeZero())
// Not performing this check on remote tests because it is a logrus error which does
// not come back via stderr on the remote client.
if !IsRemote() {
Expect(nc.ErrorToString()).To(ContainSubstring("dnsname and --internal networks are incompatible"))
}
nc = podmanTest.Podman([]string{"network", "inspect", net})
nc.WaitWithDefaultTimeout()
Expect(nc.ExitCode()).To(BeZero())
Expect(nc.OutputToString()).ToNot(ContainSubstring("dnsname"))
})

})
Loading

0 comments on commit 4dbb58d

Please sign in to comment.