Re: [PATCH v5 0/7] Don't expose container loopback services to the host

[Stefano Brivio <sbrivio@redhat.com>]

On Fri, 18 Oct 2024 12:35:49 +1100
David Gibson <david@gibson.dropbear.id.au> wrote:

> podman issue #24045 pointed out that pasta's spliced forwarding logic
> can expose services within the namespace bound only to 127.0.0.1 or
> ::1 to the host.  However, the namespace probably expects those to
> only be accessible to itself, so that's probably not what we want.
> 
> This changes our forwarding logic so as not to do this.  Note that the
> podman tests will currently fail with this series, I've submitted
> podman PR https://github.com/containers/podman/pull/24064 to fix that.
> 
> Link: https://github.com/containers/podman/issues/24045
> 
> Changes since v4:
>  * Handled a few cases where we need to wait for DAD which were missed
>    in v4.
>  * Fix a grammar error in comment
> Changes since v3:
>  * Added several extra patches working around failures on Debian,
>    because its dhclient-script doesn't wait for DAD to complete
> Changes since v2:
>  * Add new field do structure comment
> Changes since v1:
>  * Add --host-lo-to-ns-lo option to preserve the old behaviour
>  * Clarify the new behaviour in the man page
>  * Add some extra patches making some other corrections to the man
>    page
> 
> David Gibson (7):
>   arp: Fix a handful of small warts
>   test: Explicitly wait for DAD to complete on SLAAC addresses
>   test: Wait for DAD on DHCPv6 addresses
>   passt.1: Mark --stderr as deprecated more prominently
>   passt.1: Clarify and update "Handling of local addresses" section
>   test: Clarify test for spliced inbound transfers
>   fwd: Direct inbound spliced forwards to the guest's external address

Applied.

-- 
Stefano