Filter out ipv6 port forwards when an ipv6 default route doesn't exist

[lattwood]

edit: Didn't intend to open this yet.

Summary

Implementation details

Testing

New tests cover the changes:

Description for the changelog

Licensing

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[sparrc]

Hello, could you please describe this PR in more detail, and what is the use case for this?

If I understand correctly, is this happening because you are using a task in awsvpc network mode, and your VPC has ipv6 enabled but you have disabled or deleted the default ipv6 route via the route table of that VPC? If this is the case, could you explain what is the use-case of having a VPC with ipv6 enabled but all of the ipv6 routes deleted?

[lattwood]

@sparrc this is to prevent duplicate task registration in the ECS API, as ECS registers the task for every port forward. On the latest version of docker they return ipv6 port forwards even when there’s no ipv6 connectivity on the host.

In our case we have ipv6 disabled at the vpc layer, but it still tries to contact the host on the ipv6 port but the ipv4 address.

[lattwood]

This happens with the nat networking mode as well.

[sparrc]

by "latest version of docker" which version do you mean? could you provide some steps to reproduce?

[lattwood]

20.10.6 That will allow you to reproduce the double registration issue. Docker using a different ipv4 and ipv6 port on the host when exposing the container port I don’t have reproduction for. It would happen on 1/60 ECS nodes.

…

On Thu, May 13, 2021 at 17:46 Cameron Sparr ***@***.***> wrote: by "latest version of docker" which version do you mean? could you provide some steps to reproduce? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#2855 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABPJNKFMXDSQ6ZHAHW2ZODTTNQ3CTANCNFSM43VMI7UQ> .

[sparrc]

@lattwood can you confirm that this is the same issue as moby/moby#42288? Looks like docker is going to fix this in 20.10.7 so we probably want to hold off on any ECS workarounds, see PR in progress moby/moby#42322

[lattwood]

It’s related in the sense that the change caused multiple regressions.

…

On Thu, May 20, 2021 at 14:54 Cameron Sparr ***@***.***> wrote: @lattwood <https://github.com/lattwood> can you confirm that this is the same issue as moby/moby#42288 <moby/moby#42288>? Looks like docker is going to fix this in 20.10.7 so we probably want to hold off on any ECS workarounds, see PR in progress moby/moby#42322 <moby/moby#42322> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2855 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABPJNKER5WDUWH7MAUCOILTTOVEETANCNFSM43VMI7UQ> .

[chienhanlin]

Hello @lattwood ,
A follow-up for the fix mentioned in @sparrc 's comment. The PR fix port forwarding with ipv6.disable=1 #2635 was merged to moby/moby repo, and is included in the 20.10.7 Docker Engine release notes. Could you take a look and see if the issue you have encountered can be resolved? If not, could you provide summary, implementation details and testing on this PR? Thank you.

[chienhanlin]

Close this PR as the fix is available since ECS Agent 1.55.3 https://github.com/aws/amazon-ecs-agent/releases/tag/v1.55.3.

In addition, we are working on a related issue #3096 to differentiate between IPV4/IPV6 Port Mappings.

Please feel free to create PRs or issues if you would like to share any suggestion with us. Thanks.