fix slirp4netns port forwarding with ranges

The slirp4netns port forwarder was not updated to make use of the new port format. This results in a problem when port ranges are used since it does not read the range field from the port. Update the logic to iterate through all ports with the range and protocols. Also added a system test for port ranges with slirp4netns, rootlesskit and the bridge network mode. Fixes containers#13643 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Luap99 · Mar 24, 2022 · 2fc46f7 · 2fc46f7
1 parent a416fd6
commit 2fc46f7
Show file tree

Hide file tree

Showing 2 changed files with 71 additions and 47 deletions.
diff --git a/libpod/networking_slirp4netns.go b/libpod/networking_slirp4netns.go
@@ -615,54 +615,59 @@ func (r *Runtime) setupRootlessPortMappingViaSlirp(ctr *Container, cmd *exec.Cmd
 
 	// for each port we want to add we need to open a connection to the slirp4netns control socket
 	// and send the add_hostfwd command.
-	for _, i := range ctr.convertPortMappings() {
-		conn, err := net.Dial("unix", apiSocket)
-		if err != nil {
-			return errors.Wrapf(err, "cannot open connection to %s", apiSocket)
-		}
-		defer func() {
-			if err := conn.Close(); err != nil {
-				logrus.Errorf("Unable to close connection: %q", err)
+	for _, port := range ctr.convertPortMappings() {
+		protocols := strings.Split(port.Protocol, ",")
+		for _, protocol := range protocols {
+			hostIP := port.HostIP
+			if hostIP == "" {
+				hostIP = "0.0.0.0"
+			}
+			for i := uint16(0); i < port.Range; i++ {
+				conn, err := net.Dial("unix", apiSocket)
+				if err != nil {
+					return errors.Wrapf(err, "cannot open connection to %s", apiSocket)
+				}
+				defer func() {
+					if err := conn.Close(); err != nil {
+						logrus.Errorf("Unable to close connection: %q", err)
+					}
+				}()
+				apiCmd := slirp4netnsCmd{
+					Execute: "add_hostfwd",
+					Args: slirp4netnsCmdArg{
+						Proto:     protocol,
+						HostAddr:  hostIP,
+						HostPort:  port.HostPort + i,
+						GuestPort: port.ContainerPort + i,
+					},
+				}
+				// create the JSON payload and send it.  Mark the end of request shutting down writes
+				// to the socket, as requested by slirp4netns.
+				data, err := json.Marshal(&apiCmd)
+				if err != nil {
+					return errors.Wrapf(err, "cannot marshal JSON for slirp4netns")
+				}
+				if _, err := conn.Write([]byte(fmt.Sprintf("%s\n", data))); err != nil {
+					return errors.Wrapf(err, "cannot write to control socket %s", apiSocket)
+				}
+				if err := conn.(*net.UnixConn).CloseWrite(); err != nil {
+					return errors.Wrapf(err, "cannot shutdown the socket %s", apiSocket)
+				}
+				buf := make([]byte, 2048)
+				readLength, err := conn.Read(buf)
+				if err != nil {
+					return errors.Wrapf(err, "cannot read from control socket %s", apiSocket)
+				}
+				// if there is no 'error' key in the received JSON data, then the operation was
+				// successful.
+				var y map[string]interface{}
+				if err := json.Unmarshal(buf[0:readLength], &y); err != nil {
+					return errors.Wrapf(err, "error parsing error status from slirp4netns")
+				}
+				if e, found := y["error"]; found {
+					return errors.Errorf("error from slirp4netns while setting up port redirection: %v", e)
+				}
 			}
-		}()
-		hostIP := i.HostIP
-		if hostIP == "" {
-			hostIP = "0.0.0.0"
-		}
-		apiCmd := slirp4netnsCmd{
-			Execute: "add_hostfwd",
-			Args: slirp4netnsCmdArg{
-				Proto:     i.Protocol,
-				HostAddr:  hostIP,
-				HostPort:  i.HostPort,
-				GuestPort: i.ContainerPort,
-			},
-		}
-		// create the JSON payload and send it.  Mark the end of request shutting down writes
-		// to the socket, as requested by slirp4netns.
-		data, err := json.Marshal(&apiCmd)
-		if err != nil {
-			return errors.Wrapf(err, "cannot marshal JSON for slirp4netns")
-		}
-		if _, err := conn.Write([]byte(fmt.Sprintf("%s\n", data))); err != nil {
-			return errors.Wrapf(err, "cannot write to control socket %s", apiSocket)
-		}
-		if err := conn.(*net.UnixConn).CloseWrite(); err != nil {
-			return errors.Wrapf(err, "cannot shutdown the socket %s", apiSocket)
-		}
-		buf := make([]byte, 2048)
-		readLength, err := conn.Read(buf)
-		if err != nil {
-			return errors.Wrapf(err, "cannot read from control socket %s", apiSocket)
-		}
-		// if there is no 'error' key in the received JSON data, then the operation was
-		// successful.
-		var y map[string]interface{}
-		if err := json.Unmarshal(buf[0:readLength], &y); err != nil {
-			return errors.Wrapf(err, "error parsing error status from slirp4netns")
-		}
-		if e, found := y["error"]; found {
-			return errors.Errorf("error from slirp4netns while setting up port redirection: %v", e)
 		}
 	}
 	logrus.Debug("slirp4netns port-forwarding setup via add_hostfwd is ready")

diff --git a/test/system/500-networking.bats b/test/system/500-networking.bats
@@ -632,4 +632,23 @@ EOF
     is "$output" ".*nameserver $subnet.1.*" "integrated dns nameserver is set"
 }
 
+@test "podman run port forward range" {
+    for netmode in bridge slirp4netns:port_handler=slirp4netns slirp4netns:port_handler=rootlesskit; do
+        local port=$(random_free_port)
+        local end_port=$(( $port + 2 ))
+        local range="$port-$end_port:$port-$end_port"
+        local random=$(random_string)
+
+        run_podman run --network $netmode -p "$range" -d $IMAGE sleep inf
+        cid="$output"
+        for port in $(seq $port $end_port); do
+            run_podman exec -d $cid nc -l -p $port -e /bin/cat
+            run nc 127.0.0.1 $port <<<$random
+            is "$output" "$random" "ncat got data back"
+        done
+
+        run_podman rm -f -t0 $cid
+    done
+}
+
 # vim: filetype=sh