From b01a204c1f31a4aa8059b45bf2a0644ee8fc9428 Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Wed, 7 Jun 2017 16:39:26 +0000
Subject: [PATCH] Check who previously owned an address claimed outside the
 range

---
 ipam/claim.go | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/ipam/claim.go b/ipam/claim.go
index b6af8901..c4a5529e 100644
--- a/ipam/claim.go
+++ b/ipam/claim.go
@@ -49,9 +49,20 @@ func (c *claim) Try(alloc *Allocator) bool {
 	}
 
 	if !alloc.ring.Contains(c.cidr.Addr) {
-		// Address not within our universe; assume user knows what they are doing
 		alloc.infof("Address %s claimed by %s - not in our range", c.cidr, c.ident)
-		addOwned()
+		previousOwner := alloc.findOwner(c.cidr.Addr)
+		switch {
+		case previousOwner == "":
+			addOwned()
+		case previousOwner == c.ident: // already owned by this ID
+		case c.ident == api.NoContainerID: // already owned by anonymous container
+			// do nothing (no automatic fall-through in Go)
+		case !alloc.dead[previousOwner].IsZero(): // already owned by dead container
+			alloc.removeOwned(previousOwner, c.cidr.Addr)
+			addOwned()
+		default:
+			c.sendResult(fmt.Errorf("address %s already in use by %s", c.cidr, previousOwner))
+		}
 		c.sendResult(nil)
 		return true
 	}