New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Restore deterministic IPv6 from MAC behavior on default bridge network #17890
Conversation
LGTM |
Signed-off-by: Alessandro Boch <aboch@docker.com>
Thanks @aboch, do we want it for 1.9.1? |
if config.Bridge.FixedCIDRv6 != "" { | ||
_, fCIDRv6, err := net.ParseCIDR(config.Bridge.FixedCIDRv6) | ||
if err != nil { | ||
return err | ||
} | ||
|
||
ones, _ := fCIDRv6.Mask.Size() | ||
deferIPv6Alloc = ones <= 80 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just two quick questions:
- What's the meaning of that
ones <= 80
? - Do we need the
bool
variable or can we justif ones <= 80 { NetworkOptionDeferIPv6Alloc(true) }
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@icecrime
When IPv6 support was added into docker, the IPv6 address assignment could happen in two ways:
- from MAC address (last 48 bits of the IPv6 address == MAC address)
- or via ip allocator
The first method was the preferred way, always chosen by bridge driver when the IPv6 network had enough host bits to contain the MAC address. That's from where the 80 (128-48) bits comes from.
This logic gave a backdoor access to configure deterministic IPv6 addresses for containers.
In order to restore that behavior (which got broken) only for the default bridge network, I had to bring the 80 bits in here.
Whenever we support the IPAM options for endpoint (container), we can deprecate the above behavior.
Since the ones
are not visible outside of the if scope, I opted for a bool variable outside.
If I had to initialize the NetworkOption setter function inside the if scope, then I'd need to define anyway an extra variable outside, of type libnetwork.NetworkOption
. Hence I did not see a difference.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the background, I think it's worth a code comment (or people reading this will definitely scratch their heads).
I don't really understand why you would need a variable if you just called libnetwork.NetworkOptionDeferIPv6Alloc
at that point of the code, but I'll trust you with that :-/
@icecrime |
Adding this to 1.9.1 as P0 (regression). Small nits, otherwise LGTM! |
Signed-off-by: Alessandro Boch <aboch@docker.com>
thanks, i can see the comment added, looks good, merging. |
Restore deterministic IPv6 from MAC behavior on default bridge network
Fixes #17739