@@ -3,7 +3,7 @@

 # LIBNETWORK_COMMIT is used to build the docker-userland-proxy binary. When

 # updating the binary version, consider updating github.com/docker/libnetwork

 # in vendor.conf accordingly

-: "${LIBNETWORK_COMMIT:=d0951081b35fa4216fc4f0064bf065beeb55a74b}"

+: "${LIBNETWORK_COMMIT:=d511c60c5c23e6753631244f271a1ec6097254a5}"

 install_proxy() {

 	case "$1" in

@@ -40,7 +40,7 @@ github.com/grpc-ecosystem/go-grpc-middleware        3c51f7f332123e8be5a157c0802a

 # libnetwork

 # When updating, also update LIBNETWORK_COMMIT in hack/dockerfile/install/proxy.installer accordingly

-github.com/docker/libnetwork                        d0951081b35fa4216fc4f0064bf065beeb55a74b

+github.com/docker/libnetwork                        d511c60c5c23e6753631244f271a1ec6097254a5 

 github.com/docker/go-events                         e31b211e4f1cd09aa76fe4ac244571fab96ae47f

 github.com/armon/go-radix                           e39d623f12e8e41c7b5529e9a9dd67a1e2261f80

 github.com/armon/go-metrics                         eb0af217e5e9747e41dd5303755356b62d28e3ec

@@ -57,6 +57,7 @@ type iptablesCleanFuncs []iptableCleanFunc

 type configuration struct {

 	EnableIPForwarding  bool

 	EnableIPTables      bool

+	EnableIP6Tables     bool

 	EnableUserlandProxy bool

 	UserlandProxyPath   string

 }

@@ -133,22 +134,27 @@ type bridgeNetwork struct {

 	config        *networkConfiguration

 	endpoints     map[string]*bridgeEndpoint // key: endpoint id

 	portMapper    *portmapper.PortMapper

+	portMapperV6  *portmapper.PortMapper

 	driver        *driver // The network's driver

 	iptCleanFuncs iptablesCleanFuncs

 	sync.Mutex

 }

 type driver struct {

-	config          *configuration

-	network         *bridgeNetwork

-	natChain        *iptables.ChainInfo

-	filterChain     *iptables.ChainInfo

-	isolationChain1 *iptables.ChainInfo

-	isolationChain2 *iptables.ChainInfo

-	networks        map[string]*bridgeNetwork

-	store           datastore.DataStore

-	nlh             *netlink.Handle

-	configNetwork   sync.Mutex

+	config            *configuration

+	network           *bridgeNetwork

+	natChain          *iptables.ChainInfo

+	filterChain       *iptables.ChainInfo

+	isolationChain1   *iptables.ChainInfo

+	isolationChain2   *iptables.ChainInfo

+	natChainV6        *iptables.ChainInfo

+	filterChainV6     *iptables.ChainInfo

+	isolationChain1V6 *iptables.ChainInfo

+	isolationChain2V6 *iptables.ChainInfo

+	networks          map[string]*bridgeNetwork

+	store             datastore.DataStore

+	nlh               *netlink.Handle

+	configNetwork     sync.Mutex

 	sync.Mutex

 }

@@ -277,7 +283,7 @@ func (n *bridgeNetwork) registerIptCleanFunc(clean iptableCleanFunc) {

 	n.iptCleanFuncs = append(n.iptCleanFuncs, clean)

 }

-func (n *bridgeNetwork) getDriverChains() (*iptables.ChainInfo, *iptables.ChainInfo, *iptables.ChainInfo, *iptables.ChainInfo, error) {

+func (n *bridgeNetwork) getDriverChains(version iptables.IPVersion) (*iptables.ChainInfo, *iptables.ChainInfo, *iptables.ChainInfo, *iptables.ChainInfo, error) {

 	n.Lock()

 	defer n.Unlock()

@@ -285,6 +291,10 @@ func (n *bridgeNetwork) getDriverChains() (*iptables.ChainInfo, *iptables.ChainI

 		return nil, nil, nil, nil, types.BadRequestErrorf("no driver found")

 	}

+	if version == iptables.IPv6 {

+		return n.driver.natChainV6, n.driver.filterChainV6, n.driver.isolationChain1V6, n.driver.isolationChain2V6, nil

+	}

+

 	return n.driver.natChain, n.driver.filterChain, n.driver.isolationChain1, n.driver.isolationChain2, nil

 }

@@ -323,17 +333,31 @@ func (n *bridgeNetwork) isolateNetwork(others []*bridgeNetwork, enable bool) err

 	}

 	// Install the rules to isolate this network against each of the other networks

-	return setINC(thisConfig.BridgeName, enable)

+	if n.driver.config.EnableIP6Tables {

+		err := setINC(iptables.IPv6, thisConfig.BridgeName, enable)

+		if err != nil {

+			return err

+		}

+	}

+

+	if n.driver.config.EnableIPTables {

+		return setINC(iptables.IPv4, thisConfig.BridgeName, enable)

+	}

+	return nil

 }

 func (d *driver) configure(option map[string]interface{}) error {

 	var (

-		config          *configuration

-		err             error

-		natChain        *iptables.ChainInfo

-		filterChain     *iptables.ChainInfo

-		isolationChain1 *iptables.ChainInfo

-		isolationChain2 *iptables.ChainInfo

+		config            *configuration

+		err               error

+		natChain          *iptables.ChainInfo

+		filterChain       *iptables.ChainInfo

+		isolationChain1   *iptables.ChainInfo

+		isolationChain2   *iptables.ChainInfo

+		natChainV6        *iptables.ChainInfo

+		filterChainV6     *iptables.ChainInfo

+		isolationChain1V6 *iptables.ChainInfo

+		isolationChain2V6 *iptables.ChainInfo

 	)

 	genericData, ok := option[netlabel.GenericData]

@@ -354,23 +378,46 @@ func (d *driver) configure(option map[string]interface{}) error {

 		return &ErrInvalidDriverConfig{}

 	}

-	if config.EnableIPTables {

+	if config.EnableIPTables || config.EnableIP6Tables {

 		if _, err := os.Stat("/proc/sys/net/bridge"); err != nil {

 			if out, err := exec.Command("modprobe", "-va", "bridge", "br_netfilter").CombinedOutput(); err != nil {

 				logrus.Warnf("Running modprobe bridge br_netfilter failed with message: %s, error: %v", out, err)

 			}

 		}

-		removeIPChains()

-		natChain, filterChain, isolationChain1, isolationChain2, err = setupIPChains(config)

+	}

+

+	if config.EnableIPTables {

+		removeIPChains(iptables.IPv4)

+

+		natChain, filterChain, isolationChain1, isolationChain2, err = setupIPChains(config, iptables.IPv4)

+		if err != nil {

+			return err

+		}

+

+		// Make sure on firewall reload, first thing being re-played is chains creation

+		iptables.OnReloaded(func() {

+			logrus.Debugf("Recreating iptables chains on firewall reload")

+			setupIPChains(config, iptables.IPv4)

+		})

+	}

+

+	if config.EnableIP6Tables {

+		removeIPChains(iptables.IPv6)

+

+		natChainV6, filterChainV6, isolationChain1V6, isolationChain2V6, err = setupIPChains(config, iptables.IPv6)

 		if err != nil {

 			return err

 		}

+

 		// Make sure on firewall reload, first thing being re-played is chains creation

-		iptables.OnReloaded(func() { logrus.Debugf("Recreating iptables chains on firewall reload"); setupIPChains(config) })

+		iptables.OnReloaded(func() {

+			logrus.Debugf("Recreating ip6tables chains on firewall reload")

+			setupIPChains(config, iptables.IPv6)

+		})

 	}

 	if config.EnableIPForwarding {

-		err = setupIPForwarding(config.EnableIPTables)

+		err = setupIPForwarding(config.EnableIPTables, config.EnableIP6Tables)

 		if err != nil {

 			logrus.Warn(err)

 			return err

@@ -382,6 +429,10 @@ func (d *driver) configure(option map[string]interface{}) error {

 	d.filterChain = filterChain

 	d.isolationChain1 = isolationChain1

 	d.isolationChain2 = isolationChain2

+	d.natChainV6 = natChainV6

+	d.filterChainV6 = filterChainV6

+	d.isolationChain1V6 = isolationChain1V6

+	d.isolationChain2V6 = isolationChain2V6

 	d.config = config

 	d.Unlock()

@@ -644,12 +695,13 @@ func (d *driver) createNetwork(config *networkConfiguration) (err error) {

 	// Create and set network handler in driver

 	network := &bridgeNetwork{

-		id:         config.ID,

-		endpoints:  make(map[string]*bridgeEndpoint),

-		config:     config,

-		portMapper: portmapper.New(d.config.UserlandProxyPath),

-		bridge:     bridgeIface,

-		driver:     d,

+		id:           config.ID,

+		endpoints:    make(map[string]*bridgeEndpoint),

+		config:       config,

+		portMapper:   portmapper.New(d.config.UserlandProxyPath),

+		portMapperV6: portmapper.New(d.config.UserlandProxyPath),

+		bridge:       bridgeIface,

+		driver:       d,

 	}

 	d.Lock()

@@ -724,11 +776,16 @@ func (d *driver) createNetwork(config *networkConfiguration) (err error) {

 		{!d.config.EnableUserlandProxy, setupLoopbackAddressesRouting},

 		// Setup IPTables.

-		{d.config.EnableIPTables, network.setupIPTables},

+		{d.config.EnableIPTables, network.setupIP4Tables},

+

+		// Setup IP6Tables.

+		{d.config.EnableIP6Tables, network.setupIP6Tables},

 		//We want to track firewalld configuration so that

 		//if it is started/reloaded, the rules can be applied correctly

 		{d.config.EnableIPTables, network.setupFirewalld},

+		// same for IPv6

+		{d.config.EnableIP6Tables, network.setupFirewalld6},

 		// Setup DefaultGatewayIPv4

 		{config.DefaultGatewayIPv4 != nil, setupGatewayIPv4},

@@ -12,7 +12,8 @@ import (

 )

 var (

-	defaultBindingIP = net.IPv4(0, 0, 0, 0)

+	defaultBindingIP   = net.IPv4(0, 0, 0, 0)

+	defaultBindingIPV6 = net.ParseIP("::")

 )

 func (n *bridgeNetwork) allocatePorts(ep *bridgeEndpoint, reqDefBindIP net.IP, ulPxyEnabled bool) ([]types.PortBinding, error) {

@@ -25,7 +26,25 @@ func (n *bridgeNetwork) allocatePorts(ep *bridgeEndpoint, reqDefBindIP net.IP, u

 		defHostIP = reqDefBindIP

 	}

-	return n.allocatePortsInternal(ep.extConnConfig.PortBindings, ep.addr.IP, defHostIP, ulPxyEnabled)

+	// IPv4 port binding including user land proxy

+	pb, err := n.allocatePortsInternal(ep.extConnConfig.PortBindings, ep.addr.IP, defHostIP, ulPxyEnabled)

+	if err != nil {

+		return nil, err

+	}

+

+	// IPv6 port binding excluding user land proxy

+	if n.driver.config.EnableIP6Tables && ep.addrv6 != nil {

+		// TODO IPv6 custom default binding IP

+		pbv6, err := n.allocatePortsInternal(ep.extConnConfig.PortBindings, ep.addrv6.IP, defaultBindingIPV6, false)

+		if err != nil {

+			// ensure we clear the previous allocated IPv4 ports

+			n.releasePortsInternal(pb)

+			return nil, err

+		}

+

+		pb = append(pb, pbv6...)

+	}

+	return pb, nil

 }

 func (n *bridgeNetwork) allocatePortsInternal(bindings []types.PortBinding, containerIP, defHostIP net.IP, ulPxyEnabled bool) ([]types.PortBinding, error) {

@@ -69,9 +88,15 @@ func (n *bridgeNetwork) allocatePort(bnd *types.PortBinding, containerIP, defHos

 		return err

 	}

+	portmapper := n.portMapper

+

+	if containerIP.To4() == nil {

+		portmapper = n.portMapperV6

+	}

+

 	// Try up to maxAllocatePortAttempts times to get a port that's not already allocated.

 	for i := 0; i < maxAllocatePortAttempts; i++ {

-		if host, err = n.portMapper.MapRange(container, bnd.HostIP, int(bnd.HostPort), int(bnd.HostPortEnd), ulPxyEnabled); err == nil {

+		if host, err = portmapper.MapRange(container, bnd.HostIP, int(bnd.HostPort), int(bnd.HostPortEnd), ulPxyEnabled); err == nil {

 			break

 		}

 		// There is no point in immediately retrying to map an explicitly chosen port.

@@ -128,5 +153,12 @@ func (n *bridgeNetwork) releasePort(bnd types.PortBinding) error {

 	if err != nil {

 		return err

 	}

-	return n.portMapper.Unmap(host)

+

+	portmapper := n.portMapper

+

+	if bnd.HostIP.To4() == nil {

+		portmapper = n.portMapperV6

+	}

+

+	return portmapper.Unmap(host)

 }

@@ -13,8 +13,23 @@ func (n *bridgeNetwork) setupFirewalld(config *networkConfiguration, i *bridgeIn

 		return IPTableCfgError(config.BridgeName)

 	}

-	iptables.OnReloaded(func() { n.setupIPTables(config, i) })

+	iptables.OnReloaded(func() { n.setupIP4Tables(config, i) })

 	iptables.OnReloaded(n.portMapper.ReMapAll)

+	return nil

+}

+

+func (n *bridgeNetwork) setupFirewalld6(config *networkConfiguration, i *bridgeInterface) error {

+	d := n.driver

+	d.Lock()

+	driverConfig := d.config

+	d.Unlock()

+

+	// Sanity check.

+	if !driverConfig.EnableIP6Tables {

+		return IPTableCfgError(config.BridgeName)

+	}

+	iptables.OnReloaded(func() { n.setupIP6Tables(config, i) })

+	iptables.OnReloaded(n.portMapperV6.ReMapAll)

 	return nil

 }

@@ -21,7 +21,7 @@ func configureIPForwarding(enable bool) error {

 	return ioutil.WriteFile(ipv4ForwardConf, []byte{val, '\n'}, ipv4ForwardConfPerm)

 }

-func setupIPForwarding(enableIPTables bool) error {

+func setupIPForwarding(enableIPTables bool, enableIP6Tables bool) error {

 	// Get current IPv4 forward setup

 	ipv4ForwardData, err := ioutil.ReadFile(ipv4ForwardConf)

 	if err != nil {

@@ -36,21 +36,36 @@ func setupIPForwarding(enableIPTables bool) error {

 		}

 		// When enabling ip_forward set the default policy on forward chain to

 		// drop only if the daemon option iptables is not set to false.

-		if !enableIPTables {

-			return nil

-		}

-		if err := iptables.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {

-			if err := configureIPForwarding(false); err != nil {

-				logrus.Errorf("Disabling IP forwarding failed, %v", err)

+		if enableIPTables {

+			iptable := iptables.GetIptable(iptables.IPv4)

+			if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {

+				if err := configureIPForwarding(false); err != nil {

+					logrus.Errorf("Disabling IP forwarding failed, %v", err)

+				}

+				return err

 			}

-			return err

+			iptables.OnReloaded(func() {

+				logrus.Debug("Setting the default DROP policy on firewall reload")

+				if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {

+					logrus.Warnf("Setting the default DROP policy on firewall reload failed, %v", err)

+				}

+			})

+		}

+	}

+

+	// add only iptables rules - forwarding is handled by setupIPv6Forwarding in setup_ipv6

+	if enableIP6Tables {

+		iptable := iptables.GetIptable(iptables.IPv6)

+		if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {

+			logrus.Warnf("Setting the default DROP policy on firewall reload failed, %v", err)

 		}

 		iptables.OnReloaded(func() {

 			logrus.Debug("Setting the default DROP policy on firewall reload")

-			if err := iptables.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {

+			if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {

 				logrus.Warnf("Setting the default DROP policy on firewall reload failed, %v", err)

 			}

 		})

 	}

+

 	return nil

 }

@@ -26,7 +26,7 @@ const (

 	IsolationChain2 = "DOCKER-ISOLATION-STAGE-2"

 )

-func setupIPChains(config *configuration) (*iptables.ChainInfo, *iptables.ChainInfo, *iptables.ChainInfo, *iptables.ChainInfo, error) {

+func setupIPChains(config *configuration, version iptables.IPVersion) (*iptables.ChainInfo, *iptables.ChainInfo, *iptables.ChainInfo, *iptables.ChainInfo, error) {

 	// Sanity check.

 	if config.EnableIPTables == false {

 		return nil, nil, nil, nil, errors.New("cannot create new chains, EnableIPTable is disabled")

@@ -34,129 +34,157 @@ func setupIPChains(config *configuration) (*iptables.ChainInfo, *iptables.ChainI

 	hairpinMode := !config.EnableUserlandProxy

-	natChain, err := iptables.NewChain(DockerChain, iptables.Nat, hairpinMode)

+	iptable := iptables.GetIptable(version)

+

+	natChain, err := iptable.NewChain(DockerChain, iptables.Nat, hairpinMode)

 	if err != nil {

 		return nil, nil, nil, nil, fmt.Errorf("failed to create NAT chain %s: %v", DockerChain, err)

 	}

 	defer func() {

 		if err != nil {

-			if err := iptables.RemoveExistingChain(DockerChain, iptables.Nat); err != nil {

+			if err := iptable.RemoveExistingChain(DockerChain, iptables.Nat); err != nil {

 				logrus.Warnf("failed on removing iptables NAT chain %s on cleanup: %v", DockerChain, err)

 			}

 		}

 	}()

-	filterChain, err := iptables.NewChain(DockerChain, iptables.Filter, false)

+	filterChain, err := iptable.NewChain(DockerChain, iptables.Filter, false)

 	if err != nil {

 		return nil, nil, nil, nil, fmt.Errorf("failed to create FILTER chain %s: %v", DockerChain, err)

 	}

 	defer func() {

 		if err != nil {

-			if err := iptables.RemoveExistingChain(DockerChain, iptables.Filter); err != nil {

+			if err := iptable.RemoveExistingChain(DockerChain, iptables.Filter); err != nil {

 				logrus.Warnf("failed on removing iptables FILTER chain %s on cleanup: %v", DockerChain, err)

 			}

 		}

 	}()

-	isolationChain1, err := iptables.NewChain(IsolationChain1, iptables.Filter, false)

+	isolationChain1, err := iptable.NewChain(IsolationChain1, iptables.Filter, false)

 	if err != nil {

 		return nil, nil, nil, nil, fmt.Errorf("failed to create FILTER isolation chain: %v", err)

 	}

 	defer func() {

 		if err != nil {

-			if err := iptables.RemoveExistingChain(IsolationChain1, iptables.Filter); err != nil {

+			if err := iptable.RemoveExistingChain(IsolationChain1, iptables.Filter); err != nil {

 				logrus.Warnf("failed on removing iptables FILTER chain %s on cleanup: %v", IsolationChain1, err)

 			}

 		}

 	}()

-	isolationChain2, err := iptables.NewChain(IsolationChain2, iptables.Filter, false)

+	isolationChain2, err := iptable.NewChain(IsolationChain2, iptables.Filter, false)

 	if err != nil {

 		return nil, nil, nil, nil, fmt.Errorf("failed to create FILTER isolation chain: %v", err)

 	}

 	defer func() {

 		if err != nil {

-			if err := iptables.RemoveExistingChain(IsolationChain2, iptables.Filter); err != nil {

+			if err := iptable.RemoveExistingChain(IsolationChain2, iptables.Filter); err != nil {

 				logrus.Warnf("failed on removing iptables FILTER chain %s on cleanup: %v", IsolationChain2, err)

 			}

 		}

 	}()

-	if err := iptables.AddReturnRule(IsolationChain1); err != nil {

+	if err := iptable.AddReturnRule(IsolationChain1); err != nil {

 		return nil, nil, nil, nil, err

 	}

-	if err := iptables.AddReturnRule(IsolationChain2); err != nil {

+	if err := iptable.AddReturnRule(IsolationChain2); err != nil {

 		return nil, nil, nil, nil, err

 	}

 	return natChain, filterChain, isolationChain1, isolationChain2, nil

 }

-func (n *bridgeNetwork) setupIPTables(config *networkConfiguration, i *bridgeInterface) error {

-	var err error

-

+func (n *bridgeNetwork) setupIP4Tables(config *networkConfiguration, i *bridgeInterface) error {

 	d := n.driver

 	d.Lock()

 	driverConfig := d.config

 	d.Unlock()

 	// Sanity check.

-	if driverConfig.EnableIPTables == false {

+	if !driverConfig.EnableIPTables {

 		return errors.New("Cannot program chains, EnableIPTable is disabled")

 	}

-	// Pickup this configuration option from driver

-	hairpinMode := !driverConfig.EnableUserlandProxy

-

 	maskedAddrv4 := &net.IPNet{

 		IP:   i.bridgeIPv4.IP.Mask(i.bridgeIPv4.Mask),

 		Mask: i.bridgeIPv4.Mask,

 	}

+	return n.setupIPTables(iptables.IPv4, maskedAddrv4, config, i)

+}

+

+func (n *bridgeNetwork) setupIP6Tables(config *networkConfiguration, i *bridgeInterface) error {

+	d := n.driver

+	d.Lock()

+	driverConfig := d.config

+	d.Unlock()

+

+	// Sanity check.

+	if !driverConfig.EnableIP6Tables {

+		return errors.New("Cannot program chains, EnableIP6Tables is disabled")

+	}

+

+	maskedAddrv6 := &net.IPNet{

+		IP:   i.bridgeIPv6.IP.Mask(i.bridgeIPv6.Mask),

+		Mask: i.bridgeIPv6.Mask,

+	}

+

+	return n.setupIPTables(iptables.IPv6, maskedAddrv6, config, i)

+}

+

+func (n *bridgeNetwork) setupIPTables(ipVersion iptables.IPVersion, maskedAddr *net.IPNet, config *networkConfiguration, i *bridgeInterface) error {

+	var err error

+

+	d := n.driver

+	d.Lock()

+	driverConfig := d.config

+	d.Unlock()

+

+	// Pickup this configuration option from driver

+	hairpinMode := !driverConfig.EnableUserlandProxy

+

+	iptable := iptables.GetIptable(ipVersion)

+

 	if config.Internal {

-		if err = setupInternalNetworkRules(config.BridgeName, maskedAddrv4, config.EnableICC, true); err != nil {

+		if err = setupInternalNetworkRules(config.BridgeName, maskedAddr, config.EnableICC, true); err != nil {

 			return fmt.Errorf("Failed to Setup IP tables: %s", err.Error())

 		}

 		n.registerIptCleanFunc(func() error {

-			return setupInternalNetworkRules(config.BridgeName, maskedAddrv4, config.EnableICC, false)

+			return setupInternalNetworkRules(config.BridgeName, maskedAddr, config.EnableICC, false)

 		})

 	} else {

-		if err = setupIPTablesInternal(config.HostIP, config.BridgeName, maskedAddrv4, config.EnableICC, config.EnableIPMasquerade, hairpinMode, true); err != nil {

+		if err = setupIPTablesInternal(config.HostIP, config.BridgeName, maskedAddr, config.EnableICC, config.EnableIPMasquerade, hairpinMode, true); err != nil {

 			return fmt.Errorf("Failed to Setup IP tables: %s", err.Error())

 		}

 		n.registerIptCleanFunc(func() error {

-			return setupIPTablesInternal(config.HostIP, config.BridgeName, maskedAddrv4, config.EnableICC, config.EnableIPMasquerade, hairpinMode, false)

+			return setupIPTablesInternal(config.HostIP, config.BridgeName, maskedAddr, config.EnableICC, config.EnableIPMasquerade, hairpinMode, false)

 		})

-		natChain, filterChain, _, _, err := n.getDriverChains()

+		natChain, filterChain, _, _, err := n.getDriverChains(ipVersion)

 		if err != nil {

 			return fmt.Errorf("Failed to setup IP tables, cannot acquire chain info %s", err.Error())

 		}

-		err = iptables.ProgramChain(natChain, config.BridgeName, hairpinMode, true)

+		err = iptable.ProgramChain(natChain, config.BridgeName, hairpinMode, true)

 		if err != nil {

 			return fmt.Errorf("Failed to program NAT chain: %s", err.Error())

 		}

-		err = iptables.ProgramChain(filterChain, config.BridgeName, hairpinMode, true)

+		err = iptable.ProgramChain(filterChain, config.BridgeName, hairpinMode, true)

 		if err != nil {

 			return fmt.Errorf("Failed to program FILTER chain: %s", err.Error())

 		}

 		n.registerIptCleanFunc(func() error {

-			return iptables.ProgramChain(filterChain, config.BridgeName, hairpinMode, false)

+			return iptable.ProgramChain(filterChain, config.BridgeName, hairpinMode, false)

 		})

 		n.portMapper.SetIptablesChain(natChain, n.getNetworkBridgeName())

 	}

 	d.Lock()

-	err = iptables.EnsureJumpRule("FORWARD", IsolationChain1)

+	err = iptable.EnsureJumpRule("FORWARD", IsolationChain1)

 	d.Unlock()

-	if err != nil {

-		return err

-	}

-

-	return nil

+	return err

 }

 type iptRule struct {

@@ -166,7 +194,7 @@ type iptRule struct {

 	args    []string

 }

-func setupIPTablesInternal(hostIP net.IP, bridgeIface string, addr net.Addr, icc, ipmasq, hairpin, enable bool) error {

+func setupIPTablesInternal(hostIP net.IP, bridgeIface string, addr *net.IPNet, icc, ipmasq, hairpin, enable bool) error {

 	var (

 		address   = addr.String()

@@ -189,41 +217,50 @@ func setupIPTablesInternal(hostIP net.IP, bridgeIface string, addr net.Addr, icc

 	natRule := iptRule{table: iptables.Nat, chain: "POSTROUTING", preArgs: []string{"-t", "nat"}, args: natArgs}

 	hpNatRule := iptRule{table: iptables.Nat, chain: "POSTROUTING", preArgs: []string{"-t", "nat"}, args: hpNatArgs}

+	ipVersion := iptables.IPv4

+

+	if addr.IP.To4() == nil {

+		ipVersion = iptables.IPv6

+	}

+

 	// Set NAT.

 	if ipmasq {

-		if err := programChainRule(natRule, "NAT", enable); err != nil {

+		if err := programChainRule(ipVersion, natRule, "NAT", enable); err != nil {

 			return err

 		}

 	}

 	if ipmasq && !hairpin {

-		if err := programChainRule(skipDNAT, "SKIP DNAT", enable); err != nil {

+		if err := programChainRule(ipVersion, skipDNAT, "SKIP DNAT", enable); err != nil {

 			return err

 		}

 	}

 	// In hairpin mode, masquerade traffic from localhost

 	if hairpin {

-		if err := programChainRule(hpNatRule, "MASQ LOCAL HOST", enable); err != nil {

+		if err := programChainRule(ipVersion, hpNatRule, "MASQ LOCAL HOST", enable); err != nil {

 			return err

 		}

 	}

 	// Set Inter Container Communication.

-	if err := setIcc(bridgeIface, icc, enable); err != nil {

+	if err := setIcc(ipVersion, bridgeIface, icc, enable); err != nil {

 		return err

 	}

 	// Set Accept on all non-intercontainer outgoing packets.

-	return programChainRule(outRule, "ACCEPT NON_ICC OUTGOING", enable)

+	return programChainRule(ipVersion, outRule, "ACCEPT NON_ICC OUTGOING", enable)

 }

-func programChainRule(rule iptRule, ruleDescr string, insert bool) error {

+func programChainRule(version iptables.IPVersion, rule iptRule, ruleDescr string, insert bool) error {

+

+	iptable := iptables.GetIptable(version)

+

 	var (

 		prefix    []string

 		operation string

 		condition bool

-		doesExist = iptables.Exists(rule.table, rule.chain, rule.args...)

+		doesExist = iptable.Exists(rule.table, rule.chain, rule.args...)

 	)

 	if insert {

@@ -240,7 +277,7 @@ func programChainRule(rule iptRule, ruleDescr string, insert bool) error {

 	}

 	if condition {

-		if err := iptables.RawCombinedOutput(append(prefix, rule.args...)...); err != nil {

+		if err := iptable.RawCombinedOutput(append(prefix, rule.args...)...); err != nil {

 			return fmt.Errorf("Unable to %s %s rule: %s", operation, ruleDescr, err.Error())

 		}

 	}

@@ -248,7 +285,8 @@ func programChainRule(rule iptRule, ruleDescr string, insert bool) error {

 	return nil

 }

-func setIcc(bridgeIface string, iccEnable, insert bool) error {

+func setIcc(version iptables.IPVersion, bridgeIface string, iccEnable, insert bool) error {

+	iptable := iptables.GetIptable(version)

 	var (

 		table      = iptables.Filter

 		chain      = "FORWARD"

@@ -259,18 +297,18 @@ func setIcc(bridgeIface string, iccEnable, insert bool) error {

 	if insert {

 		if !iccEnable {

-			iptables.Raw(append([]string{"-D", chain}, acceptArgs...)...)

+			iptable.Raw(append([]string{"-D", chain}, acceptArgs...)...)

-			if !iptables.Exists(table, chain, dropArgs...) {

-				if err := iptables.RawCombinedOutput(append([]string{"-A", chain}, dropArgs...)...); err != nil {

+			if !iptable.Exists(table, chain, dropArgs...) {

+				if err := iptable.RawCombinedOutput(append([]string{"-A", chain}, dropArgs...)...); err != nil {

 					return fmt.Errorf("Unable to prevent intercontainer communication: %s", err.Error())

 				}

 			}

 		} else {

-			iptables.Raw(append([]string{"-D", chain}, dropArgs...)...)

+			iptable.Raw(append([]string{"-D", chain}, dropArgs...)...)

-			if !iptables.Exists(table, chain, acceptArgs...) {

-				if err := iptables.RawCombinedOutput(append([]string{"-I", chain}, acceptArgs...)...); err != nil {

+			if !iptable.Exists(table, chain, acceptArgs...) {

+				if err := iptable.RawCombinedOutput(append([]string{"-I", chain}, acceptArgs...)...); err != nil {

 					return fmt.Errorf("Unable to allow intercontainer communication: %s", err.Error())

 				}

 			}

@@ -278,12 +316,12 @@ func setIcc(bridgeIface string, iccEnable, insert bool) error {

 	} else {

 		// Remove any ICC rule.

 		if !iccEnable {

-			if iptables.Exists(table, chain, dropArgs...) {

-				iptables.Raw(append([]string{"-D", chain}, dropArgs...)...)

+			if iptable.Exists(table, chain, dropArgs...) {

+				iptable.Raw(append([]string{"-D", chain}, dropArgs...)...)

 			}

 		} else {

-			if iptables.Exists(table, chain, acceptArgs...) {

-				iptables.Raw(append([]string{"-D", chain}, acceptArgs...)...)

+			if iptable.Exists(table, chain, acceptArgs...) {

+				iptable.Raw(append([]string{"-D", chain}, acceptArgs...)...)

 			}

 		}

 	}

@@ -292,7 +330,8 @@ func setIcc(bridgeIface string, iccEnable, insert bool) error {

 }

 // Control Inter Network Communication. Install[Remove] only if it is [not] present.

-func setINC(iface string, enable bool) error {

+func setINC(version iptables.IPVersion, iface string, enable bool) error {

+	iptable := iptables.GetIptable(version)

 	var (

 		action    = iptables.Insert

 		actionMsg = "add"

@@ -309,12 +348,12 @@ func setINC(iface string, enable bool) error {

 	}

 	for i, chain := range chains {

-		if err := iptables.ProgramRule(iptables.Filter, chain, action, rules[i]); err != nil {

+		if err := iptable.ProgramRule(iptables.Filter, chain, action, rules[i]); err != nil {

 			msg := fmt.Sprintf("unable to %s inter-network communication rule: %v", actionMsg, err)

 			if enable {

 				if i == 1 {

 					// Rollback the rule installed on first chain

-					if err2 := iptables.ProgramRule(iptables.Filter, chains[0], iptables.Delete, rules[0]); err2 != nil {

+					if err2 := iptable.ProgramRule(iptables.Filter, chains[0], iptables.Delete, rules[0]); err2 != nil {

 						logrus.Warnf("Failed to rollback iptables rule after failure (%v): %v", err, err2)

 					}

 				}

@@ -330,37 +369,47 @@ func setINC(iface string, enable bool) error {

 // Obsolete chain from previous docker versions

 const oldIsolationChain = "DOCKER-ISOLATION"

-func removeIPChains() {

+func removeIPChains(version iptables.IPVersion) {

+	ipt := iptables.IPTable{Version: version}

+

 	// Remove obsolete rules from default chains

-	iptables.ProgramRule(iptables.Filter, "FORWARD", iptables.Delete, []string{"-j", oldIsolationChain})

+	ipt.ProgramRule(iptables.Filter, "FORWARD", iptables.Delete, []string{"-j", oldIsolationChain})

 	// Remove chains

 	for _, chainInfo := range []iptables.ChainInfo{

-		{Name: DockerChain, Table: iptables.Nat},

-		{Name: DockerChain, Table: iptables.Filter},

-		{Name: IsolationChain1, Table: iptables.Filter},

-		{Name: IsolationChain2, Table: iptables.Filter},

-		{Name: oldIsolationChain, Table: iptables.Filter},

+		{Name: DockerChain, Table: iptables.Nat, IPTable: ipt},

+		{Name: DockerChain, Table: iptables.Filter, IPTable: ipt},

+		{Name: IsolationChain1, Table: iptables.Filter, IPTable: ipt},

+		{Name: IsolationChain2, Table: iptables.Filter, IPTable: ipt},

+		{Name: oldIsolationChain, Table: iptables.Filter, IPTable: ipt},

 	} {

+

 		if err := chainInfo.Remove(); err != nil {

 			logrus.Warnf("Failed to remove existing iptables entries in table %s chain %s : %v", chainInfo.Table, chainInfo.Name, err)

 		}

 	}

 }

-func setupInternalNetworkRules(bridgeIface string, addr net.Addr, icc, insert bool) error {

+func setupInternalNetworkRules(bridgeIface string, addr *net.IPNet, icc, insert bool) error {

 	var (

 		inDropRule  = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{"-i", bridgeIface, "!", "-d", addr.String(), "-j", "DROP"}}

 		outDropRule = iptRule{table: iptables.Filter, chain: IsolationChain1, args: []string{"-o", bridgeIface, "!", "-s", addr.String(), "-j", "DROP"}}

 	)

-	if err := programChainRule(inDropRule, "DROP INCOMING", insert); err != nil {

+

+	version := iptables.IPv4

+

+	if addr.IP.To4() == nil {

+		version = iptables.IPv6

+	}

+

+	if err := programChainRule(version, inDropRule, "DROP INCOMING", insert); err != nil {

 		return err

 	}

-	if err := programChainRule(outDropRule, "DROP OUTGOING", insert); err != nil {

+	if err := programChainRule(version, outDropRule, "DROP OUTGOING", insert); err != nil {

 		return err

 	}

 	// Set Inter Container Communication.

-	return setIcc(bridgeIface, icc, insert)

+	return setIcc(version, bridgeIface, icc, insert)

 }

 func clearEndpointConnections(nlh *netlink.Handle, ep *bridgeEndpoint) {

@@ -210,7 +210,10 @@ func programMangle(vni uint32, add bool) (err error) {

 		action = "install"

 	)

-	if add == iptables.Exists(iptables.Mangle, chain, rule...) {

+	// TODO IPv6 support

+	iptable := iptables.GetIptable(iptables.IPv4)

+

+	if add == iptable.Exists(iptables.Mangle, chain, rule...) {

 		return

 	}

@@ -219,7 +222,7 @@ func programMangle(vni uint32, add bool) (err error) {

 		action = "remove"

 	}

-	if err = iptables.RawCombinedOutput(append([]string{"-t", string(iptables.Mangle), a, chain}, rule...)...); err != nil {

+	if err = iptable.RawCombinedOutput(append([]string{"-t", string(iptables.Mangle), a, chain}, rule...)...); err != nil {

 		logrus.Warnf("could not %s mangle rule: %v", action, err)

 	}

@@ -239,16 +242,19 @@ func programInput(vni uint32, add bool) (err error) {

 		msg        = "add"

 	)

+	// TODO IPv6 support

+	iptable := iptables.GetIptable(iptables.IPv4)

+

 	if !add {

 		action = iptables.Delete

 		msg = "remove"

 	}

-	if err := iptables.ProgramRule(iptables.Filter, chain, action, accept); err != nil {

+	if err := iptable.ProgramRule(iptables.Filter, chain, action, accept); err != nil {

 		logrus.Errorf("could not %s input rule: %v. Please do it manually.", msg, err)

 	}

-	if err := iptables.ProgramRule(iptables.Filter, chain, action, block); err != nil {

+	if err := iptable.ProgramRule(iptables.Filter, chain, action, block); err != nil {

 		logrus.Errorf("could not %s input rule: %v. Please do it manually.", msg, err)

 	}

@@ -20,7 +20,9 @@ func filterWait() func() {

 }

 func chainExists(cname string) bool {

-	if _, err := iptables.Raw("-L", cname); err != nil {

+	// TODO IPv6 support

+	iptable := iptables.GetIptable(iptables.IPv4)

+	if _, err := iptable.Raw("-L", cname); err != nil {

 		return false

 	}

@@ -28,22 +30,26 @@ func chainExists(cname string) bool {

 }

 func setupGlobalChain() {

+	// TODO IPv6 support

+	iptable := iptables.GetIptable(iptables.IPv4)

 	// Because of an ungraceful shutdown, chain could already be present

 	if !chainExists(globalChain) {

-		if err := iptables.RawCombinedOutput("-N", globalChain); err != nil {

+		if err := iptable.RawCombinedOutput("-N", globalChain); err != nil {

 			logrus.Errorf("could not create global overlay chain: %v", err)

 			return

 		}

 	}

-	if !iptables.Exists(iptables.Filter, globalChain, "-j", "RETURN") {

-		if err := iptables.RawCombinedOutput("-A", globalChain, "-j", "RETURN"); err != nil {

+	if !iptable.Exists(iptables.Filter, globalChain, "-j", "RETURN") {

+		if err := iptable.RawCombinedOutput("-A", globalChain, "-j", "RETURN"); err != nil {

 			logrus.Errorf("could not install default return chain in the overlay global chain: %v", err)

 		}

 	}

 }

 func setNetworkChain(cname string, remove bool) error {

+	// TODO IPv6 support

+	iptable := iptables.GetIptable(iptables.IPv4)

 	// Initialize the onetime global overlay chain

 	filterOnce.Do(setupGlobalChain)

@@ -52,21 +58,21 @@ func setNetworkChain(cname string, remove bool) error {

 	opt := "-N"

 	// In case of remove, make sure to flush the rules in the chain

 	if remove && exists {

-		if err := iptables.RawCombinedOutput("-F", cname); err != nil {

+		if err := iptable.RawCombinedOutput("-F", cname); err != nil {

 			return fmt.Errorf("failed to flush overlay network chain %s rules: %v", cname, err)

 		}

 		opt = "-X"

 	}

 	if (!remove && !exists) || (remove && exists) {

-		if err := iptables.RawCombinedOutput(opt, cname); err != nil {

+		if err := iptable.RawCombinedOutput(opt, cname); err != nil {

 			return fmt.Errorf("failed network chain operation %q for chain %s: %v", opt, cname, err)