GitHub Actions recently updated ubuntu-latest to 22.04 [1], which now
defaults to nfttables (rather than iptables-legacy) [2]. The portmap
tests in this project are written with the expectation that expected
error message for one test is in the iptables-legacy format.
This commit updates the check to make it work for both the
iptables-legecy and iptables-nftables variants.
References:
[1]: 4aba37bd3b
[2]: https://ubuntu.com/blog/whats-new-in-security-for-ubuntu-22-04-lts
Signed-off-by: Emily Shepherd <emily@redcoat.dev>
This commit changes the order of substituting sysctl path to first handle
. to / change, before substituting the interface name.
This is needed as vlan interfaces have a . in the name, which should not
be changed.
Signed-off-by: mmirecki <mmirecki@redhat.com>
These were previously left intact, even when exiting gracefully. As the
daemon also fails if the socket already exists, it became the caller's
responsibilityto check for and cleanup old socket files when performing
graceful / deliberate restarts.
Signed-off-by: Emily Shepherd <emily@redcoat.dev>
Leverages the Linux dummy interface type to create network interfaces
that permists routing packets through the Linux kernel without
them being transmitted.
This solution allows use of arbitrary non-loopback IP addresses within
the container.
Related to #466
Signed-off-by: Mircea Iordache-Sica <mircea@arista.com>
Currently, hostname is set in the original DHCPREQUEST but not the
renewal. With some DHCP server implementations (such as FreeBSD dhcpd),
this leads to the hostname being cleared in the lease table.
This behavior is inconsistent with other DHCP clients such as dhclient
which set the hostname on the renewal request as well. To fix, use the
same options for acquire and renew.
This is compatible with RFC 2131 (see table 5).
Signed-off-by: Akhil Velagapudi <4@4khil.com>
Previously, the bridge plugin ignored DNS settings returned
from an IPAM plugin (e.g. the host-local plugin parsing
resolv.conf to configure DNS). With this change, the bridge plugin
uses IPAM DNS settings.
Similarly to #388, this change will use incoming DNS settings if set,
otherwise IPAM plugin returned DNS settings
Signed-off-by: Kern Walster <walster@amazon.com>
This PR bring V2 API support into win-overlay CNI. With the current V1
API, only docker runtime works for win-overlay. By bringing new changes, we
should be able to use containerd as the runtime.Below are the key
points regarding this implementation.
1. Clear seperation for V1 & V2 API support
2. New cni.conf sample that works for win-overlay
Signed-off-by: selansen <esiva@redhat.com>
Signed-off-by: mansikulkarni96 <mankulka@redhat.com>
The client id was constructed differently in the acquire
function compared to the release and renew functions,
which caused the dhcp-server to consider it a different client.
This is now encapsulated in a common function.
Signed-off-by: Fabian Wiesel <fabian.wiesel@sap.com>
checkPorts would return nil rather than an error if the per-container
DNAT chain didn't exist, meaning CHECK would erroneously return
success rather than failure.
chain.check() already (correctly) checks that the chain exists, so
there's no need to do it separately before calling that anyway.
Signed-off-by: Dan Winship <danwinship@redhat.com>
Calling AddPort before AddProtocol returns an error, which means ConntrackDeleteFilter has been called without port filter.
Signed-off-by: Sang Heon Lee <developistBV@gmail.com>
