Skip to content

Commit 6daf3d2

Browse files
vdemeestervdemeester
committed
Validate hostname starting from 1.24 API.
In order to keep a little bit of "sanity" on the API side, validate hostname only starting from v1.24 API version. Signed-off-by: Vincent Demeester <[email protected]>
1 parent ad44f49 commit 6daf3d2

13 files changed

Lines changed: 44 additions & 32 deletions

File tree

‎api/server/router/container/backend.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,17 +32,17 @@ type copyBackend interface {
3232

3333
// stateBackend includes functions to implement to provide container state lifecycle functionality.
3434
type stateBackend interface {
35-
ContainerCreate(types.ContainerCreateConfig) (types.ContainerCreateResponse, error)
35+
ContainerCreate(config types.ContainerCreateConfig, validateHostname bool) (types.ContainerCreateResponse, error)
3636
ContainerKill(name string, sig uint64) error
3737
ContainerPause(name string) error
3838
ContainerRename(oldName, newName string) error
3939
ContainerResize(name string, height, width int) error
4040
ContainerRestart(name string, seconds int) error
4141
ContainerRm(name string, config *types.ContainerRmConfig) error
42-
ContainerStart(name string, hostConfig *container.HostConfig) error
42+
ContainerStart(name string, hostConfig *container.HostConfig, validateHostname bool) error
4343
ContainerStop(name string, seconds int) error
4444
ContainerUnpause(name string) error
45-
ContainerUpdate(name string, hostConfig *container.HostConfig) ([]string, error)
45+
ContainerUpdate(name string, hostConfig *container.HostConfig, validateHostname bool) ([]string, error)
4646
ContainerWait(name string, timeout time.Duration) (int, error)
4747
}
4848

‎api/server/router/container/container_routes.go‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -132,10 +132,10 @@ func (s *containerRouter) postContainersStart(ctx context.Context, w http.Respon
132132
// including r.TransferEncoding
133133
// allow a nil body for backwards compatibility
134134

135+
version := httputils.VersionFromContext(ctx)
135136
var hostConfig *container.HostConfig
136137
// A non-nil json object is at least 7 characters.
137138
if r.ContentLength > 7 || r.ContentLength == -1 {
138-
version := httputils.VersionFromContext(ctx)
139139
if versions.GreaterThanOrEqualTo(version, "1.24") {
140140
return validationError{fmt.Errorf("starting container with HostConfig was deprecated since v1.10 and removed in v1.12")}
141141
}
@@ -151,7 +151,8 @@ func (s *containerRouter) postContainersStart(ctx context.Context, w http.Respon
151151
hostConfig = c
152152
}
153153

154-
if err := s.backend.ContainerStart(vars["name"], hostConfig); err != nil {
154+
validateHostname := versions.GreaterThanOrEqualTo(version, "1.24")
155+
if err := s.backend.ContainerStart(vars["name"], hostConfig, validateHostname); err != nil {
155156
return err
156157
}
157158
w.WriteHeader(http.StatusNoContent)
@@ -311,6 +312,7 @@ func (s *containerRouter) postContainerUpdate(ctx context.Context, w http.Respon
311312
return err
312313
}
313314

315+
version := httputils.VersionFromContext(ctx)
314316
var updateConfig container.UpdateConfig
315317

316318
decoder := json.NewDecoder(r.Body)
@@ -324,7 +326,8 @@ func (s *containerRouter) postContainerUpdate(ctx context.Context, w http.Respon
324326
}
325327

326328
name := vars["name"]
327-
warnings, err := s.backend.ContainerUpdate(name, hostConfig)
329+
validateHostname := versions.GreaterThanOrEqualTo(version, "1.24")
330+
warnings, err := s.backend.ContainerUpdate(name, hostConfig, validateHostname)
328331
if err != nil {
329332
return err
330333
}
@@ -351,13 +354,14 @@ func (s *containerRouter) postContainersCreate(ctx context.Context, w http.Respo
351354
version := httputils.VersionFromContext(ctx)
352355
adjustCPUShares := versions.LessThan(version, "1.19")
353356

357+
validateHostname := versions.GreaterThanOrEqualTo(version, "1.24")
354358
ccr, err := s.backend.ContainerCreate(types.ContainerCreateConfig{
355359
Name: name,
356360
Config: config,
357361
HostConfig: hostConfig,
358362
NetworkingConfig: networkingConfig,
359363
AdjustCPUShares: adjustCPUShares,
360-
})
364+
}, validateHostname)
361365
if err != nil {
362366
return err
363367
}

‎builder/builder.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -116,15 +116,15 @@ type Backend interface {
116116
// ContainerAttachRaw attaches to container.
117117
ContainerAttachRaw(cID string, stdin io.ReadCloser, stdout, stderr io.Writer, stream bool) error
118118
// ContainerCreate creates a new Docker container and returns potential warnings
119-
ContainerCreate(types.ContainerCreateConfig) (types.ContainerCreateResponse, error)
119+
ContainerCreate(config types.ContainerCreateConfig, validateHostname bool) (types.ContainerCreateResponse, error)
120120
// ContainerRm removes a container specified by `id`.
121121
ContainerRm(name string, config *types.ContainerRmConfig) error
122122
// Commit creates a new Docker image from an existing Docker container.
123123
Commit(string, *backend.ContainerCommitConfig) (string, error)
124124
// ContainerKill stops the container execution abruptly.
125125
ContainerKill(containerID string, sig uint64) error
126126
// ContainerStart starts a new container
127-
ContainerStart(containerID string, hostConfig *container.HostConfig) error
127+
ContainerStart(containerID string, hostConfig *container.HostConfig, validateHostname bool) error
128128
// ContainerWait stops processing until the given container is stopped.
129129
ContainerWait(containerID string, timeout time.Duration) (int, error)
130130
// ContainerUpdateCmdOnBuild updates container.Path and container.Args

‎builder/dockerfile/internals.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,7 @@ func (b *Builder) runContextCommand(args []string, allowRemote bool, allowLocalD
181181
return nil
182182
}
183183

184-
container, err := b.docker.ContainerCreate(types.ContainerCreateConfig{Config: b.runConfig})
184+
container, err := b.docker.ContainerCreate(types.ContainerCreateConfig{Config: b.runConfig}, true)
185185
if err != nil {
186186
return err
187187
}
@@ -508,7 +508,7 @@ func (b *Builder) create() (string, error) {
508508
c, err := b.docker.ContainerCreate(types.ContainerCreateConfig{
509509
Config: b.runConfig,
510510
HostConfig: hostConfig,
511-
})
511+
}, true)
512512
if err != nil {
513513
return "", err
514514
}
@@ -552,7 +552,7 @@ func (b *Builder) run(cID string) (err error) {
552552
}
553553
}()
554554

555-
if err := b.docker.ContainerStart(cID, nil); err != nil {
555+
if err := b.docker.ContainerStart(cID, nil, true); err != nil {
556556
return err
557557
}
558558

‎daemon/cluster/executor/backend.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ type Backend interface {
1818
DeleteManagedNetwork(name string) error
1919
SetupIngress(req clustertypes.NetworkCreateRequest, nodeIP string) error
2020
PullImage(ctx context.Context, image, tag string, metaHeaders map[string][]string, authConfig *types.AuthConfig, outStream io.Writer) error
21-
CreateManagedContainer(types.ContainerCreateConfig) (types.ContainerCreateResponse, error)
22-
ContainerStart(name string, hostConfig *container.HostConfig) error
21+
CreateManagedContainer(config types.ContainerCreateConfig, validateHostname bool) (types.ContainerCreateResponse, error)
22+
ContainerStart(name string, hostConfig *container.HostConfig, validateHostname bool) error
2323
ContainerStop(name string, seconds int) error
2424
ConnectContainerToNetwork(containerName, networkName string, endpointConfig *network.EndpointSettings) error
2525
UpdateContainerServiceConfig(containerName string, serviceConfig *clustertypes.ServiceConfig) error

‎daemon/cluster/executor/container/adapter.go‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,10 @@ import (
99
"syscall"
1010

1111
"github.com/Sirupsen/logrus"
12+
"github.com/docker/docker/api/server/httputils"
1213
executorpkg "github.com/docker/docker/daemon/cluster/executor"
1314
"github.com/docker/engine-api/types"
15+
"github.com/docker/engine-api/types/versions"
1416
"github.com/docker/libnetwork"
1517
"github.com/docker/swarmkit/api"
1618
"github.com/docker/swarmkit/log"
@@ -115,13 +117,16 @@ func (c *containerAdapter) removeNetworks(ctx context.Context) error {
115117
func (c *containerAdapter) create(ctx context.Context, backend executorpkg.Backend) error {
116118
var cr types.ContainerCreateResponse
117119
var err error
120+
version := httputils.VersionFromContext(ctx)
121+
validateHostname := versions.GreaterThanOrEqualTo(version, "1.24")
122+
118123
if cr, err = backend.CreateManagedContainer(types.ContainerCreateConfig{
119124
Name: c.container.name(),
120125
Config: c.container.config(),
121126
HostConfig: c.container.hostConfig(),
122127
// Use the first network in container create
123128
NetworkingConfig: c.container.createNetworkingConfig(),
124-
}); err != nil {
129+
}, validateHostname); err != nil {
125130
return err
126131
}
127132

@@ -145,7 +150,9 @@ func (c *containerAdapter) create(ctx context.Context, backend executorpkg.Backe
145150
}
146151

147152
func (c *containerAdapter) start(ctx context.Context) error {
148-
return c.backend.ContainerStart(c.container.name(), nil)
153+
version := httputils.VersionFromContext(ctx)
154+
validateHostname := versions.GreaterThanOrEqualTo(version, "1.24")
155+
return c.backend.ContainerStart(c.container.name(), nil, validateHostname)
149156
}
150157

151158
func (c *containerAdapter) inspect(ctx context.Context) (types.ContainerJSON, error) {

‎daemon/container.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,7 @@ func (daemon *Daemon) setHostConfig(container *container.Container, hostConfig *
203203

204204
// verifyContainerSettings performs validation of the hostconfig and config
205205
// structures.
206-
func (daemon *Daemon) verifyContainerSettings(hostConfig *containertypes.HostConfig, config *containertypes.Config, update bool) ([]string, error) {
206+
func (daemon *Daemon) verifyContainerSettings(hostConfig *containertypes.HostConfig, config *containertypes.Config, update bool, validateHostname bool) ([]string, error) {
207207

208208
// First perform verification of settings common across all platforms.
209209
if config != nil {
@@ -222,10 +222,10 @@ func (daemon *Daemon) verifyContainerSettings(hostConfig *containertypes.HostCon
222222
}
223223

224224
// Validate if the given hostname is RFC 1123 (https://tools.ietf.org/html/rfc1123) compliant.
225-
if len(config.Hostname) > 0 {
225+
if validateHostname && len(config.Hostname) > 0 {
226226
// RFC1123 specifies that 63 bytes is the maximium length
227227
// Windows has the limitation of 63 bytes in length
228-
// Linux hostname is limited to HOST_NAME_MAX=64, not not including the terminating null byte.
228+
// Linux hostname is limited to HOST_NAME_MAX=64, not including the terminating null byte.
229229
// We limit the length to 63 bytes here to match RFC1035 and RFC1123.
230230
matched, _ := regexp.MatchString("^(([[:alnum:]]|[[:alnum:]][[:alnum:]\\-]*[[:alnum:]])\\.)*([[:alnum:]]|[[:alnum:]][[:alnum:]\\-]*[[:alnum:]])$", config.Hostname)
231231
if len(config.Hostname) > 63 || !matched {

‎daemon/create.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,21 +20,21 @@ import (
2020
)
2121

2222
// CreateManagedContainer creates a container that is managed by a Service
23-
func (daemon *Daemon) CreateManagedContainer(params types.ContainerCreateConfig) (types.ContainerCreateResponse, error) {
24-
return daemon.containerCreate(params, true)
23+
func (daemon *Daemon) CreateManagedContainer(params types.ContainerCreateConfig, validateHostname bool) (types.ContainerCreateResponse, error) {
24+
return daemon.containerCreate(params, true, validateHostname)
2525
}
2626

2727
// ContainerCreate creates a regular container
28-
func (daemon *Daemon) ContainerCreate(params types.ContainerCreateConfig) (types.ContainerCreateResponse, error) {
29-
return daemon.containerCreate(params, false)
28+
func (daemon *Daemon) ContainerCreate(params types.ContainerCreateConfig, validateHostname bool) (types.ContainerCreateResponse, error) {
29+
return daemon.containerCreate(params, false, validateHostname)
3030
}
3131

32-
func (daemon *Daemon) containerCreate(params types.ContainerCreateConfig, managed bool) (types.ContainerCreateResponse, error) {
32+
func (daemon *Daemon) containerCreate(params types.ContainerCreateConfig, managed bool, validateHostname bool) (types.ContainerCreateResponse, error) {
3333
if params.Config == nil {
3434
return types.ContainerCreateResponse{}, fmt.Errorf("Config cannot be empty in order to create a container")
3535
}
3636

37-
warnings, err := daemon.verifyContainerSettings(params.HostConfig, params.Config, false)
37+
warnings, err := daemon.verifyContainerSettings(params.HostConfig, params.Config, false, validateHostname)
3838
if err != nil {
3939
return types.ContainerCreateResponse{Warnings: warnings}, err
4040
}

‎daemon/start.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ import (
1818
)
1919

2020
// ContainerStart starts a container.
21-
func (daemon *Daemon) ContainerStart(name string, hostConfig *containertypes.HostConfig) error {
21+
func (daemon *Daemon) ContainerStart(name string, hostConfig *containertypes.HostConfig, validateHostname bool) error {
2222
container, err := daemon.GetContainer(name)
2323
if err != nil {
2424
return err
@@ -68,7 +68,7 @@ func (daemon *Daemon) ContainerStart(name string, hostConfig *containertypes.Hos
6868

6969
// check if hostConfig is in line with the current system settings.
7070
// It may happen cgroups are umounted or the like.
71-
if _, err = daemon.verifyContainerSettings(container.HostConfig, nil, false); err != nil {
71+
if _, err = daemon.verifyContainerSettings(container.HostConfig, nil, false, validateHostname); err != nil {
7272
return err
7373
}
7474
// Adapt for old containers in case we have updates in this function and

‎daemon/update.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ import (
77
)
88

99
// ContainerUpdate updates configuration of the container
10-
func (daemon *Daemon) ContainerUpdate(name string, hostConfig *container.HostConfig) ([]string, error) {
10+
func (daemon *Daemon) ContainerUpdate(name string, hostConfig *container.HostConfig, validateHostname bool) ([]string, error) {
1111
var warnings []string
1212

13-
warnings, err := daemon.verifyContainerSettings(hostConfig, nil, true)
13+
warnings, err := daemon.verifyContainerSettings(hostConfig, nil, true, validateHostname)
1414
if err != nil {
1515
return warnings, err
1616
}

0 commit comments

Comments
 (0)