<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=koi8-r">
</head>
<body>
<div dir="auto">
<div><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">18 янв. 2017 г. 9:49 AM пользователь Andrey Vagin <avagin@virtuozzo.com> написал:<br type="attribution">
<blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><font size="2"><span style="font-size:10pt"></span></font>
<div>On Tue, Jan 17, 2017 at 11:01:29PM -0800, Stanislav Kinsburskiy wrote:<br>
> <br>
> <br>
> 18 янв. 2017 г. 4:31 AM пользователь Andrey Vagin <avagin@virtuozzo.com><br>
> написал:<br>
> <br>
> On Tue, Jan 17, 2017 at 12:08:18PM -0800, Stanislav Kinsburskiy wrote:<br>
> ><br>
> ><br>
> > 17 янв. 2017 г. 9:05 PM пользователь Andrey Vagin <avagin@virtuozzo.com><br>
> > написал:<br>
> ><br>
> > On Mon, Jan 16, 2017 at 07:04:50PM +0300, Stanislav Kinsburskiy<br>
> wrote:<br>
> > > The intention of commit 61b8fc264f55e15dea90350834a50d551d33bffa<br>
> was to<br>
> > drop<br>
> > > local traffic only.<br>
> > > But there was a side effect: iptables rules were blocking all the<br>
> traffic<br>
> > > including external communication.<br>
> <br>
> The intention of my commit wat to block all traffic to not think how to<br>
> block it externally...<br>
> <br>
> <br>
> Well, I see.<br>
> Sad, that commit message explains it differently.<br>
> <br>
> <br>
> <br>
> <br>
> > > While it's not a big problem by itself, it significantly<br>
> complicates<br>
> > external<br>
> > > communication when needed (say, in case of NFS files), because<br>
> forces one<br>
> > to<br>
> > > unmask NFS routes within container.<br>
> <br>
> How are you going to block all external traffic except nfs?<br>
> <br>
</div>
</div>
</blockquote>
</div>
</div>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">I don't. P.haul does.</div>
<div dir="auto">Curently via iface down.</div>
<div dir="auto">Will be replaced by drop via ebtables on host.</div>
<div dir="auto"><br>
</div>
<div dir="auto">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div>> <br>
> Simply block all the external traffic. Then unmask routes for NFS ports by<br>
> server IP. One by one.<br>
<br>
A container can use veth which is connected to a bridge. In this case<br>
veth can be disconned of connected to the bridge. How are you going to<br>
filter NFS traffic in this case?<br>
</div>
</div>
</blockquote>
</div>
</div>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">Disconnected or connected when?</div>
<div dir="auto">During dump?</div>
<div dir="auto"><br>
</div>
<div dir="auto">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div><br>
> <br>
> <br>
> <br>
> > > Let's get rid of this side effect by limiting rules to loopback<br>
> > interface.<br>
> > > External traffic blocking is controlled outside containers anyway.<br>
> ><br>
> > * Does it controlled for venet?<br>
> ><br>
> ><br>
> > Sorry, I don't understand the question.<br>
> <br>
> How do we block traffic which go via venet?<br>
> <br>
</div>
</div>
</blockquote>
</div>
</div>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">On host via iptables.</div>
<div dir="auto"><br>
</div>
<div dir="auto">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div>> <br>
> This one is considered as external, and has to be blocked elsewhere.<br>
> <br>
> <br>
> ><br>
> ><br>
> > * Both ends of a local tcp connection can be bond to an ip address<br>
> > (which is set to any interface). I am not sure that this hack will<br>
> > work for this case.<br>
> ><br>
> ><br>
> > Well, I was assured, that even it this case traffic is considered as<br>
> local, and<br>
> > transfered via loopback.<br>
> <br>
> Yes, you are right, I've checked. But this patch will break Docker,<br>
> because it doesn't block traffic externally.<br>
> <br>
> <br>
> But it should, isn't it?<br>
<br>
According to my plan it should not ;). But the plan may be wrong. Anyway<br>
it breaks backward compatibility and we need to add an option to block<br>
network by this way.<br>
</div>
</div>
</blockquote>
</div>
</div>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">Current solution doesn't block packets delivery to tcpdump (Packet sockets, to be precise) within container. Otherwise it would be perfect.</div>
<div dir="auto"><br>
</div>
<div dir="auto">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div><br>
Actually I am not sure that it will help you to solve a problem with<br>
nfs...<br>
</div>
</div>
</blockquote>
</div>
</div>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">Problem with NFS can be solved without this patch.</div>
<div dir="auto">The intention of the patch is to bring logic, mentioned in the comment, to the code.</div>
<div dir="auto">And also simplify NFS unmasking.</div>
<div dir="auto">Nevetheless, this patch is not an essential one.</div>
<div dir="auto">If it breaks Docker, then, probably, it doesn'tmake much sense to take it.</div>
<div dir="auto"><br>
</div>
<div dir="auto">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div><br>
> <br>
> <br>
> <br>
> ><br>
> ><br>
> ><br>
> > ><br>
> > > Signed-off-by: Stanislav Kinsburskiy <skinsbursky@virtuozzo.com><br>
> > > ---<br>
> > > criu/net.c | 8 ++++----<br>
> > > 1 file changed, 4 insertions(+), 4 deletions(-)<br>
> > ><br>
> > > diff --git a/criu/net.c b/criu/net.c<br>
> > > index 080c617..d75c9fa 100644<br>
> > > --- a/criu/net.c<br>
> > > +++ b/criu/net.c<br>
> > > @@ -1547,8 +1547,8 @@ static int network_lock_internal()<br>
> > > {<!-- --><br>
> > > char conf[] = "*filter\n"<br>
> > > ":CRIU - [0:0]\n"<br>
> > > - "-I INPUT -j CRIU\n"<br>
> > > - "-I OUTPUT -j CRIU\n"<br>
> > > + "-I INPUT -i lo -j CRIU\n"<br>
> > > + "-I OUTPUT -o lo -j CRIU\n"<br>
> > > "-A CRIU -j DROP\n"<br>
> > > "COMMIT\n";<br>
> > > int ret = 0, nsret;<br>
> > > @@ -1571,8 +1571,8 @@ static int network_unlock_internal()<br>
> > > {<!-- --><br>
> > > char conf[] = "*filter\n"<br>
> > > ":CRIU - [0:0]\n"<br>
> > > - "-D INPUT -j CRIU\n"<br>
> > > - "-D OUTPUT -j CRIU\n"<br>
> > > + "-D INPUT -i lo -j CRIU\n"<br>
> > > + "-D OUTPUT -o lo -j CRIU\n"<br>
> > > "-X CRIU\n"<br>
> > > "COMMIT\n";<br>
> > > int ret = 0, nsret;<br>
> > ><br>
> ><br>
> ><br>
> <br>
> <br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</body>
</html>