network: remove unnecessary links iptables rule for return traffic

Currently there are two iptables rules per port for each link: one to
allow the parent to connect to the child's port, and another one to
allow return traffic from the child back to the parent.  The second rule
shouldn't be needed because the "ctstate RELATED,ESTABLISHED" rule can
already allow all established traffic.

So this patch does the following:

1. Move the RELATED,ESTABLISHED rule to be _before_ the potential
   inter-container communication DROP rule so it will work for
   inter-container traffic as well.  Since we're inserting, everything
   is reversed chronologically so it should be inserted _after_ we
   insert the DROP.  This also has a small performance benefit because
   it will be processed earlier and it's generally one of the most
   commonly used rules.

2. Get rid of the unnecessary return traffic rule per link.

3. Also move the other "Accept all non-intercontainer outgoing packets"
   rule to earlier.  This gives a small performance benefit since it's
   also a commonly used rule, and it makes sense to logically group it
   next to the ctstate rule.

Docker-DCO-1.1-Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com> (github: jpoimboe)
check for errors in call, not readBody

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
vendor: add github.com/coreos/go-systemd/activation

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
server: add socket activation

This adds the ability to socket activate docker by passing in
`-H fd://*` along with examples systemd configuration files.

The fastest way to test this is to run:

```
/usr/lib/systemd/systemd-activate -l 127.0.0.1:2001 /usr/bin/docker -d -H 'fd://*'
docker -H tcp://127.0.0.1:2001 ps
```

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
fix(docs): fixup based on changes in master

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
docs: improve the socket activation cli docs

as suggested by SvenDowideit expand the docs to have more information on
socket activation.

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
fix(docs): add Systemd in front of socket activation

Suggested by SvenDowideit.

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
Move listenfd to utility package

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
Allow fd:// like unix:// and tcp://

Somthing like 20605eb310f0b57bd06eea80ec63c5022fc83bde

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
fix(cli.rst): add missing underscores

As suggested by @metalivedev

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
fix(contrib/init/systemd): remove mount rprivate

Docker does this now via 157d99a72786c454dfaad8b0800914cc80879aa8

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
chore(*): go fmt

I noticed that travis was failing, go fmt to make it happy.

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
vendor: bump github.com/coreos/go-systemd/activation

tests now work in the Docker tree with

`go test github.com/coreos/go-systemd/activation`

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
chore(systemd): use activation.Listeners instead of Files

Use this Listeners() API that was exposed to save a few more lines of
boiler plate code.

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
chore(coreos/go-systemd): copy to github.com/dotcloud/docker/systemd/pkg/activation

Via https://github.com/dotcloud/docker/pull/3105#issuecomment-32807547

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
fix(api): , _ removed to simplify code in range

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
Add --ip-forward flag to daemon (enabled by default) which automatically sets "net.ipv4.ip_forward" to 1

See also https://groups.google.com/d/topic/docker-dev/DCjF5Prx7HA/discussion

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Merge pull request #3759 from jpoimboe/links-iptables-cleanup

network: remove unnecessary links iptables rule for return traffic
Merge pull request #3801 from tianon/ip-forward

Add --ip-forward flag to daemon (enabled by default)
remove ip_forward warning

Now that docker sets /proc/sys/net/ipv4/ip_forward by default (unless
the user manually specifies "-ip-forward=false"), there's no need to
warn if its disabled.

Docker-DCO-1.1-Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com> (github: jpoimboe)