The new macspoofchk field is added to the bridge plugin to support
anti-mac-spoofing.
When the parameter is enabled, traffic is limited to the mac addresses
of the container interface (the veth peer that is placed in the
container ns).
Any traffic that exits the pod is checked against the source mac address
that is expected. If the mac address is different, the frames are
dropped.
The implementation is using nftables and should only be used on nodes
that support it.
Signed-off-by: Edward Haas <edwardh@redhat.com>
go get github.com/containernetworking/cni@62e54113f44a762923fd2ef3115cda92a2111ca2
go mod vendor
go mod tidy
Signed-off-by: Dan Williams <dcbw@redhat.com>
Closes #544
The above issue describes a situation where using the bridge plugin
with IPv6 addresses prevented `DEL` from working correctly.
`DEL` seems to be failing in the body of `TeardownIPMasq`
This arises because:
* twice delete postrouting rules: `ipn.String()` `ipn.IP.String()` #279
* we are using a version of go-iptables which is bugged for v6
PR github.com/coreos/go-iptables/pull/74 describes why this does
not work. The error message is not being checked correctly.
Using a later version of go-iptables means that
* when the second `ipt.Delete` fails (this is okay)
* we will correctly interpret this as an non-fatal error
* `TeardownIPMasq` will not prematurely exit the method
* `ipt.ClearChain` now can run
* `ipt.DeleteChain` now can run
This explains why this was working for v4 but not v6
This commit was amended to include v0.5.0 instead of a pseudo-version
v0.4.6-0.20200318170312-12696f5c9108
Signed-off-by: toby lorne <toby@toby.codes>
bump the go-iptables module to v0.4.5 to avoid
concurrency issues with the portmap plugin and
errors related to iptables not able to hold the
lock.
Signed-off-by: Antonio Ojea <antonio.ojea.garcia@gmail.com>
Update github.com/safchain/ethtool to fix the compilation
error on 386. Also added 386 to the tarvis yaml.
Fixes #322
Signed-off-by: Moshe Levi <moshele@mellanox.com>
interfaces using dhcp ipam.
Vendor latest dhcp4server, dhcp4client, dhcp4
Added additional tests for new functionality in dhcp2_test.go
Wrap d2g dhcp4client calls with our own which add clientID to packet.
