Filter out ipv6 port forwards when an ipv6 default route doesn't exist

agent/api/ecsclient/client.go

@@ -476,19 +476,23 @@ func (client *APIECSClient) buildContainerStateChangePayload(change api.Containe
 		exitCode := int64(aws.IntValue(change.ExitCode))
 		statechange.ExitCode = aws.Int64(exitCode)
 	}
-	networkBindings := make([]*ecs.NetworkBinding, len(change.PortBindings))
-	for i, binding := range change.PortBindings {
+
+	networkBindings := []*ecs.NetworkBinding{}
+	for _, binding := range change.PortBindings {
+		if binding.BindIP == "::" && client.config.MissingIPv6DefaultRoute {
+			continue
+		}
 		hostPort := int64(binding.HostPort)
 		containerPort := int64(binding.ContainerPort)
 		bindIP := binding.BindIP
 		protocol := binding.Protocol.String()
 
-		networkBindings[i] = &ecs.NetworkBinding{
+		networkBindings = append(networkBindings, &ecs.NetworkBinding{
 			BindIP:        aws.String(bindIP),
 			ContainerPort: aws.Int64(containerPort),
 			HostPort:      aws.Int64(hostPort),
 			Protocol:      aws.String(protocol),
-		}
+		})
 	}
 	statechange.NetworkBindings = networkBindings
 

agent/config/config_unix.go

@@ -15,8 +15,10 @@
 package config
 
 import (
+	"bufio"
 	"fmt"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/aws/amazon-ecs-agent/agent/dockerclient"
@@ -44,6 +46,9 @@ const (
 	minimumContainerCreateTimeout = 1 * time.Minute
 	// default docker inactivity time is extra time needed on container extraction
 	defaultImagePullInactivityTimeout = 1 * time.Minute
+
+	// location of ipv6 route table
+	ipv6RouteFile = "/proc/net/ipv6_route"
 )
 
 // DefaultConfig returns the default configuration for Linux
@@ -91,6 +96,7 @@ func DefaultConfig() Config {
 		CgroupCPUPeriod:                     defaultCgroupCPUPeriod,
 		GMSACapable:                         false,
 		FSxWindowsFileServerCapable:         false,
+		MissingIPv6DefaultRoute:             false,
 	}
 }
 
@@ -103,6 +109,9 @@ func (cfg *Config) platformOverrides() {
 	if cfg.TaskENIEnabled.Enabled() { // when task networking is enabled, eni trunking is enabled by default
 		cfg.ENITrunkingEnabled = parseBooleanDefaultTrueConfig("ECS_ENABLE_HIGH_DENSITY_ENI")
 	}
+	if !hasIPv6DefaultRoute() {
+		cfg.MissingIPv6DefaultRoute = true
+	}
 }
 
 // platformString returns platform-specific config data that can be serialized
@@ -117,3 +126,25 @@ func (cfg *Config) platformString() string {
 	}
 	return ""
 }
+
+// hasIPv6DefaultRoute returns whether an non-zero IPv6 default route exists.
+// This returns true in error conditions to ensure the existing behaviour
+// isn't modified
+func hasIPv6DefaultRoute() bool {
+	file, err := os.Open(ipv6RouteFile)
+	if err != nil {
+		return true
+	}
+	defer file.Close()
+	scanner := bufio.NewReader(file)
+	for {
+		line, err := scanner.ReadString('\n')
+		if err != nil {
+			break
+		}
+		if strings.Fields(line)[4] != "00000000000000000000000000000000" {
+			return true
+		}
+	}
+	return false
+}

agent/config/types.go

@@ -329,4 +329,7 @@ type Config struct {
 	// FSxWindowsFileServerCapable is the config option to indicate if fsxWindowsFileServer is supported.
 	// It should be enabled by default only if the container instance is part of a valid active directory domain.
 	FSxWindowsFileServerCapable bool
+
+	// MissingIPv6DefaultRoute indicates if the agent sees a IPv6 default route
+	MissingIPv6DefaultRoute bool
 }