erabo/spiegel_podman
1
0
Fork 0
mirror of https://github.com/podman-container-tools/podman.git synced 2026-09-13 19:17:52 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
spiegel_podman/libpod
History
Paul Holzinger e88d8dbeae
fix rootless port forwarding with network dis-/connect 
The rootlessport forwarder requires a child IP to be set. This must be a
valid ip in the container network namespace. The problem is that after a
network disconnect and connect the eth0 ip changed. Therefore the
packages are dropped since the source ip does no longer exists in the
netns.
One solution is to set the child IP to 127.0.0.1, however this is a
security problem. [1]

To fix this we have to recreate the ports after network connect and
disconnect. To make this work the rootlessport process exposes a socket
where podman network connect/disconnect connect to and send to new child
IP to rootlessport. The rootlessport process will remove all ports and
recreate them with the new correct child IP.

Also bump rootlesskit to v0.14.3 to fix a race with RemovePort().

Fixes #10052

[1] https://nvd.nist.gov/vuln/detail/CVE-2021-20199

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2021-08-03 16:29:09 +02:00
..
common Set blob cache directory based on GraphDriver 2019-03-29 08:27:33 -04:00
define podman pod create --pid flag 2021-07-15 10:34:09 -04:00
driver bump go module to v3 2021-02-22 09:03:51 +01:00
events Add ExecDied event and use it to retrieve exit codes 2021-06-10 14:17:41 -04:00
layers Initial checkin from CRI-O repo 2017-11-01 11:24:59 -04:00
linkmode Add podman static build 2020-05-11 13:11:07 +02:00
lock bump go module to v3 2021-02-22 09:03:51 +01:00
logs Implemented Until Query Parameter for Containers/logs 2021-07-09 12:21:46 -04:00
network dual-stack network: fix duplicated subnet assignment 2021-07-26 14:05:33 +02:00
plugin bump go module to v3 2021-02-22 09:03:51 +01:00
shutdown Fixes from make codespell 2021-04-21 13:16:33 -04:00
boltdb_state.go Removing a non existing container API should return 404 2021-03-10 04:08:29 -05:00
boltdb_state_internal.go Add --requires flag to podman run/create 2021-04-06 14:01:31 -04:00
boltdb_state_linux.go bump go module to v3 2021-02-22 09:03:51 +01:00
boltdb_state_unsupported.go podman-remote inspect 2019-01-18 15:43:11 -06:00
common_test.go bump go module to v3 2021-02-22 09:03:51 +01:00
container.go ps: support the container notation for ps --filter network=... 2021-07-30 19:31:05 +05:30
container_api.go Merge pull request #10910 from adrianreber/2021-07-12-checkpoint-restore-into-pod 2021-07-28 14:48:28 +02:00
container_commit.go migrate Podman to containers/common/libimage 2021-05-05 11:30:12 +02:00
container_config.go Support uid,gid,mode options for secrets 2021-05-17 14:35:55 -04:00
container_copy_linux.go support container to container copy 2021-07-27 15:32:23 +02:00
container_copy_unsupported.go podman cp: support copying on tmpfs mounts 2021-03-04 15:43:12 +01:00
container_exec.go Fix resize race with podman exec -it 2021-06-16 16:43:30 +02:00
container_graph.go bump go module to v3 2021-02-22 09:03:51 +01:00
container_graph_test.go bump go module to v3 2021-02-22 09:03:51 +01:00
container_inspect.go ps: support the container notation for ps --filter network=... 2021-07-30 19:31:05 +05:30
container_internal.go Drop podman create --storage-opt container flag 2021-07-20 16:36:10 -04:00
container_internal_linux.go Support checkpoint/restore with pods 2021-07-27 16:10:44 +02:00
container_internal_linux_test.go Make an entry in /etc/group when we modify /etc/passwd 2020-09-10 13:02:31 -04:00
container_internal_test.go Refactor container config 2020-07-23 10:18:14 -04:00
container_internal_unsupported.go Fix permissions on initially created named volumes 2021-06-14 11:56:48 -04:00
container_linux.go Do not fetch pod and ctr State on retrieval in Bolt 2018-07-31 14:19:50 +00:00
container_log.go Implemented Until Query Parameter for Containers/logs 2021-07-09 12:21:46 -04:00
container_log_linux.go Implemented --until flag for libpod's container logs 2021-07-22 10:56:56 -04:00
container_log_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
container_path_resolution.go Fix infinite loop in isPathOnVolume 2021-05-06 19:24:14 +03:00
container_stat_linux.go podman cp: evaluate symlink correctly when copying from container 2021-03-09 10:45:15 +01:00
container_stat_unsupported.go podman cp: support copying on tmpfs mounts 2021-03-04 15:43:12 +01:00
container_top_linux.go bump go module to v3 2021-02-22 09:03:51 +01:00
container_top_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
container_unsupported.go Do not fetch pod and ctr State on retrieval in Bolt 2018-07-31 14:19:50 +00:00
container_validate.go Podman Pod Create --cpus and --cpuset-cpus flags 2021-06-23 13:47:57 -04:00
diff.go vendor containers/common@main 2021-07-16 14:19:56 +02:00
events.go Add ExecDied event and use it to retrieve exit codes 2021-06-10 14:17:41 -04:00
healthcheck.go bump go module to v3 2021-02-22 09:03:51 +01:00
healthcheck_linux.go bump go module to v3 2021-02-22 09:03:51 +01:00
healthcheck_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
info.go remove pkg/registries 2021-06-25 09:56:21 +02:00
kube.go Adds support to preserve auto update labels in generate and play kube 2021-05-06 21:21:43 -06:00
mounts_linux.go set root propagation based on volume properties 2018-11-26 13:55:02 +01:00
networking_linux.go fix rootless port forwarding with network dis-/connect 2021-08-03 16:29:09 +02:00
networking_slirp4netns.go fix rootless port forwarding with network dis-/connect 2021-08-03 16:29:09 +02:00
networking_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
oci.go Fix resize race with podman exec -it 2021-06-16 16:43:30 +02:00
oci_attach_linux.go Fix resize race with podman exec -it 2021-06-16 16:43:30 +02:00
oci_attach_unsupported.go prune remotecommand dependency 2021-02-25 10:02:41 -06:00
oci_conmon.go podman: add new cgroup mode split 2020-06-25 17:16:12 +02:00
oci_conmon_exec_linux.go Perform a one-sided close of HTTP attach conn on EOF 2021-07-13 16:26:53 -04:00
oci_conmon_linux.go Support checkpoint/restore with pods 2021-07-27 16:10:44 +02:00
oci_conmon_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
oci_missing.go Fix resize race with podman exec -it 2021-06-16 16:43:30 +02:00
oci_util.go bump go module to v3 2021-02-22 09:03:51 +01:00
options.go --infra-name command line argument 2021-07-15 21:27:51 -03:00
pod.go --infra-name command line argument 2021-07-15 21:27:51 -03:00
pod_api.go podman pod create --pid flag 2021-07-15 10:34:09 -04:00
pod_internal.go cgroup: fix rootless --cgroup-parent with pods 2021-05-06 08:33:28 +02:00
pod_status.go bump go module to v3 2021-02-22 09:03:51 +01:00
pod_top_linux.go bump go module to v3 2021-02-22 09:03:51 +01:00
pod_top_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
reset.go migrate Podman to containers/common/libimage 2021-05-05 11:30:12 +02:00
runtime.go Remove GetStore function from Libpod 2021-07-08 14:22:33 -04:00
runtime_cstorage.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_ctr.go ps: support the container notation for ps --filter network=... 2021-07-30 19:31:05 +05:30
runtime_img.go migrate Podman to containers/common/libimage 2021-05-05 11:30:12 +02:00
runtime_migrate.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_migrate_unsupported.go Use Libpod tmpdir for pause path 2020-12-02 14:18:37 -05:00
runtime_pod.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_pod_infra_linux.go --infra-name command line argument 2021-07-15 21:27:51 -03:00
runtime_pod_linux.go podman pod create --pid flag 2021-07-15 10:34:09 -04:00
runtime_pod_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_renumber.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_volume.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_volume_linux.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_volume_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
state.go Rewrite Rename backend in a more atomic fashion 2021-03-02 13:30:28 -05:00
state_test.go Remove in-memory state implementation 2021-04-13 14:00:38 -04:00
stats.go Podman Stats additional features 2021-06-23 09:23:40 -04:00
stats_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
storage.go turn hidden --trace into a NOP 2021-03-08 09:22:42 +01:00
util.go Use seccomp_profile as default profile if defined in containers.conf 2021-04-28 15:19:48 +02:00
util_linux.go bump go module to v3 2021-02-22 09:03:51 +01:00
util_linux_test.go Fix mismatch between log messages and behavior of libpod.LabelVolumePath. 2020-09-13 23:24:15 -04:00
util_test.go bump go module to v3 2021-02-22 09:03:51 +01:00
util_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
volume.go bump go module to v3 2021-02-22 09:03:51 +01:00
volume_inspect.go bump go module to v3 2021-02-22 09:03:51 +01:00
volume_internal.go Fix volumes with uid and gid options 2021-06-11 13:27:08 +02:00
volume_internal_linux.go [NO TESTS NEEDED] Fix rootless volume plugins 2021-03-24 22:53:53 +03:00
volume_internal_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00