From 8fa9a697642a2ec8f7588ac7114754fcd79eb9a8 Mon Sep 17 00:00:00 2001
From: Alessandro Boch <[email protected]>
Date: Tue, 13 Dec 2016 15:04:35 -0800
Subject: [PATCH 1/2] Placeholder for libnetwork changes

Signed-off-by: Alessandro Boch <[email protected]>
---
 .../docker/libnetwork/ipamutils/utils.go           | 104 ++++++++++++++++++++-
 1 file changed, 101 insertions(+), 3 deletions(-)

diff --git a/vendor/github.com/docker/libnetwork/ipamutils/utils.go b/vendor/github.com/docker/libnetwork/ipamutils/utils.go
index bca4e9e519a..16bd79fb0ac 100644
--- a/vendor/github.com/docker/libnetwork/ipamutils/utils.go
+++ b/vendor/github.com/docker/libnetwork/ipamutils/utils.go
@@ -2,6 +2,7 @@
 package ipamutils
 
 import (
+	"fmt"
 	"net"
 	"sync"
 )
@@ -13,11 +14,25 @@ var (
 	// PredefinedGranularNetworks contains a list of 64K IPv4 private networks with host size 8
 	// (10.x.x.x/24) which do not overlap with the networks in `PredefinedBroadNetworks`
 	PredefinedGranularNetworks []*net.IPNet
-
-	initNetworksOnce sync.Once
+	// ErrPoolsAlreadyInitialized notifies the default pools are already set
+	ErrPoolsAlreadyInitialized = fmt.Errorf("predefined address pools are already initialized")
+	initNetworksOnce           sync.Once
 )
 
-// InitNetworks initializes the pre-defined networks used by the built-in IP allocator
+// PredefinedPools represent a set of address pools with prefix length Size.
+// Each pool in the set is derived from the Base pool. Base is to be passed
+// in CIDR format. The Scope field can be "local" or "global", and says
+// whether the address pool is to be used for local or global scope networks.
+// Example: a Base "10.10.0.0/16 with Size 24 will define the set of 256
+// 10.10.[0-255].0/24 address pools
+type PredefinedPools struct {
+	Scope string `json:"scope,omitempty"`
+	Base  string `json:"base"`
+	Size  int    `json:"size"`
+}
+
+// InitNetworks initializes the local and global scope predefined adress pools
+// with the default values.
 func InitNetworks() {
 	initNetworksOnce.Do(func() {
 		PredefinedBroadNetworks = initBroadPredefinedNetworks()
@@ -48,3 +63,86 @@ func initGranularPredefinedNetworks() []*net.IPNet {
 	}
 	return pl
 }
+
+// InitAddressPools allows to initialize the local and global scope predefined
+// address pools to the desired values. It fails is invalid input is passed
+// or if the predefined pools were already initialized.
+func InitAddressPools(list []*PredefinedPools) error {
+	var (
+		localPools  []*net.IPNet
+		globalPools []*net.IPNet
+		done        bool
+	)
+
+	for _, p := range list {
+		if p == nil {
+			continue
+		}
+		_, b, err := net.ParseCIDR(p.Base)
+		if err != nil {
+			return fmt.Errorf("invalid base pool %q: %v", p.Base, err)
+		}
+		ones, _ := b.Mask.Size()
+		if p.Size <= 0 || p.Size < ones {
+			return fmt.Errorf("invalid pools size: %d", p.Size)
+		}
+		switch p.Scope {
+		case "", "local":
+			localPools = append(localPools, initPools(p.Size, b)...)
+		case "global":
+			globalPools = append(globalPools, initPools(p.Size, b)...)
+		default:
+			return fmt.Errorf("invalid pool scope: %s", p.Scope)
+		}
+	}
+
+	if localPools == nil {
+		localPools = initBroadPredefinedNetworks()
+	}
+	if globalPools == nil {
+		globalPools = initGranularPredefinedNetworks()
+	}
+
+	initNetworksOnce.Do(func() {
+		PredefinedBroadNetworks = localPools
+		PredefinedGranularNetworks = globalPools
+		done = true
+	})
+
+	if !done {
+		return ErrPoolsAlreadyInitialized
+	}
+
+	return nil
+}
+
+func initPools(size int, base *net.IPNet) []*net.IPNet {
+	one, bits := base.Mask.Size()
+	mask := net.CIDRMask(size, bits)
+	n := 1 << uint(size-one)
+	s := uint(bits - size)
+	list := make([]*net.IPNet, 0, n)
+
+	for i := 0; i < n; i++ {
+		ip := copyIP(base.IP)
+		addIntToIP(ip, uint(i<<s))
+		list = append(list, &net.IPNet{IP: ip, Mask: mask})
+	}
+
+	return list
+}
+
+func copyIP(from net.IP) net.IP {
+	ip := make([]byte, len(from))
+	for i := 0; i < len(ip); i++ {
+		ip[i] = from[i]
+	}
+	return ip
+}
+
+func addIntToIP(array []byte, ordinal uint) {
+	for i := len(array) - 1; i >= 0; i-- {
+		array[i] |= (byte)(ordinal & 0xff)
+		ordinal >>= 8
+	}
+}

From 0c0c9cbb8d85554bc195c91155ad778450b7eb86 Mon Sep 17 00:00:00 2001
From: Alessandro Boch <[email protected]>
Date: Tue, 13 Dec 2016 15:04:59 -0800
Subject: [PATCH 2/2] Allow user to control the default address pools

- Via daemon flag --default-address-pools scope=<local|global>,base=<CIDR>,size=<int>

Signed-off-by: Alessandro Boch <[email protected]>
---
 cmd/dockerd/config_unix.go                |  1 +
 daemon/config/config_unix.go              | 17 +++++++
 daemon/daemon_unix.go                     |  4 ++
 docs/reference/commandline/dockerd.md     |  1 +
 integration-cli/docker_cli_daemon_test.go | 30 +++++++++++
 man/dockerd.8.md                          |  6 +++
 opts/address_pools.go                     | 84 +++++++++++++++++++++++++++++++
 7 files changed, 143 insertions(+)
 create mode 100644 opts/address_pools.go

diff --git a/cmd/dockerd/config_unix.go b/cmd/dockerd/config_unix.go
index d79f0b5c9ac..6c70b462f5d 100644
--- a/cmd/dockerd/config_unix.go
+++ b/cmd/dockerd/config_unix.go
@@ -46,6 +46,7 @@ func installConfigFlags(conf *config.Config, flags *pflag.FlagSet) {
 	flags.Int64Var(&conf.CPURealtimeRuntime, "cpu-rt-runtime", 0, "Limit the CPU real-time runtime in microseconds")
 	flags.StringVar(&conf.SeccompProfile, "seccomp-profile", "", "Path to seccomp profile")
 	flags.Var(&conf.ShmSize, "default-shm-size", "Default shm size for containers")
+	flags.Var(opts.NewPoolsOpt(&conf.NetworkConfig.DefaultAddressPools), "default-address-pools", "Set the default address pools for local/global scope networks")
 
 	attachExperimentalFlags(conf, flags)
 }
diff --git a/daemon/config/config_unix.go b/daemon/config/config_unix.go
index 8f1da59198b..87a86a8c4c2 100644
--- a/daemon/config/config_unix.go
+++ b/daemon/config/config_unix.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/docker/docker/opts"
 	units "github.com/docker/go-units"
+	"github.com/docker/libnetwork/ipamutils"
 )
 
 // Config defines the configuration of a docker daemon.
@@ -18,6 +19,8 @@ type Config struct {
 	// These fields are common to all unix platforms.
 	CommonUnixConfig
 
+	NetworkConfig
+
 	// Fields below here are platform specific.
 	CgroupParent         string                   `json:"cgroup-parent,omitempty"`
 	EnableSelinuxSupport bool                     `json:"selinux-enabled,omitempty"`
@@ -51,6 +54,12 @@ type BridgeConfig struct {
 	FixedCIDRv6         string `json:"fixed-cidr-v6,omitempty"`
 }
 
+// NetworkConfig stores the daemon-wide networking configurations
+type NetworkConfig struct {
+	// Default address pools for docker networks
+	DefaultAddressPools []*ipamutils.PredefinedPools `json:"default-address-pools,omitempty"`
+}
+
 // IsSwarmCompatible defines if swarm mode can be enabled in this config
 func (conf *Config) IsSwarmCompatible() error {
 	if conf.ClusterStore != "" || conf.ClusterAdvertise != "" {
@@ -61,3 +70,11 @@ func (conf *Config) IsSwarmCompatible() error {
 	}
 	return nil
 }
+
+// ProcessPoolsConfig applies the default address pools configuration, if present
+func (conf *Config) ProcessPoolsConfig() error {
+	if len(conf.NetworkConfig.DefaultAddressPools) == 0 {
+		return nil
+	}
+	return ipamutils.InitAddressPools(conf.NetworkConfig.DefaultAddressPools)
+}
diff --git a/daemon/daemon_unix.go b/daemon/daemon_unix.go
index 6a961bae01a..f1df9af3c66 100644
--- a/daemon/daemon_unix.go
+++ b/daemon/daemon_unix.go
@@ -725,6 +725,10 @@ func configureKernelSecuritySupport(config *config.Config, driverName string) er
 }
 
 func (daemon *Daemon) initNetworkController(config *config.Config, activeSandboxes map[string]interface{}) (libnetwork.NetworkController, error) {
+	if err := config.ProcessPoolsConfig(); err != nil {
+		return nil, err
+	}
+
 	netOptions, err := daemon.networkOptions(config, daemon.PluginStore, activeSandboxes)
 	if err != nil {
 		return nil, err
diff --git a/docs/reference/commandline/dockerd.md b/docs/reference/commandline/dockerd.md
index 92b9349a417..e05f26ee495 100644
--- a/docs/reference/commandline/dockerd.md
+++ b/docs/reference/commandline/dockerd.md
@@ -34,6 +34,7 @@ Options:
       --config-file string                    Daemon configuration file (default "/etc/docker/daemon.json")
       --containerd string                     Path to containerd socket
   -D, --debug                                 Enable debug mode
+      --default-address-pools value           Set the default address pools for local/global scope networks
       --default-gateway value                 Container default gateway IPv4 address
       --default-gateway-v6 value              Container default gateway IPv6 address
       --default-runtime string                Default OCI runtime for containers (default "runc")
diff --git a/integration-cli/docker_cli_daemon_test.go b/integration-cli/docker_cli_daemon_test.go
index b7f8f0a5426..2090c436a08 100644
--- a/integration-cli/docker_cli_daemon_test.go
+++ b/integration-cli/docker_cli_daemon_test.go
@@ -944,6 +944,36 @@ func (s *DockerDaemonSuite) TestDaemonLinksIpTablesRulesWhenLinkAndUnlink(c *che
 	s.d.Cmd("kill", "parent")
 }
 
+func (s *DockerDaemonSuite) TestDaemonNetworkPools(c *check.C) {
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
+
+	// Remove docker0 bridge and the start daemon defining the predefined address pools
+	defaultNetworkBridge := "docker0"
+	deleteInterface(c, defaultNetworkBridge)
+	s.d.Start(c,
+		"--default-address-pools", "scope=local,base=175.30.0.0/16,size=16",
+		"--default-address-pools", "scope=local,base=175.33.0.0/16,size=24")
+
+	// Verify bridge network's subnet
+	out, err := s.d.Cmd("network", "inspect", "--format", "'{{.IPAM.Config}}'", "bridge")
+	c.Assert(err, check.IsNil)
+	c.Assert(out, checker.Contains, "175.30.0.0/16")
+
+	// Create a bridge network and verify its subnet is the second default pool
+	_, err = s.d.Cmd("network", "create", "nw100")
+	c.Assert(err, check.IsNil)
+	out, err = s.d.Cmd("network", "inspect", "--format", "'{{.IPAM.Config}}'", "nw100")
+	c.Assert(err, check.IsNil)
+	c.Assert(out, checker.Contains, "175.33.0.0/24")
+
+	// Create a bridge network and verify its subnet is the third default pool
+	_, err = s.d.Cmd("network", "create", "nw101")
+	c.Assert(err, check.IsNil)
+	out, err = s.d.Cmd("network", "inspect", "--format", "'{{.IPAM.Config}}'", "nw101")
+	c.Assert(err, check.IsNil)
+	c.Assert(out, checker.Contains, "175.33.1.0/24")
+}
+
 func (s *DockerDaemonSuite) TestDaemonUlimitDefaults(c *check.C) {
 	testRequires(c, DaemonIsLinux)
 
diff --git a/man/dockerd.8.md b/man/dockerd.8.md
index 56408089d4c..c573cc87bac 100644
--- a/man/dockerd.8.md
+++ b/man/dockerd.8.md
@@ -18,6 +18,7 @@ dockerd - Enable daemon mode
 [**--config-file**[=*/etc/docker/daemon.json*]]
 [**--containerd**[=*SOCKET-PATH*]]
 [**-D**|**--debug**]
+[**--default-address-pools**[=*DEFAULT-ADDRESS-POOLS*]]
 [**--default-gateway**[=*DEFAULT-GATEWAY*]]
 [**--default-gateway-v6**[=*DEFAULT-GATEWAY-V6*]]
 [**--default-runtime**[=*runc*]]
@@ -155,6 +156,11 @@ $ sudo dockerd --add-runtime runc=runc --add-runtime custom=/usr/local/bin/my-ru
 **-D**, **--debug**=*true*|*false*
   Enable debug mode. Default is false.
 
+**--default-address-pools**=""
+  Default address pools from which IPAM driver selects a subnet for the networks.
+  Example: scope=[local|global],base=172.30.0.0/16,size=24 will set the default
+  address pools for the selected scope networks to {172.30.[0-255].0/24}
+
 **--default-gateway**=""
   IPv4 address of the container default gateway; this address must be part of
   the bridge subnet (which is defined by \-b or \--bip)
diff --git a/opts/address_pools.go b/opts/address_pools.go
new file mode 100644
index 00000000000..30e4a0a051a
--- /dev/null
+++ b/opts/address_pools.go
@@ -0,0 +1,84 @@
+package opts
+
+import (
+	"encoding/csv"
+	"fmt"
+	"strconv"
+	"strings"
+
+	types "github.com/docker/libnetwork/ipamutils"
+)
+
+// PoolsOpt is a Value type for parsing the default address pools definitions
+type PoolsOpt struct {
+	values *[]*types.PredefinedPools
+}
+
+// NewPoolsOpt creates a new PoolsOpt
+func NewPoolsOpt(ref *[]*types.PredefinedPools) *PoolsOpt {
+	return &PoolsOpt{values: ref}
+}
+
+// Set predefined pools
+func (p *PoolsOpt) Set(value string) error {
+	csvReader := csv.NewReader(strings.NewReader(value))
+	fields, err := csvReader.Read()
+	if err != nil {
+		return err
+	}
+
+	poolsDef := types.PredefinedPools{}
+
+	for _, field := range fields {
+		parts := strings.SplitN(field, "=", 2)
+		if len(parts) != 2 {
+			return fmt.Errorf("ninvalid field '%s' must be a key=value pair", field)
+		}
+
+		key := strings.ToLower(parts[0])
+		value := strings.ToLower(parts[1])
+
+		switch key {
+		case "scope":
+			poolsDef.Scope = value
+		case "base":
+			poolsDef.Base = value
+		case "size":
+			size, err := strconv.Atoi(value)
+			if err != nil {
+				return fmt.Errorf("invalid size value: %q (must be integer): %v", value, err)
+			}
+			poolsDef.Size = size
+		default:
+			return fmt.Errorf("unexpected key '%s' in '%s'", key, field)
+		}
+	}
+
+	*p.values = append(*p.values, &poolsDef)
+
+	return nil
+}
+
+// Type returns the type of this option
+func (p *PoolsOpt) Type() string {
+	return "default-address-pools"
+}
+
+// String returns a string repr of this option
+func (p *PoolsOpt) String() string {
+	pools := []string{}
+	for _, pool := range *p.values {
+		repr := fmt.Sprintf("%s %s %s", pool.Scope, pool.Base, pool.Size)
+		pools = append(pools, repr)
+	}
+	return strings.Join(pools, ", ")
+}
+
+// Value returns the mounts
+func (p *PoolsOpt) Value() []*types.PredefinedPools {
+	var pd []*types.PredefinedPools
+	for _, p := range *p.values {
+		pd = append(pd, p)
+	}
+	return pd
+}