{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/30766","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/30766/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/30766/comments","events_url":"https://api.github.com/repos/docker/docker/issues/30766/events","html_url":"https://github.com/docker/docker/issues/30766","id":205628433,"number":30766,"title":"[DOCKER SWARM 1.13]Docker overlay not working with encryption","user":{"login":"fabio-barile","id":10850206,"avatar_url":"https://avatars2.githubusercontent.com/u/10850206?v=3","gravatar_id":"","url":"https://api.github.com/users/fabio-barile","html_url":"https://github.com/fabio-barile","followers_url":"https://api.github.com/users/fabio-barile/followers","following_url":"https://api.github.com/users/fabio-barile/following{/other_user}","gists_url":"https://api.github.com/users/fabio-barile/gists{/gist_id}","starred_url":"https://api.github.com/users/fabio-barile/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fabio-barile/subscriptions","organizations_url":"https://api.github.com/users/fabio-barile/orgs","repos_url":"https://api.github.com/users/fabio-barile/repos","events_url":"https://api.github.com/users/fabio-barile/events{/privacy}","received_events_url":"https://api.github.com/users/fabio-barile/received_events","type":"User","site_admin":false},"labels":[{"id":237472034,"url":"https://api.github.com/repos/docker/docker/labels/area/networking","name":"area/networking","color":"fbca04","default":false},{"id":392678049,"url":"https://api.github.com/repos/docker/docker/labels/area/swarm","name":"area/swarm","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2017-02-06T15:58:07Z","updated_at":"2017-03-09T15:52:30Z","closed_at":null,"body":"**Description**\r\nHi,\r\nwe are now evaluating the impact of docker 1.13 over our  application \r\nOur application is composed of several nodejs microservices and mongodb in replicaset mode.\r\nFor this evaluation we are executing some load tests, simulating 1400 concurrent users.\r\nEverything worked fine until we enabled the encryption of the overlay network :(\r\nit seems that services are not able to reach each other anymore!\r\n\r\nTo make it easier to debug for you, we have found a simple way to reproduce the issue\r\n\r\n**Steps to reproduce the issue:**\r\n1. create 2 networks overlay ; one with encryption enabled and the second one without the encryption:\r\n```\r\ndocker network create --driver overlay  --subnet 192.168.1.0/24 --attachable --opt encrypted encrypted_network\r\ndocker network create --driver overlay  --subnet 192.168.1.0/24 --attachable clear_network\r\n```\r\n2. create a image using the following docker file:\r\n\r\n```\r\nFROM ubuntu:14.04\r\nRUN apt-get update\r\nRUN apt-get -y install wget\r\n```\r\n\r\n3. Deploy the image on 2 different hosts using the not encrypted network with the command : \r\n`docker run --network clear_network -t -i <IMAGE_NAME> /bin/bash\r\n`\r\n4. start a netcat server listening on port 12345 in one of the containers : \r\n`nc -l 12345`\r\n\r\n5. Send text using netcat from the second container using the command : \r\n` echo \"some text\"| nc 192.168.1.3 12345`\r\nThe IP is the one of the first container\r\n\r\n6. The text is sent from the second to the first container.\r\nIf you repeat these steps using the encrypted overlay network it will not work :(\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/285390831","html_url":"https://github.com/docker/docker/issues/30766#issuecomment-285390831","issue_url":"https://api.github.com/repos/docker/docker/issues/30766","id":285390831,"user":{"login":"fabio-barile","id":10850206,"avatar_url":"https://avatars2.githubusercontent.com/u/10850206?v=3","gravatar_id":"","url":"https://api.github.com/users/fabio-barile","html_url":"https://github.com/fabio-barile","followers_url":"https://api.github.com/users/fabio-barile/followers","following_url":"https://api.github.com/users/fabio-barile/following{/other_user}","gists_url":"https://api.github.com/users/fabio-barile/gists{/gist_id}","starred_url":"https://api.github.com/users/fabio-barile/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fabio-barile/subscriptions","organizations_url":"https://api.github.com/users/fabio-barile/orgs","repos_url":"https://api.github.com/users/fabio-barile/repos","events_url":"https://api.github.com/users/fabio-barile/events{/privacy}","received_events_url":"https://api.github.com/users/fabio-barile/received_events","type":"User","site_admin":false},"created_at":"2017-03-09T15:52:30Z","updated_at":"2017-03-09T15:52:30Z","body":"Hi Guys,\r\n\r\nThanks to you comments, we have used tcpdump to track the headers of the ESP requests and we have found a configuration issue due to our infrastructure.\r\nNow ALMOST all our servers are able to communicate through an encrypted network ovelay exected 1.\r\n\r\nContainers running in this servers are not pingable in the encrypted networks\r\nBy checking the iptables it seems that all packets are DROPPED by the last rule:\r\n\r\n\r\n\r\n\tChain INPUT (policy ACCEPT 135K packets, 18M bytes)\r\n\t pkts bytes target     prot opt in     out     source               destination\r\n\t 7024 2619K ACCEPT     udp  --  any    any     anywhere             anywhere             udp dpt:7946\r\n\t 1636 5720K ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:7946\r\n\t\t0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:2377\r\n\t\t0     0 ACCEPT     esp  --  any    any     anywhere             anywhere\r\n\t\t0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             policy match dir in pol ipsec udp dpt:4789 u32 \"0x0>>0x16&0x3c@0xc&0xffffff00=0x100100\"\r\n\t  802  107K DROP       udp  --  any    any     anywhere             anywhere             udp dpt:4789 u32 \"0x0>>0x16&0x3c@0xc&0xffffff00=0x100100\"\r\n\r\n\r\nbelow is the tcpdump trace of the packect sent over UDP 4789:\r\n\r\n\troot@mo-d75c773c8-mongodb-2:~# sudo tcpdump -i eth0 -X  -s 0  -vv  udp  port 4789\r\n\ttcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes\r\n\t15:22:07.626069 IP (tos 0x0, ttl 64, id 11381, offset 0, flags [none], proto UDP (17), length 134)\r\n\t\tmo-811134400.mo.sap.corp.54062 > mo-d75c773c8.mo.sap.corp.4789: [no cksum] VXLAN, flags [I] (0x08), vni 4097\r\n\tIP (tos 0x0, ttl 64, id 63538, offset 0, flags [DF], proto ICMP (1), length 84)\r\n\t\t192.168.2.72 > 192.168.2.44: ICMP echo request, id 512, seq 1, length 64\r\n\t\t\t0x0000:  4500 0086 2c75 0000 4011 8da6 0a61 4eef  E...,u..@....aN.\r\n\t\t\t0x0010:  0a61 5c9b d32e 12b5 0072 0000 0800 0000  .a\\......r......\r\n\t\t\t0x0020:  0010 0100 0242 c0a8 022c 0242 c0a8 0248  .....B...,.B...H\r\n\t\t\t0x0030:  0800 4500 0054 f832 4000 4001 bcb1 c0a8  ..E..T.2@.@.....\r\n\t\t\t0x0040:  0248 c0a8 022c 0800 d6cd 0200 0001 2073  .H...,.........s\r\n\t\t\t0x0050:  c158 0000 0000 7b92 0300 0000 0000 1011  .X....{.........\r\n\t\t\t0x0060:  1213 1415 1617 1819 1a1b 1c1d 1e1f 2021  ...............!\r\n\t\t\t0x0070:  2223 2425 2627 2829 2a2b 2c2d 2e2f 3031  \"#$%&'()*+,-./01\r\n\t\t\t0x0080:  3233 3435 3637                           234567\r\n\t15:22:08.634833 IP (tos 0x0, ttl 64, id 11584, offset 0, flags [none], proto UDP (17), length 134)\r\n\t\tmo-811134400.mo.sap.corp.54062 > mo-d75c773c8.mo.sap.corp.4789: [no cksum] VXLAN, flags [I] (0x08), vni 4097\r\n\tIP (tos 0x0, ttl 64, id 63611, offset 0, flags [DF], proto ICMP (1), length 84)\r\n\t\t192.168.2.72 > 192.168.2.44: ICMP echo request, id 512, seq 2, length 64\r\n\t\t\t0x0000:  4500 0086 2d40 0000 4011 8cdb 0a61 4eef  E...-@..@....aN.\r\n\t\t\t0x0010:  0a61 5c9b d32e 12b5 0072 0000 0800 0000  .a\\......r......\r\n\t\t\t0x0020:  0010 0100 0242 c0a8 022c 0242 c0a8 0248  .....B...,.B...H\r\n\t\t\t0x0030:  0800 4500 0054 f87b 4000 4001 bc68 c0a8  ..E..T.{@.@..h..\r\n\t\t\t0x0040:  0248 c0a8 022c 0800 efa9 0200 0002 2173  .H...,........!s\r\n\t\t\t0x0050:  c158 0000 0000 61b5 0300 0000 0000 1011  .X....a.........\r\n\t\t\t0x0060:  1213 1415 1617 1819 1a1b 1c1d 1e1f 2021  ...............!\r\n\t\t\t0x0070:  2223 2425 2627 2829 2a2b 2c2d 2e2f 3031  \"#$%&'()*+,-./01\r\n\t\t\t0x0080:  3233 3435 3637                           234567\r\n\t15:22:09.642817 IP (tos 0x0, ttl 64, id 11689, offset 0, flags [none], proto UDP (17), length 134)\r\n\t\tmo-811134400.mo.sap.corp.54062 > mo-d75c773c8.mo.sap.corp.4789: [no cksum] VXLAN, flags [I] (0x08), vni 4097\r\n\tIP (tos 0x0, ttl 64, id 63823, offset 0, flags [DF], proto ICMP (1), length 84)\r\n\t\t192.168.2.72 > 192.168.2.44: ICMP echo request, id 512, seq 3, length 64\r\n\t\t\t0x0000:  4500 0086 2da9 0000 4011 8c72 0a61 4eef  E...-...@..r.aN.\r\n\t\t\t0x0010:  0a61 5c9b d32e 12b5 0072 0000 0800 0000  .a\\......r......\r\n\t\t\t0x0020:  0010 0100 0242 c0a8 022c 0242 c0a8 0248  .....B...,.B...H\r\n\t\t\t0x0030:  0800 4500 0054 f94f 4000 4001 bb94 c0a8  ..E..T.O@.@.....\r\n\t\t\t0x0040:  0248 c0a8 022c 0800 c889 0200 0003 2273  .H...,........\"s\r\n\t\t\t0x0050:  c158 0000 0000 87d4 0300 0000 0000 1011  .X..............\r\n\t\t\t0x0060:  1213 1415 1617 1819 1a1b 1c1d 1e1f 2021  ...............!\r\n\t\t\t0x0070:  2223 2425 2627 2829 2a2b 2c2d 2e2f 3031  \"#$%&'()*+,-./01\r\n\t\t\t0x0080:  3233 3435 3637                           234567\r\n\t15:22:10.651124 IP (tos 0x0, ttl 64, id 11791, offset 0, flags [none], proto UDP (17), length 134)\r\n\t\tmo-811134400.mo.sap.corp.54062 > mo-d75c773c8.mo.sap.corp.4789: [no cksum] VXLAN, flags [I] (0x08), vni 4097\r\n\tIP (tos 0x0, ttl 64, id 63979, offset 0, flags [DF], proto ICMP (1), length 84)\r\n\t\t192.168.2.72 > 192.168.2.44: ICMP echo request, id 512, seq 4, length 64\r\n\t\t\t0x0000:  4500 0086 2e0f 0000 4011 8c0c 0a61 4eef  E.......@....aN.\r\n\t\t\t0x0010:  0a61 5c9b d32e 12b5 0072 0000 0800 0000  .a\\......r......\r\n\t\t\t0x0020:  0010 0100 0242 c0a8 022c 0242 c0a8 0248  .....B...,.B...H\r\n\t\t\t0x0030:  0800 4500 0054 f9eb 4000 4001 baf8 c0a8  ..E..T..@.@.....\r\n\t\t\t0x0040:  0248 c0a8 022c 0800 6e69 0200 0004 2373  .H...,..ni....#s\r\n\t\t\t0x0050:  c158 0000 0000 e0f3 0300 0000 0000 1011  .X..............\r\n\t\t\t0x0060:  1213 1415 1617 1819 1a1b 1c1d 1e1f 2021  ...............!\r\n\t\t\t0x0070:  2223 2425 2627 2829 2a2b 2c2d 2e2f 3031  \"#$%&'()*+,-./01\r\n\t\t\t0x0080:  3233 3435 3637                           234567\r\n\r\n\r\n\r\n\r\nCould you please ,e xplain me what is the purpose of this iptable rule?\r\nDo you have an idea why our packets are rejected by this rule ?\r\nThanks in advance\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n "}}
{"actor":{"display_login":"fabio-barile"}}