@@ -1,6 +1,7 @@

 package swarm

 import (

+	"net/netip"

 	"time"

 	"github.com/moby/moby/api/types/container"

@@ -14,7 +15,7 @@ import (

 // TODO: `domain` is not supported yet.

 type DNSConfig struct {

 	// Nameservers specifies the IP addresses of the name servers

-	Nameservers []string `json:",omitempty"`

+	Nameservers []netip.Addr `json:",omitempty"`

 	// Search specifies the search list for host-name lookup

 	Search []string `json:",omitempty"`

 	// Options allows certain internal resolver variables to be modified

@@ -1,6 +1,8 @@

 package swarm

 import (

+	"net/netip"

+

 	"github.com/moby/moby/api/types/network"

 )

@@ -68,8 +70,8 @@ const (

 // EndpointVirtualIP represents the virtual ip of a port.

 type EndpointVirtualIP struct {

-	NetworkID string `json:",omitempty"`

-	Addr      string `json:",omitempty"`

+	NetworkID string     `json:",omitempty"`

+	Addr      netip.Addr `json:",omitempty"`

 }

 // Network represents a network.

@@ -103,8 +105,8 @@ type NetworkAttachmentConfig struct {

 // NetworkAttachment represents a network attachment.

 type NetworkAttachment struct {

-	Network   Network  `json:",omitempty"`

-	Addresses []string `json:",omitempty"`

+	Network   Network      `json:",omitempty"`

+	Addresses []netip.Addr `json:",omitempty"`

 }

 // IPAMOptions represents ipam options.

@@ -115,7 +117,7 @@ type IPAMOptions struct {

 // IPAMConfig represents ipam configuration.

 type IPAMConfig struct {

-	Subnet  string `json:",omitempty"`

-	Range   string `json:",omitempty"`

-	Gateway string `json:",omitempty"`

+	Subnet  netip.Prefix `json:",omitempty"`

+	Range   netip.Prefix `json:",omitempty"`

+	Gateway netip.Addr   `json:",omitempty"`

 }

@@ -1,6 +1,7 @@

 package swarm

 import (

+	"net/netip"

 	"time"

 )

@@ -12,7 +13,7 @@ type ClusterInfo struct {

 	Spec                   Spec

 	TLSInfo                TLSInfo

 	RootRotationInProgress bool

-	DefaultAddrPool        []string

+	DefaultAddrPool        []netip.Prefix

 	SubnetSize             uint32

 	DataPathPort           uint32

 }

@@ -159,7 +160,7 @@ type InitRequest struct {

 	Spec             Spec

 	AutoLockManagers bool

 	Availability     NodeAvailability

-	DefaultAddrPool  []string

+	DefaultAddrPool  []netip.Prefix

 	SubnetSize       uint32

 }

@@ -4,6 +4,7 @@ import (

 	"context"

 	"encoding/json"

 	"fmt"

+	"net/netip"

 	"strings"

 	"github.com/containerd/log"

@@ -11,6 +12,7 @@ import (

 	"github.com/moby/moby/api/types/container"

 	mounttypes "github.com/moby/moby/api/types/mount"

 	types "github.com/moby/moby/api/types/swarm"

+	"github.com/moby/moby/v2/daemon/internal/sliceutil"

 	swarmapi "github.com/moby/swarmkit/v2/api"

 	"github.com/pkg/errors"

 )

@@ -47,7 +49,7 @@ func containerSpecFromGRPC(c *swarmapi.ContainerSpec) *types.ContainerSpec {

 	if c.DNSConfig != nil {

 		containerSpec.DNSConfig = &types.DNSConfig{

-			Nameservers: c.DNSConfig.Nameservers,

+			Nameservers: sliceutil.Map(c.DNSConfig.Nameservers, func(s string) netip.Addr { a, _ := netip.ParseAddr(s); return a }),

 			Search:      c.DNSConfig.Search,

 			Options:     c.DNSConfig.Options,

 		}

@@ -309,7 +311,7 @@ func containerToGRPC(c *types.ContainerSpec) (*swarmapi.ContainerSpec, error) {

 	if c.DNSConfig != nil {

 		containerSpec.DNSConfig = &swarmapi.ContainerSpec_DNSConfig{

-			Nameservers: c.DNSConfig.Nameservers,

+			Nameservers: sliceutil.Map(c.DNSConfig.Nameservers, (netip.Addr).String),

 			Search:      c.DNSConfig.Search,

 			Options:     c.DNSConfig.Options,

 		}

@@ -1,6 +1,7 @@

 package convert

 import (

+	"net/netip"

 	"strings"

 	"time"

@@ -8,6 +9,8 @@ import (

 	"github.com/moby/moby/api/types/network"

 	types "github.com/moby/moby/api/types/swarm"

 	"github.com/moby/moby/v2/daemon/cluster/convert/netextra"

+	"github.com/moby/moby/v2/daemon/internal/netiputil"

+	"github.com/moby/moby/v2/daemon/internal/sliceutil"

 	"github.com/moby/moby/v2/daemon/libnetwork/scope"

 	swarmapi "github.com/moby/swarmkit/v2/api"

 )

@@ -16,7 +19,7 @@ func networkAttachmentFromGRPC(na *swarmapi.NetworkAttachment) types.NetworkAtta

 	if na != nil {

 		return types.NetworkAttachment{

 			Network:   networkFromGRPC(na.Network),

-			Addresses: na.Addresses,

+			Addresses: sliceutil.Map(na.Addresses, func(s string) netip.Addr { a, _ := netip.ParseAddr(s); return a }),

 		}

 	}

 	return types.NetworkAttachment{}

@@ -82,10 +85,16 @@ func ipamFromGRPC(i *swarmapi.IPAMOptions) *types.IPAMOptions {

 		}

 		for _, config := range i.Configs {

+			// Best-effort parse of user suppplied values that have

+			// been round-tripped through Swarm's Raft store. It is

+			// far too late to reject bogus values.

+			subnet, _ := netiputil.ParseCIDR(config.Subnet)

+			iprange, _ := netiputil.ParseCIDR(config.Range)

+			gw, _ := netip.ParseAddr(config.Gateway)

 			ipam.Configs = append(ipam.Configs, types.IPAMConfig{

-				Subnet:  config.Subnet,

-				Range:   config.Range,

-				Gateway: config.Gateway,

+				Subnet:  subnet.Masked(),

+				Range:   iprange.Masked(),

+				Gateway: gw.Unmap(),

 			})

 		}

 	}

@@ -118,9 +127,10 @@ func endpointFromGRPC(e *swarmapi.Endpoint) types.Endpoint {

 		}

 		for _, v := range e.VirtualIPs {

+			vip, _ := netip.ParseAddr(v.Addr)

 			endpoint.VirtualIPs = append(endpoint.VirtualIPs, types.EndpointVirtualIP{

 				NetworkID: v.NetworkID,

-				Addr:      v.Addr,

+				Addr:      vip,

 			})

 		}

 	}

@@ -2,10 +2,12 @@ package convert

 import (

 	"fmt"

+	"net/netip"

 	"strings"

 	gogotypes "github.com/gogo/protobuf/types"

 	types "github.com/moby/moby/api/types/swarm"

+	"github.com/moby/moby/v2/daemon/internal/sliceutil"

 	swarmapi "github.com/moby/swarmkit/v2/api"

 	"github.com/moby/swarmkit/v2/ca"

 )

@@ -40,7 +42,7 @@ func SwarmFromGRPC(c swarmapi.Cluster) types.Swarm {

 				TrustRoot: string(c.RootCA.CACert),

 			},

 			RootRotationInProgress: c.RootCA.RootRotation != nil,

-			DefaultAddrPool:        c.DefaultAddressPool,

+			DefaultAddrPool:        sliceutil.Map(c.DefaultAddressPool, func(s string) netip.Prefix { pfx, _ := netip.ParsePrefix(s); return pfx }),

 			SubnetSize:             c.SubnetSize,

 			DataPathPort:           c.VXLANUDPPort,

 		},

@@ -4,7 +4,7 @@ import (

 	"errors"

 	"fmt"

 	"net"

-	"strings"

+	"net/netip"

 )

 const (

@@ -91,7 +91,7 @@ func (c *Cluster) resolveAdvertiseAddr(advertiseAddr, listenAddrPort string) (st

 // validateDefaultAddrPool validates default address pool

 // it also strips white space from the string before validation

-func validateDefaultAddrPool(defaultAddrPool []string, size uint32) error {

+func validateDefaultAddrPool(defaultAddrPool []netip.Prefix, size uint32) error {

 	if defaultAddrPool == nil {

 		// defaultAddrPool is not defined

 		return nil

@@ -108,16 +108,9 @@ func validateDefaultAddrPool(defaultAddrPool []string, size uint32) error {

 	if size > 29 {

 		return fmt.Errorf("subnet size is out of range: %d", size)

 	}

-	for i := range defaultAddrPool {

-		// trim leading and trailing white spaces

-		defaultAddrPool[i] = strings.TrimSpace(defaultAddrPool[i])

-		_, b, err := net.ParseCIDR(defaultAddrPool[i])

-		if err != nil {

-			return fmt.Errorf("invalid base pool %s: %v", defaultAddrPool[i], err)

-		}

-		ones, _ := b.Mask.Size()

-		if size < uint32(ones) {

-			return fmt.Errorf("invalid CIDR: %q. Subnet size is too small for pool: %d", defaultAddrPool[i], size)

+	for _, a := range defaultAddrPool {

+		if size < uint32(a.Bits()) {

+			return fmt.Errorf("invalid CIDR: %q. Subnet size is too small for pool: %d", a, size)

 		}

 	}

@@ -3,6 +3,7 @@ package cluster

 import (

 	"context"

 	"fmt"

+	"net/netip"

 	"path/filepath"

 	"strings"

 	"sync"

@@ -12,6 +13,7 @@ import (

 	types "github.com/moby/moby/api/types/swarm"

 	"github.com/moby/moby/v2/daemon/cluster/convert"

 	"github.com/moby/moby/v2/daemon/cluster/executor/container"

+	"github.com/moby/moby/v2/daemon/internal/sliceutil"

 	lncluster "github.com/moby/moby/v2/daemon/libnetwork/cluster"

 	"github.com/moby/moby/v2/daemon/libnetwork/cnmallocator"

 	swarmapi "github.com/moby/swarmkit/v2/api"

@@ -55,7 +57,7 @@ type nodeStartConfig struct {

 	// DataPathAddr is the address that has to be used for the data path

 	DataPathAddr string

 	// DefaultAddressPool contains list of subnets

-	DefaultAddressPool []string

+	DefaultAddressPool []netip.Prefix

 	// SubnetSize contains subnet size of DefaultAddressPool

 	SubnetSize uint32

 	// DataPathPort contains Data path port (VXLAN UDP port) number that is used for data traffic.

@@ -126,7 +128,7 @@ func (n *nodeRunner) start(conf nodeStartConfig) error {

 		ListenRemoteAPI:    conf.ListenAddr,

 		AdvertiseRemoteAPI: conf.AdvertiseAddr,

 		NetworkConfig: &networkallocator.Config{

-			DefaultAddrPool: conf.DefaultAddressPool,

+			DefaultAddrPool: sliceutil.Map(conf.DefaultAddressPool, (netip.Prefix).String),

 			SubnetSize:      conf.SubnetSize,

 			VXLANUDPPort:    conf.DataPathPort,

 		},

@@ -21,6 +21,9 @@ func ToIPNet(p netip.Prefix) *net.IPNet {

 // ToPrefix converts n into a netip.Prefix. If n is not a valid IPv4 or IPV6

 // address, ToPrefix returns netip.Prefix{}, false.

 func ToPrefix(n *net.IPNet) (netip.Prefix, bool) {

+	if n == nil {

+		return netip.Prefix{}, false

+	}

 	if ll := len(n.Mask); ll != net.IPv4len && ll != net.IPv6len {

 		return netip.Prefix{}, false

 	}

@@ -88,3 +91,21 @@ func PrefixAfter(prev netip.Prefix, sz int) netip.Prefix {

 	}

 	return netip.PrefixFrom(addr, sz).Masked()

 }

+

+// Unmap returns p with any IPv4-mapped IPv6 address prefix removed, per the

+// quirky semantics that have been Hyrum's Law'ed into our Engine API contract:

+// the subnet mask is truncated to the length of the unmapped address.

+// For example:

+//   - "::ffff:1.2.3.4/24" -> 1.2.3.4/0

+//   - "::ffff:1.2.3.4/120" -> 1.2.3.4/24

+func Unmap(p netip.Prefix) netip.Prefix {

+	bits := p.Addr().Unmap().BitLen() - p.Addr().BitLen() + p.Bits()

+	return netip.PrefixFrom(p.Addr().Unmap(), max(0, bits))

+}

+

+// ParseCIDR parses s as an IP address prefix, like [netip.ParsePrefix],

+// unmapping any IPv4-mapped IPv6 address prefixes using [Unmap].

+func ParseCIDR(s string) (netip.Prefix, error) {

+	prefix, err := netip.ParsePrefix(s)

+	return Unmap(prefix), err

+}

@@ -1,6 +1,7 @@

 package netiputil

 import (

+	"net"

 	"net/netip"

 	"testing"

@@ -44,3 +45,28 @@ func TestPrefixAfter(t *testing.T) {

 		assert.Check(t, next == tc.want, "PrefixAfter(%q, %d) = %s; want: %s", tc.prev, tc.sz, next, tc.want)

 	}

 }

+

+func TestUnmap(t *testing.T) {

+	assert.Check(t, !Unmap(netip.Prefix{}).IsValid())

+}

+

+func TestParseCIDR(t *testing.T) {

+	tests := []string{"::ffff:1.2.3.4/24", "::ffff:1.2.3.4/1", "::ffff:1.2.3.4/120", "1.2.3.4/24", "::1/128", "2001:db8::/32"}

+	for _, s := range tests {

+		// From "github.com/moby/moby/v2/daemon/libnetwork/types".ParseCIDR

+		ip, net, err := net.ParseCIDR(s)

+		assert.NilError(t, err)

+		net.IP = ip

+		want := netip.MustParsePrefix(net.String())

+

+		got, err := ParseCIDR(s)

+		assert.Check(t, err)

+		if got != want {

+			t.Errorf("ParseCIDR(%q) = %v, want %v", s, got, want)

+		}

+	}

+

+	got, err := ParseCIDR("invalid")

+	assert.Check(t, err != nil, "expected error for invalid input")

+	assert.Check(t, !got.IsValid(), "expected invalid result for invalid input")

+}

@@ -2,6 +2,7 @@ package network

 import (

 	"context"

+	"net/netip"

 	"strings"

 	"testing"

 	"time"

@@ -417,7 +418,7 @@ func TestServiceWithDefaultAddressPoolInit(t *testing.T) {

 	ctx := setupTest(t)

 	d := swarm.NewSwarm(ctx, t, testEnv,

-		daemon.WithSwarmDefaultAddrPool([]string{"20.20.0.0/16"}),

+		daemon.WithSwarmDefaultAddrPool(netip.MustParsePrefix("20.20.0.0/16")),

 		daemon.WithSwarmDefaultAddrPoolSubnetSize(24))

 	defer d.Stop(t)

 	cli := d.NewClientT(t)

@@ -1,10 +1,12 @@

 package service

 import (

+	"net/netip"

 	"testing"

 	"time"

 	"github.com/google/go-cmp/cmp"

+	"github.com/google/go-cmp/cmp/cmpopts"

 	"github.com/moby/moby/api/types/container"

 	swarmtypes "github.com/moby/moby/api/types/swarm"

 	"github.com/moby/moby/client"

@@ -67,7 +69,10 @@ func cmpServiceOpts() cmp.Option {

 		return delta < threshold && delta > -threshold

 	})

-	return cmp.FilterPath(metaTimeFields, withinThreshold)

+	return cmp.Options{

+		cmp.FilterPath(metaTimeFields, withinThreshold),

+		cmpopts.EquateComparable(netip.Addr{}, netip.Prefix{}),

+	}

 }

 func fullSwarmServiceSpec(name string, replicas uint64) swarmtypes.ServiceSpec {

@@ -95,7 +100,7 @@ func fullSwarmServiceSpec(name string, replicas uint64) swarmtypes.ServiceSpec {

 				StopGracePeriod: &restartDelay,

 				Hosts:           []string{"8.8.8.8  google"},

 				DNSConfig: &swarmtypes.DNSConfig{

-					Nameservers: []string{"8.8.8.8"},

+					Nameservers: []netip.Addr{netip.MustParseAddr("8.8.8.8")},

 					Search:      []string{"somedomain"},

 				},

 				Isolation: container.IsolationDefault,

@@ -7,6 +7,7 @@ import (

 	"fmt"

 	"io"

 	"net/http"

+	"net/netip"

 	"os"

 	"os/exec"

 	"os/user"

@@ -96,7 +97,7 @@ type Daemon struct {

 	swarmListenAddr   string

 	swarmWithIptables bool

 	SwarmPort         int // FIXME(vdemeester) should probably not be exported

-	DefaultAddrPool   []string

+	DefaultAddrPool   []netip.Prefix

 	SubnetSize        uint32

 	DataPathPort      uint32

 	OOMScoreAdjust    int

@@ -1,6 +1,7 @@

 package daemon

 import (

+	"net/netip"

 	"os/user"

 	"github.com/moby/moby/v2/internal/testutil/environment"

@@ -82,7 +83,7 @@ func WithSwarmIptables(useIptables bool) Option {

 }

 // WithSwarmDefaultAddrPool sets the swarm default address pool to use for swarm mode

-func WithSwarmDefaultAddrPool(defaultAddrPool []string) Option {

+func WithSwarmDefaultAddrPool(defaultAddrPool ...netip.Prefix) Option {

 	return func(d *Daemon) {

 		d.DefaultAddrPool = defaultAddrPool

 	}

@@ -1,6 +1,7 @@

 package swarm

 import (

+	"net/netip"

 	"time"

 	"github.com/moby/moby/api/types/container"

@@ -14,7 +15,7 @@ import (

 // TODO: `domain` is not supported yet.

 type DNSConfig struct {

 	// Nameservers specifies the IP addresses of the name servers

-	Nameservers []string `json:",omitempty"`

+	Nameservers []netip.Addr `json:",omitempty"`

 	// Search specifies the search list for host-name lookup

 	Search []string `json:",omitempty"`

 	// Options allows certain internal resolver variables to be modified

@@ -1,6 +1,8 @@

 package swarm

 import (

+	"net/netip"

+

 	"github.com/moby/moby/api/types/network"

 )

@@ -68,8 +70,8 @@ const (

 // EndpointVirtualIP represents the virtual ip of a port.

 type EndpointVirtualIP struct {

-	NetworkID string `json:",omitempty"`

-	Addr      string `json:",omitempty"`

+	NetworkID string     `json:",omitempty"`

+	Addr      netip.Addr `json:",omitempty"`

 }

 // Network represents a network.

@@ -103,8 +105,8 @@ type NetworkAttachmentConfig struct {

 // NetworkAttachment represents a network attachment.

 type NetworkAttachment struct {

-	Network   Network  `json:",omitempty"`

-	Addresses []string `json:",omitempty"`

+	Network   Network      `json:",omitempty"`

+	Addresses []netip.Addr `json:",omitempty"`

 }

 // IPAMOptions represents ipam options.

@@ -115,7 +117,7 @@ type IPAMOptions struct {

 // IPAMConfig represents ipam configuration.

 type IPAMConfig struct {

-	Subnet  string `json:",omitempty"`

-	Range   string `json:",omitempty"`

-	Gateway string `json:",omitempty"`

+	Subnet  netip.Prefix `json:",omitempty"`

+	Range   netip.Prefix `json:",omitempty"`

+	Gateway netip.Addr   `json:",omitempty"`

 }

@@ -1,6 +1,7 @@

 package swarm

 import (

+	"net/netip"

 	"time"

 )

@@ -12,7 +13,7 @@ type ClusterInfo struct {

 	Spec                   Spec

 	TLSInfo                TLSInfo

 	RootRotationInProgress bool

-	DefaultAddrPool        []string

+	DefaultAddrPool        []netip.Prefix

 	SubnetSize             uint32

 	DataPathPort           uint32

 }

@@ -159,7 +160,7 @@ type InitRequest struct {

 	Spec             Spec

 	AutoLockManagers bool

 	Availability     NodeAvailability

-	DefaultAddrPool  []string

+	DefaultAddrPool  []netip.Prefix

 	SubnetSize       uint32

 }