podman

mirror of https://github.com/containers/podman.git synced 2025-09-19 12:56:57 +08:00

Files

Paul Holzinger e88d8dbeae fix rootless port forwarding with network dis-/connect

The rootlessport forwarder requires a child IP to be set. This must be a
valid ip in the container network namespace. The problem is that after a
network disconnect and connect the eth0 ip changed. Therefore the
packages are dropped since the source ip does no longer exists in the
netns.
One solution is to set the child IP to 127.0.0.1, however this is a
security problem. [1]

To fix this we have to recreate the ports after network connect and
disconnect. To make this work the rootlessport process exposes a socket
where podman network connect/disconnect connect to and send to new child
IP to rootlessport. The rootlessport process will remove all ports and
recreate them with the new correct child IP.

Also bump rootlesskit to v0.14.3 to fix a race with RemovePort().

Fixes #10052

[1] https://nvd.nist.gov/vuln/detail/CVE-2021-20199

Signed-off-by: Paul Holzinger <pholzing@redhat.com>

2021-08-03 16:29:09 +02:00

_static

Cirrus: Upload swagger YAML in every context

2021-01-21 10:26:57 -05:00

markdown

fix rootless port forwarding with network dis-/connect

2021-08-03 16:29:09 +02:00

Commands.rst

Use secrets and machine rst file properly

2021-06-01 15:31:56 -04:00

conf.py

Add host.serviceIsRemote to podman info results