ITQC/containernetworking-plugins
24
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 34 Wiki Activity

bridge: Add macspoofchk support

Browse Source 
The new macspoofchk field is added to the bridge plugin to support
anti-mac-spoofing.
When the parameter is enabled, traffic is limited to the mac addresses
of the container interface (the veth peer that is placed in the
container ns).
Any traffic that exits the pod is checked against the source mac address
that is expected. If the mac address is different, the frames are
dropped.

The implementation is using nftables and should only be used on nodes
that support it.

Signed-off-by: Edward Haas <edwardh@redhat.com>
This commit is contained in:
Edward Haas
2021-06-15 21:12:57 +03:00
parent 8632ace977
commit 081ed44a1d
24 changed files with 2132 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
go.mod
View File

@ -15,6 +15,7 @@ require (
github.com/godbus/dbus/v5 v5.0.4
github.com/j-keck/arping v1.0.2
github.com/mattn/go-shellwords v1.0.12
github.com/networkplumbing/go-nft v0.2.0
github.com/onsi/ginkgo v1.16.4
github.com/onsi/gomega v1.15.0
github.com/safchain/ethtool v0.0.0-20210803160452-9aa261dae9b1