gvisor - Container Runtime Sandbox

Age	Commit message (Collapse)	Author
2020-07-31	iptables: support SO_ORIGINAL_DST	Kevin Krakauer
	Envoy (#170) uses this to get the original destination of redirected packets.
2020-07-28	ip6tables testing	Kevin Krakauer
	We skip gVisor tests for now, as ip6tables aren't yet implemented.
2020-07-24	Speed up some iptables tests	Kevin Krakauer
	Sending UDP packets in a loop can be done in a separate goroutine. We can't do this in ContainerAction because the container will terminate early. Locally, scripts/iptables_tests.sh runs ~40 seconds faster.
2020-07-08	ip6tables: handle both IPv4 and v6 addresses	Kevin Krakauer
	Enabling IPv6 in Docker caused IPv4 tests to fail because localAddrs didn't distinguish between address types. Example failure: https://source.cloud.google.com/results/invocations/203b2401-3333-4bec-9a56-72cc53d68ddd/log
2020-05-08	iptables - filter packets using outgoing interface.	gVisor bot
	Enables commands with -o (--out-interface) for iptables rules. $ iptables -A OUTPUT -o eth0 -j ACCEPT PiperOrigin-RevId: 310642286
2020-05-01	Support for connection tracking of TCP packets.	Nayana Bidari
	Connection tracking is used to track packets in prerouting and output hooks of iptables. The NAT rules modify the tuples in connections. The connection tracking code modifies the packets by looking at the modified tuples.
2020-04-23	Simplify Docker test infrastructure.	Adin Scannell
	This change adds a layer of abstraction around the internal Docker APIs, and eliminates all direct dependencies on Dockerfiles in the infrastructure. A subsequent change will automated the generation of local images (with efficient caching). Note that this change drops the use of bazel container rules, as that experiment does not seem to be viable. PiperOrigin-RevId: 308095430
2020-03-18	iptables: deflake DropTCP*Port tests	Kevin Krakauer
	These tests could timeout because net.DialTCP didn't respect the timeout.
2020-03-16	Merge pull request #1943 from kevinGC:ipt-filter-ip	gVisor bot
	PiperOrigin-RevId: 301197007
2020-03-11	iptables: ready tests to be enabled in kokoro	Kevin Krakauer
	Fixed flakes (tested via --runs_per_test=100) and added skips for not-yet-implemented features. Once submitted, the iptables tests will be ready to enable in kokoro.
2020-02-26	iptables: filter by IP address (and range)	Kevin Krakauer
	Enables commands such as: $ iptables -A INPUT -d 127.0.0.1 -j ACCEPT $ iptables -t nat -A PREROUTING ! -d 127.0.0.1 -j REDIRECT Also adds a bunch of REDIRECT+destination tests.
2020-02-18	iptables: use "-t nat" for NAT tests	gVisor bot
	PiperOrigin-RevId: 295835807
2020-02-13	We can now create and jump in iptables. For example:	Kevin Krakauer
	$ iptables -N foochain $ iptables -A INPUT -j foochain
2020-01-23	Merge pull request #1617 from kevinGC:iptables-write-filter-proto	gVisor bot
	PiperOrigin-RevId: 291249314
2020-01-21	Merge branch 'master' into iptables-write-filter-proto	Kevin Krakauer

2020-01-17	Merge pull request #1541 from nybidari:iptables	gVisor bot
	PiperOrigin-RevId: 290273561
2020-01-13	Add test for iptables TCP rule	Nayana Bidari
	Added tests for tcp protocol with input and output rules including options sport and dport Increased timeout in iptables_test as TCP tests were timing out with existing value.
2020-01-09	Added a test that we don't pass yet	Kevin Krakauer

2019-12-12	Add iptables testing framework.	Kevin Krakauer
	It would be preferrable to test iptables via syscall tests, but there are some problems with that approach: * We're limited to loopback-only, as syscall tests involve only a single container. Other link interfaces (e.g. fdbased) should be tested. * We'd have to shell out to call iptables anyways, as the iptables syscall interface itself is too large and complex to work with alone. * Running the Linux/native version of the syscall test will require root, which is a pain to configure, is inherently unsafe, and could leave host iptables misconfigured. Using the go_test target allows there to be no new test runner. PiperOrigin-RevId: 285274275