From: Stefano Brivio <sbrivio@redhat.com>
To: David Gibson <david@gibson.dropbear.id.au>
Cc: passt-dev@passt.top
Subject: Re: [PATCH 0/2] Don't expose container loopback services to the host
Date: Wed, 25 Sep 2024 10:20:09 +0200 [thread overview]
Message-ID: <20240925102009.62b9a0ce@elisabeth> (raw)
In-Reply-To: <20240925065436.2064995-1-david@gibson.dropbear.id.au>
On Wed, 25 Sep 2024 16:54:34 +1000
David Gibson <david@gibson.dropbear.id.au> wrote:
> podman issue #24045 pointed out that pasta's spliced forwarding logic
> can expose services within the namespace bound only to 127.0.0.1 or
> ::1 to the host. However, the namespace probably expects those to
> only be accessible to itself, so that's probably not what we want.
...that's what I thought would be desirable as you see from patch 1/2
and https://github.com/containers/podman/pull/24064.
I think you're right in general but I would feel more confident
applying this if 1. we briefly documented this in the man page and 2.
we added an option to enable the current behaviour back (1. can be
documented as part of documenting 2., then).
The new fwd_nat_from_host() implementation seems to make this relatively
trivial, but I'm not really familiar with it yet so I might be wrong.
--
Stefano
prev parent reply other threads:[~2024-09-25 8:20 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-25 6:54 [PATCH 0/2] Don't expose container loopback services to the host David Gibson
2024-09-25 6:54 ` [PATCH 1/2] test: Clarify test for spliced inbound transfers David Gibson
2024-09-25 6:54 ` [PATCH 2/2] fwd: Direct inbound spliced forwards to the guest's external address David Gibson
2024-09-25 8:29 ` Stefano Brivio
2024-09-26 2:02 ` David Gibson
2024-09-25 8:20 ` Stefano Brivio [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240925102009.62b9a0ce@elisabeth \
--to=sbrivio@redhat.com \
--cc=david@gibson.dropbear.id.au \
--cc=passt-dev@passt.top \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://passt.top/passt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).