gvisor - Container Runtime Sandbox

Age	Commit message (Collapse)	Author
2020-03-18	iptables: deflake DropTCP*Port tests	Kevin Krakauer
	These tests could timeout because net.DialTCP didn't respect the timeout.
2020-03-16	Merge pull request #1943 from kevinGC:ipt-filter-ip	gVisor bot
	PiperOrigin-RevId: 301197007
2020-03-11	iptables: ready tests to be enabled in kokoro	Kevin Krakauer
	Fixed flakes (tested via --runs_per_test=100) and added skips for not-yet-implemented features. Once submitted, the iptables tests will be ready to enable in kokoro.
2020-02-26	iptables: filter by IP address (and range)	Kevin Krakauer
	Enables commands such as: $ iptables -A INPUT -d 127.0.0.1 -j ACCEPT $ iptables -t nat -A PREROUTING ! -d 127.0.0.1 -j REDIRECT Also adds a bunch of REDIRECT+destination tests.
2020-02-18	iptables: use "-t nat" for NAT tests	gVisor bot
	PiperOrigin-RevId: 295835807
2020-02-13	We can now create and jump in iptables. For example:	Kevin Krakauer
	$ iptables -N foochain $ iptables -A INPUT -j foochain
2020-01-23	Merge pull request #1617 from kevinGC:iptables-write-filter-proto	gVisor bot
	PiperOrigin-RevId: 291249314
2020-01-21	Merge branch 'master' into iptables-write-filter-proto	Kevin Krakauer

2020-01-17	Merge pull request #1541 from nybidari:iptables	gVisor bot
	PiperOrigin-RevId: 290273561
2020-01-13	Add test for iptables TCP rule	Nayana Bidari
	Added tests for tcp protocol with input and output rules including options sport and dport Increased timeout in iptables_test as TCP tests were timing out with existing value.
2020-01-09	Added a test that we don't pass yet	Kevin Krakauer

2019-12-12	Add iptables testing framework.	Kevin Krakauer
	It would be preferrable to test iptables via syscall tests, but there are some problems with that approach: * We're limited to loopback-only, as syscall tests involve only a single container. Other link interfaces (e.g. fdbased) should be tested. * We'd have to shell out to call iptables anyways, as the iptables syscall interface itself is too large and complex to work with alone. * Running the Linux/native version of the syscall test will require root, which is a pain to configure, is inherently unsafe, and could leave host iptables misconfigured. Using the go_test target allows there to be no new test runner. PiperOrigin-RevId: 285274275