Add an iptables rule to drop packets that conntrack considers invalid. #957
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mccv1r0
force-pushed
the
invalid-conntrack
branch
2 times, most recently
from
72ef7d2
to
246489a
Compare
|
The existing conntrack entry should stick around for 2*MSL to address any in flight packets from needing such a rule. |
mccv1r0
force-pushed
the
invalid-conntrack
branch
from
d364c7d
to
3922f9c
Compare
One rule for the life of CNI vs one for ipMasq, portmap etc.
This is an alternative to adding an unique container IP specific rules
every cniADD for ipMasq, portmap and then removing when cniDel is called.
Fixes plugins containernetworking#816
gofumpt
Keep lint happy?
Signed-off-by: Michael Cambria <mcambria@redhat.com>
mccv1r0
force-pushed
the
invalid-conntrack
branch
2 times, most recently
from
6686e4b
to
7ee6987
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add an iptables rule to drop packets that conntrack considers invalid.
One rule for the life of CNI vs one for ipMasq, portmap etc.
This is an alternative to adding an unique container IP specific rules every cniADD for ipMasq, portmap and then removing when cniDel is called.
Fixes plugins 816
Signed-off-by: Michael Cambria mcambria@redhat.com