<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="auto">
<div><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">18 янв. 2017 г. 4:31 AM пользователь Andrey Vagin <avagin@virtuozzo.com> написал:<br type="attribution">
<blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><font size="2"><span style="font-size:10pt"></span></font>
<div>On Tue, Jan 17, 2017 at 12:08:18PM -0800, Stanislav Kinsburskiy wrote:<br>
> <br>
> <br>
> 17 янв. 2017 г. 9:05 PM пользователь Andrey Vagin <avagin@virtuozzo.com><br>
> написал:<br>
> <br>
> On Mon, Jan 16, 2017 at 07:04:50PM +0300, Stanislav Kinsburskiy wrote:<br>
> > The intention of commit 61b8fc264f55e15dea90350834a50d551d33bffa was to<br>
> drop<br>
> > local traffic only.<br>
> > But there was a side effect: iptables rules were blocking all the traffic<br>
> > including external communication.<br>
<br>
The intention of my commit wat to block all traffic to not think how to<br>
block it externally...<br>
</div>
</div>
</blockquote>
</div>
</div>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">Well, I see.</div>
<div dir="auto">Sad, that commit message explains it differently.</div>
<div dir="auto"><br>
</div>
<div dir="auto">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div><br>
<br>
> > While it's not a big problem by itself, it significantly complicates<br>
> external<br>
> > communication when needed (say, in case of NFS files), because forces one<br>
> to<br>
> > unmask NFS routes within container.<br>
<br>
How are you going to block all external traffic except nfs?<br>
</div>
</div>
</blockquote>
</div>
</div>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">Simply block all the external traffic. Then unmask routes for NFS ports by server IP. One by one.</div>
<div dir="auto"><br>
</div>
<div dir="auto">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div><br>
> > Let's get rid of this side effect by limiting rules to loopback<br>
> interface.<br>
> > External traffic blocking is controlled outside containers anyway.<br>
> <br>
> * Does it controlled for venet?<br>
> <br>
> <br>
> Sorry, I don't understand the question.<br>
<br>
How do we block traffic which go via venet?<br>
</div>
</div>
</blockquote>
</div>
</div>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">This one is considered as external, and has to be blocked elsewhere.</div>
<div dir="auto"><br>
</div>
<div dir="auto">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div>> <br>
> <br>
> * Both ends of a local tcp connection can be bond to an ip address<br>
> (which is set to any interface). I am not sure that this hack will<br>
> work for this case.<br>
> <br>
> <br>
> Well, I was assured, that even it this case traffic is considered as local, and<br>
> transfered via loopback.<br>
<br>
Yes, you are right, I've checked. But this patch will break Docker,<br>
because it doesn't block traffic externally.<br>
</div>
</div>
</blockquote>
</div>
</div>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">But it should, isn't it?</div>
<div dir="auto"><br>
</div>
<div dir="auto">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div><br>
> <br>
> <br>
> <br>
> ><br>
> > Signed-off-by: Stanislav Kinsburskiy <skinsbursky@virtuozzo.com><br>
> > ---<br>
> > criu/net.c | 8 ++++----<br>
> > 1 file changed, 4 insertions(+), 4 deletions(-)<br>
> ><br>
> > diff --git a/criu/net.c b/criu/net.c<br>
> > index 080c617..d75c9fa 100644<br>
> > --- a/criu/net.c<br>
> > +++ b/criu/net.c<br>
> > @@ -1547,8 +1547,8 @@ static int network_lock_internal()<br>
> > {<!-- --><br>
> > char conf[] = "*filter\n"<br>
> > ":CRIU - [0:0]\n"<br>
> > - "-I INPUT -j CRIU\n"<br>
> > - "-I OUTPUT -j CRIU\n"<br>
> > + "-I INPUT -i lo -j CRIU\n"<br>
> > + "-I OUTPUT -o lo -j CRIU\n"<br>
> > "-A CRIU -j DROP\n"<br>
> > "COMMIT\n";<br>
> > int ret = 0, nsret;<br>
> > @@ -1571,8 +1571,8 @@ static int network_unlock_internal()<br>
> > {<!-- --><br>
> > char conf[] = "*filter\n"<br>
> > ":CRIU - [0:0]\n"<br>
> > - "-D INPUT -j CRIU\n"<br>
> > - "-D OUTPUT -j CRIU\n"<br>
> > + "-D INPUT -i lo -j CRIU\n"<br>
> > + "-D OUTPUT -o lo -j CRIU\n"<br>
> > "-X CRIU\n"<br>
> > "COMMIT\n";<br>
> > int ret = 0, nsret;<br>
> ><br>
> <br>
> <br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</body>
</html>