Merge pull request #11890 from Luap99/ports

libpod: deduplicate ports in db

13 files changed, 599 insertions, 148 deletions

diff --git a/libpod/boltdb_state_internal.go b/libpod/boltdb_state_internal.go
index 3e3c17a9e..e71d82736 100644
--- a/libpod/boltdb_state_internal.go
+++ b/libpod/boltdb_state_internal.go
@@ -384,6 +384,15 @@ func (s *BoltState) getContainerConfigFromDB(id []byte, config *ContainerConfig,
 		return errors.Wrapf(err, "error unmarshalling container %s config", string(id))
 	}
 
+	// convert ports to the new format if needed
+	if len(config.ContainerNetworkConfig.OldPortMappings) > 0 && len(config.ContainerNetworkConfig.PortMappings) == 0 {
+		config.ContainerNetworkConfig.PortMappings = ocicniPortsToNetTypesPorts(config.ContainerNetworkConfig.OldPortMappings)
+		// keep the OldPortMappings in case an user has to downgrade podman
+
+		// indicate the the config was modified and should be written back to the db when possible
+		config.rewrite = true
+	}
+
 	return nil
 }
 
diff --git a/libpod/common_test.go b/libpod/common_test.go
index 4662a33bd..67e29c265 100644
--- a/libpod/common_test.go
+++ b/libpod/common_test.go
@@ -41,18 +41,20 @@ func getTestContainer(id, name string, manager lock.Manager) (*Container, error)
 			ContainerNetworkConfig: ContainerNetworkConfig{
 				DNSServer: []net.IP{net.ParseIP("192.168.1.1"), net.ParseIP("192.168.2.2")},
 				DNSSearch: []string{"example.com", "example.example.com"},
-				PortMappings: []types.OCICNIPortMapping{
+				PortMappings: []types.PortMapping{
 					{
 						HostPort:      80,
 						ContainerPort: 90,
 						Protocol:      "tcp",
 						HostIP:        "192.168.3.3",
+						Range:         1,
 					},
 					{
 						HostPort:      100,
 						ContainerPort: 110,
 						Protocol:      "udp",
 						HostIP:        "192.168.4.4",
+						Range:         1,
 					},
 				},
 			},
diff --git a/libpod/container.go b/libpod/container.go
index 4d15c04c5..86989a02f 100644
--- a/libpod/container.go
+++ b/libpod/container.go
@@ -465,7 +465,7 @@ func (c *Container) NewNetNS() bool {
 // PortMappings returns the ports that will be mapped into a container if
 // a new network namespace is created
 // If NewNetNS() is false, this value is unused
-func (c *Container) PortMappings() ([]types.OCICNIPortMapping, error) {
+func (c *Container) PortMappings() ([]types.PortMapping, error) {
 	// First check if the container belongs to a network namespace (like a pod)
 	if len(c.config.NetNsCtr) > 0 {
 		netNsCtr, err := c.runtime.GetContainer(c.config.NetNsCtr)
diff --git a/libpod/container_config.go b/libpod/container_config.go
index 8f803d744..412be835f 100644
--- a/libpod/container_config.go
+++ b/libpod/container_config.go
@@ -78,6 +78,11 @@ type ContainerConfig struct {
 	// These containers must be started before this container is started.
 	Dependencies []string
 
+	// rewrite is an internal bool to indicate that the config was modified after
+	// a read from the db, e.g. to migrate config fields after an upgrade.
+	// This field should never be written to the db, the json tag ensures this.
+	rewrite bool `json:"-"`
+
 	// embedded sub-configs
 	ContainerRootFSConfig
 	ContainerSecurityConfig
@@ -232,7 +237,12 @@ type ContainerNetworkConfig struct {
 	// PortMappings are the ports forwarded to the container's network
 	// namespace
 	// These are not used unless CreateNetNS is true
-	PortMappings []types.OCICNIPortMapping `json:"portMappings,omitempty"`
+	PortMappings []types.PortMapping `json:"newPortMappings,omitempty"`
+	// OldPortMappings are the ports forwarded to the container's network
+	// namespace. As of podman 4.0 this field is deprecated, use PortMappings
+	// instead. The db will convert the old ports to the new structure for you.
+	// These are not used unless CreateNetNS is true
+	OldPortMappings []types.OCICNIPortMapping `json:"portMappings,omitempty"`
 	// ExposedPorts are the ports which are exposed but not forwarded
 	// into the container.
 	// The map key is the port and the string slice contains the protocols,
diff --git a/libpod/container_internal.go b/libpod/container_internal.go
index b9805faa3..19b48e14b 100644
--- a/libpod/container_internal.go
+++ b/libpod/container_internal.go
@@ -667,6 +667,19 @@ func (c *Container) refresh() error {
 	c.state.NetworkStatus = nil
 	c.state.NetworkStatusOld = nil
 
+	// Rewrite the config if necessary.
+	// Podman 4.0 uses a new port format in the config.
+	// getContainerConfigFromDB() already converted the old ports to the new one
+	// but it did not write the config to the db back for performance reasons.
+	// If a rewrite must happen the config.rewrite field is set to true.
+	if c.config.rewrite {
+		// SafeRewriteContainerConfig must be used with care. Make sure to not change config fields by accident.
+		if err := c.runtime.state.SafeRewriteContainerConfig(c, "", "", c.config); err != nil {
+			return errors.Wrapf(err, "failed to rewrite the config for container %s", c.config.ID)
+		}
+		c.config.rewrite = false
+	}
+
 	if err := c.save(); err != nil {
 		return errors.Wrapf(err, "error refreshing state for container %s", c.ID())
 	}
diff --git a/libpod/kube.go b/libpod/kube.go
index ad5acea78..e0ed911af 100644
--- a/libpod/kube.go
+++ b/libpod/kube.go
@@ -75,7 +75,7 @@ func (p *Pod) GenerateForKube(ctx context.Context) (*v1.Pod, []v1.ServicePort, e
 				Hostnames: []string{hostSli[0]},
 			})
 		}
-		ports, err = ocicniPortMappingToContainerPort(infraContainer.config.PortMappings)
+		ports, err = portMappingToContainerPort(infraContainer.config.PortMappings)
 		if err != nil {
 			return nil, servicePorts, err
 		}
@@ -452,7 +452,7 @@ func containerToV1Container(ctx context.Context, c *Container) (v1.Container, []
 	if err != nil {
 		return kubeContainer, kubeVolumes, nil, annotations, err
 	}
-	ports, err := ocicniPortMappingToContainerPort(portmappings)
+	ports, err := portMappingToContainerPort(portmappings)
 	if err != nil {
 		return kubeContainer, kubeVolumes, nil, annotations, err
 	}
@@ -588,29 +588,36 @@ func containerToV1Container(ctx context.Context, c *Container) (v1.Container, []
 	return kubeContainer, kubeVolumes, &dns, annotations, nil
 }
 
-// ocicniPortMappingToContainerPort takes an ocicni portmapping and converts
+// portMappingToContainerPort takes an portmapping and converts
 // it to a v1.ContainerPort format for kube output
-func ocicniPortMappingToContainerPort(portMappings []types.OCICNIPortMapping) ([]v1.ContainerPort, error) {
+func portMappingToContainerPort(portMappings []types.PortMapping) ([]v1.ContainerPort, error) {
 	containerPorts := make([]v1.ContainerPort, 0, len(portMappings))
 	for _, p := range portMappings {
-		var protocol v1.Protocol
-		switch strings.ToUpper(p.Protocol) {
-		case "TCP":
-			// do nothing as it is the default protocol in k8s, there is no need to explicitly
-			// add it to the generated yaml
-		case "UDP":
-			protocol = v1.ProtocolUDP
-		default:
-			return containerPorts, errors.Errorf("unknown network protocol %s", p.Protocol)
-		}
-		cp := v1.ContainerPort{
-			// Name will not be supported
-			HostPort:      p.HostPort,
-			HostIP:        p.HostIP,
-			ContainerPort: p.ContainerPort,
-			Protocol:      protocol,
-		}
-		containerPorts = append(containerPorts, cp)
+		protocols := strings.Split(p.Protocol, ",")
+		for _, proto := range protocols {
+			var protocol v1.Protocol
+			switch strings.ToUpper(proto) {
+			case "TCP":
+				// do nothing as it is the default protocol in k8s, there is no need to explicitly
+				// add it to the generated yaml
+			case "UDP":
+				protocol = v1.ProtocolUDP
+			case "SCTP":
+				protocol = v1.ProtocolSCTP
+			default:
+				return containerPorts, errors.Errorf("unknown network protocol %s", p.Protocol)
+			}
+			for i := uint16(0); i < p.Range; i++ {
+				cp := v1.ContainerPort{
+					// Name will not be supported
+					HostPort:      int32(p.HostPort + i),
+					HostIP:        p.HostIP,
+					ContainerPort: int32(p.ContainerPort + i),
+					Protocol:      protocol,
+				}
+				containerPorts = append(containerPorts, cp)
+			}
+		}
 	}
 	return containerPorts, nil
 }
diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go
index 035fb5832..ef261a438 100644
--- a/libpod/networking_linux.go
+++ b/libpod/networking_linux.go
@@ -11,6 +11,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"sort"
 	"strconv"
 	"strings"
 	"syscall"
@@ -91,10 +92,7 @@ func (c *Container) getNetworkOptions() (types.NetworkOptions, error) {
 		ContainerID:   c.config.ID,
 		ContainerName: getCNIPodName(c),
 	}
-	// TODO remove ocicni PortMappings from container config and store as types PortMappings
-	if len(c.config.PortMappings) > 0 {
-		opts.PortMappings = ocicniPortsToNetTypesPorts(c.config.PortMappings)
-	}
+	opts.PortMappings = c.config.PortMappings
 	networks, _, err := c.networks()
 	if err != nil {
 		return opts, err
@@ -1209,9 +1207,7 @@ func (c *Container) NetworkDisconnect(nameOrID, netName string, force bool) erro
 		ContainerID:   c.config.ID,
 		ContainerName: getCNIPodName(c),
 	}
-	if len(c.config.PortMappings) > 0 {
-		opts.PortMappings = ocicniPortsToNetTypesPorts(c.config.PortMappings)
-	}
+	opts.PortMappings = c.config.PortMappings
 	eth, exists := c.state.NetInterfaceDescriptions.getInterfaceByName(netName)
 	if !exists {
 		return errors.Errorf("no network interface name for container %s on network %s", c.config.ID, netName)
@@ -1303,9 +1299,7 @@ func (c *Container) NetworkConnect(nameOrID, netName string, aliases []string) e
 		ContainerID:   c.config.ID,
 		ContainerName: getCNIPodName(c),
 	}
-	if len(c.config.PortMappings) > 0 {
-		opts.PortMappings = ocicniPortsToNetTypesPorts(c.config.PortMappings)
-	}
+	opts.PortMappings = c.config.PortMappings
 	eth, exists := c.state.NetInterfaceDescriptions.getInterfaceByName(netName)
 	if !exists {
 		return errors.Errorf("no network interface name for container %s on network %s", c.config.ID, netName)
@@ -1373,16 +1367,67 @@ func (r *Runtime) normalizeNetworkName(nameOrID string) (string, error) {
 	return net.Name, nil
 }
 
+// ocicniPortsToNetTypesPorts convert the old port format to the new one
+// while deduplicating ports into ranges
 func ocicniPortsToNetTypesPorts(ports []types.OCICNIPortMapping) []types.PortMapping {
+	if len(ports) == 0 {
+		return nil
+	}
+
 	newPorts := make([]types.PortMapping, 0, len(ports))
-	for _, port := range ports {
-		newPorts = append(newPorts, types.PortMapping{
-			HostIP:        port.HostIP,
-			HostPort:      uint16(port.HostPort),
-			ContainerPort: uint16(port.ContainerPort),
-			Protocol:      port.Protocol,
-			Range:         1,
-		})
+
+	// first sort the ports
+	sort.Slice(ports, func(i, j int) bool {
+		return compareOCICNIPorts(ports[i], ports[j])
+	})
+
+	// we already check if the slice is empty so we can use the first element
+	currentPort := types.PortMapping{
+		HostIP:        ports[0].HostIP,
+		HostPort:      uint16(ports[0].HostPort),
+		ContainerPort: uint16(ports[0].ContainerPort),
+		Protocol:      ports[0].Protocol,
+		Range:         1,
+	}
+
+	for i := 1; i < len(ports); i++ {
+		if ports[i].HostIP == currentPort.HostIP &&
+			ports[i].Protocol == currentPort.Protocol &&
+			ports[i].HostPort-int32(currentPort.Range) == int32(currentPort.HostPort) &&
+			ports[i].ContainerPort-int32(currentPort.Range) == int32(currentPort.ContainerPort) {
+			currentPort.Range = currentPort.Range + 1
+		} else {
+			newPorts = append(newPorts, currentPort)
+			currentPort = types.PortMapping{
+				HostIP:        ports[i].HostIP,
+				HostPort:      uint16(ports[i].HostPort),
+				ContainerPort: uint16(ports[i].ContainerPort),
+				Protocol:      ports[i].Protocol,
+				Range:         1,
+			}
+		}
 	}
+	newPorts = append(newPorts, currentPort)
 	return newPorts
 }
+
+// compareOCICNIPorts will sort the ocicni ports by
+// 1) host ip
+// 2) protocol
+// 3) hostPort
+// 4) container port
+func compareOCICNIPorts(i, j types.OCICNIPortMapping) bool {
+	if i.HostIP != j.HostIP {
+		return i.HostIP < j.HostIP
+	}
+
+	if i.Protocol != j.Protocol {
+		return i.Protocol < j.Protocol
+	}
+
+	if i.HostPort != j.HostPort {
+		return i.HostPort < j.HostPort
+	}
+
+	return i.ContainerPort < j.ContainerPort
+}
diff --git a/libpod/networking_linux_test.go b/libpod/networking_linux_test.go
new file mode 100644
index 000000000..06bf05723
--- /dev/null
+++ b/libpod/networking_linux_test.go
@@ -0,0 +1,323 @@
+package libpod
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/containers/podman/v3/libpod/network/types"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_ocicniPortsToNetTypesPorts(t *testing.T) {
+	tests := []struct {
+		name string
+		arg  []types.OCICNIPortMapping
+		want []types.PortMapping
+	}{
+		{
+			name: "no ports",
+			arg:  nil,
+			want: nil,
+		},
+		{
+			name: "empty ports",
+			arg:  []types.OCICNIPortMapping{},
+			want: nil,
+		},
+		{
+			name: "single port",
+			arg: []types.OCICNIPortMapping{
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+				},
+			},
+			want: []types.PortMapping{
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+					Range:         1,
+				},
+			},
+		},
+		{
+			name: "two separate ports",
+			arg: []types.OCICNIPortMapping{
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+				},
+				{
+					HostPort:      9000,
+					ContainerPort: 90,
+					Protocol:      "tcp",
+				},
+			},
+			want: []types.PortMapping{
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+					Range:         1,
+				},
+				{
+					HostPort:      9000,
+					ContainerPort: 90,
+					Protocol:      "tcp",
+					Range:         1,
+				},
+			},
+		},
+		{
+			name: "two ports joined",
+			arg: []types.OCICNIPortMapping{
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+				},
+				{
+					HostPort:      8081,
+					ContainerPort: 81,
+					Protocol:      "tcp",
+				},
+			},
+			want: []types.PortMapping{
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+					Range:         2,
+				},
+			},
+		},
+		{
+			name: "three ports with different container port are not joined",
+			arg: []types.OCICNIPortMapping{
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+				},
+				{
+					HostPort:      8081,
+					ContainerPort: 79,
+					Protocol:      "tcp",
+				},
+				{
+					HostPort:      8082,
+					ContainerPort: 82,
+					Protocol:      "tcp",
+				},
+			},
+			want: []types.PortMapping{
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+					Range:         1,
+				},
+				{
+					HostPort:      8081,
+					ContainerPort: 79,
+					Protocol:      "tcp",
+					Range:         1,
+				},
+				{
+					HostPort:      8082,
+					ContainerPort: 82,
+					Protocol:      "tcp",
+					Range:         1,
+				},
+			},
+		},
+		{
+			name: "three ports joined (not sorted)",
+			arg: []types.OCICNIPortMapping{
+				{
+					HostPort:      8081,
+					ContainerPort: 81,
+					Protocol:      "tcp",
+				},
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+				},
+				{
+					HostPort:      8082,
+					ContainerPort: 82,
+					Protocol:      "tcp",
+				},
+			},
+			want: []types.PortMapping{
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+					Range:         3,
+				},
+			},
+		},
+		{
+			name: "different protocols ports are not joined",
+			arg: []types.OCICNIPortMapping{
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+				},
+				{
+					HostPort:      8081,
+					ContainerPort: 81,
+					Protocol:      "udp",
+				},
+			},
+			want: []types.PortMapping{
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+					Range:         1,
+				},
+				{
+					HostPort:      8081,
+					ContainerPort: 81,
+					Protocol:      "udp",
+					Range:         1,
+				},
+			},
+		},
+		{
+			name: "different host ip ports are not joined",
+			arg: []types.OCICNIPortMapping{
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+					HostIP:        "192.168.1.1",
+				},
+				{
+					HostPort:      8081,
+					ContainerPort: 81,
+					Protocol:      "tcp",
+					HostIP:        "192.168.1.2",
+				},
+			},
+			want: []types.PortMapping{
+				{
+					HostPort:      8080,
+					ContainerPort: 80,
+					Protocol:      "tcp",
+					Range:         1,
+					HostIP:        "192.168.1.1",
+				},
+				{
+					HostPort:      8081,
+					ContainerPort: 81,
+					Protocol:      "tcp",
+					Range:         1,
+					HostIP:        "192.168.1.2",
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			result := ocicniPortsToNetTypesPorts(tt.arg)
+			assert.Equal(t, tt.want, result, "ports do not match")
+		})
+	}
+}
+
+func benchmarkOCICNIPortsToNetTypesPorts(b *testing.B, ports []types.OCICNIPortMapping) {
+	for n := 0; n < b.N; n++ {
+		ocicniPortsToNetTypesPorts(ports)
+	}
+}
+
+func Benchmark_ocicniPortsToNetTypesPortsNoPorts(b *testing.B) {
+	benchmarkOCICNIPortsToNetTypesPorts(b, nil)
+}
+
+func Benchmark_ocicniPortsToNetTypesPorts1(b *testing.B) {
+	benchmarkOCICNIPortsToNetTypesPorts(b, []types.OCICNIPortMapping{
+		{
+			HostPort:      8080,
+			ContainerPort: 80,
+			Protocol:      "tcp",
+		},
+	})
+}
+
+func Benchmark_ocicniPortsToNetTypesPorts10(b *testing.B) {
+	ports := make([]types.OCICNIPortMapping, 0, 10)
+	for i := int32(8080); i < 8090; i++ {
+		ports = append(ports, types.OCICNIPortMapping{
+			HostPort:      i,
+			ContainerPort: i,
+			Protocol:      "tcp",
+		})
+	}
+	b.ResetTimer()
+	benchmarkOCICNIPortsToNetTypesPorts(b, ports)
+}
+
+func Benchmark_ocicniPortsToNetTypesPorts100(b *testing.B) {
+	ports := make([]types.OCICNIPortMapping, 0, 100)
+	for i := int32(8080); i < 8180; i++ {
+		ports = append(ports, types.OCICNIPortMapping{
+			HostPort:      i,
+			ContainerPort: i,
+			Protocol:      "tcp",
+		})
+	}
+	b.ResetTimer()
+	benchmarkOCICNIPortsToNetTypesPorts(b, ports)
+}
+
+func Benchmark_ocicniPortsToNetTypesPorts1k(b *testing.B) {
+	ports := make([]types.OCICNIPortMapping, 0, 1000)
+	for i := int32(8080); i < 9080; i++ {
+		ports = append(ports, types.OCICNIPortMapping{
+			HostPort:      i,
+			ContainerPort: i,
+			Protocol:      "tcp",
+		})
+	}
+	b.ResetTimer()
+	benchmarkOCICNIPortsToNetTypesPorts(b, ports)
+}
+
+func Benchmark_ocicniPortsToNetTypesPorts10k(b *testing.B) {
+	ports := make([]types.OCICNIPortMapping, 0, 30000)
+	for i := int32(8080); i < 18080; i++ {
+		ports = append(ports, types.OCICNIPortMapping{
+			HostPort:      i,
+			ContainerPort: i,
+			Protocol:      "tcp",
+		})
+	}
+	b.ResetTimer()
+	benchmarkOCICNIPortsToNetTypesPorts(b, ports)
+}
+
+func Benchmark_ocicniPortsToNetTypesPorts1m(b *testing.B) {
+	ports := make([]types.OCICNIPortMapping, 0, 1000000)
+	for j := 0; j < 20; j++ {
+		for i := int32(1); i <= 50000; i++ {
+			ports = append(ports, types.OCICNIPortMapping{
+				HostPort:      i,
+				ContainerPort: i,
+				Protocol:      "tcp",
+				HostIP:        fmt.Sprintf("192.168.1.%d", j),
+			})
+		}
+	}
+	b.ResetTimer()
+	benchmarkOCICNIPortsToNetTypesPorts(b, ports)
+}
diff --git a/libpod/networking_slirp4netns.go b/libpod/networking_slirp4netns.go
index 56e8eca99..760427f22 100644
--- a/libpod/networking_slirp4netns.go
+++ b/libpod/networking_slirp4netns.go
@@ -38,9 +38,9 @@ type slirpFeatures struct {
 type slirp4netnsCmdArg struct {
 	Proto     string `json:"proto,omitempty"`
 	HostAddr  string `json:"host_addr"`
-	HostPort  int32  `json:"host_port"`
+	HostPort  uint16 `json:"host_port"`
 	GuestAddr string `json:"guest_addr"`
-	GuestPort int32  `json:"guest_port"`
+	GuestPort uint16 `json:"guest_port"`
 }
 
 type slirp4netnsCmd struct {
diff --git a/libpod/oci_util.go b/libpod/oci_util.go
index c1afc0d20..6d99d5836 100644
--- a/libpod/oci_util.go
+++ b/libpod/oci_util.go
@@ -32,93 +32,108 @@ func createUnitName(prefix string, name string) string {
 }
 
 // Bind ports to keep them closed on the host
-func bindPorts(ports []types.OCICNIPortMapping) ([]*os.File, error) {
+func bindPorts(ports []types.PortMapping) ([]*os.File, error) {
 	var files []*os.File
-	notifySCTP := false
-	for _, i := range ports {
-		isV6 := net.ParseIP(i.HostIP).To4() == nil
-		if i.HostIP == "" {
+	sctpWarning := true
+	for _, port := range ports {
+		isV6 := net.ParseIP(port.HostIP).To4() == nil
+		if port.HostIP == "" {
 			isV6 = false
 		}
-		switch i.Protocol {
-		case "udp":
-			var (
-				addr *net.UDPAddr
-				err  error
-			)
-			if isV6 {
-				addr, err = net.ResolveUDPAddr("udp6", fmt.Sprintf("[%s]:%d", i.HostIP, i.HostPort))
-			} else {
-				addr, err = net.ResolveUDPAddr("udp4", fmt.Sprintf("%s:%d", i.HostIP, i.HostPort))
-			}
-			if err != nil {
-				return nil, errors.Wrapf(err, "cannot resolve the UDP address")
+		protocols := strings.Split(port.Protocol, ",")
+		for _, protocol := range protocols {
+			for i := uint16(0); i < port.Range; i++ {
+				f, err := bindPort(protocol, port.HostIP, port.HostPort+i, isV6, &sctpWarning)
+				if err != nil {
+					return files, err
+				}
+				if f != nil {
+					files = append(files, f)
+				}
 			}
+		}
+	}
+	return files, nil
+}
 
-			proto := "udp4"
-			if isV6 {
-				proto = "udp6"
-			}
-			server, err := net.ListenUDP(proto, addr)
-			if err != nil {
-				return nil, errors.Wrapf(err, "cannot listen on the UDP port")
-			}
-			f, err := server.File()
-			if err != nil {
-				return nil, errors.Wrapf(err, "cannot get file for UDP socket")
-			}
-			files = append(files, f)
-			// close the listener
-			// note that this does not affect the fd, see the godoc for server.File()
-			err = server.Close()
-			if err != nil {
-				logrus.Warnf("Failed to close connection: %v", err)
-			}
+func bindPort(protocol, hostIP string, port uint16, isV6 bool, sctpWarning *bool) (*os.File, error) {
+	var file *os.File
+	switch protocol {
+	case "udp":
+		var (
+			addr *net.UDPAddr
+			err  error
+		)
+		if isV6 {
+			addr, err = net.ResolveUDPAddr("udp6", fmt.Sprintf("[%s]:%d", hostIP, port))
+		} else {
+			addr, err = net.ResolveUDPAddr("udp4", fmt.Sprintf("%s:%d", hostIP, port))
+		}
+		if err != nil {
+			return nil, errors.Wrapf(err, "cannot resolve the UDP address")
+		}
 
-		case "tcp":
-			var (
-				addr *net.TCPAddr
-				err  error
-			)
-			if isV6 {
-				addr, err = net.ResolveTCPAddr("tcp6", fmt.Sprintf("[%s]:%d", i.HostIP, i.HostPort))
-			} else {
-				addr, err = net.ResolveTCPAddr("tcp4", fmt.Sprintf("%s:%d", i.HostIP, i.HostPort))
-			}
-			if err != nil {
-				return nil, errors.Wrapf(err, "cannot resolve the TCP address")
-			}
+		proto := "udp4"
+		if isV6 {
+			proto = "udp6"
+		}
+		server, err := net.ListenUDP(proto, addr)
+		if err != nil {
+			return nil, errors.Wrapf(err, "cannot listen on the UDP port")
+		}
+		file, err = server.File()
+		if err != nil {
+			return nil, errors.Wrapf(err, "cannot get file for UDP socket")
+		}
+		// close the listener
+		// note that this does not affect the fd, see the godoc for server.File()
+		err = server.Close()
+		if err != nil {
+			logrus.Warnf("Failed to close connection: %v", err)
+		}
 
-			proto := "tcp4"
-			if isV6 {
-				proto = "tcp6"
-			}
-			server, err := net.ListenTCP(proto, addr)
-			if err != nil {
-				return nil, errors.Wrapf(err, "cannot listen on the TCP port")
-			}
-			f, err := server.File()
-			if err != nil {
-				return nil, errors.Wrapf(err, "cannot get file for TCP socket")
-			}
-			files = append(files, f)
-			// close the listener
-			// note that this does not affect the fd, see the godoc for server.File()
-			err = server.Close()
-			if err != nil {
-				logrus.Warnf("Failed to close connection: %v", err)
-			}
+	case "tcp":
+		var (
+			addr *net.TCPAddr
+			err  error
+		)
+		if isV6 {
+			addr, err = net.ResolveTCPAddr("tcp6", fmt.Sprintf("[%s]:%d", hostIP, port))
+		} else {
+			addr, err = net.ResolveTCPAddr("tcp4", fmt.Sprintf("%s:%d", hostIP, port))
+		}
+		if err != nil {
+			return nil, errors.Wrapf(err, "cannot resolve the TCP address")
+		}
 
-		case "sctp":
-			if !notifySCTP {
-				notifySCTP = true
-				logrus.Warnf("Port reservation for SCTP is not supported")
-			}
-		default:
-			return nil, fmt.Errorf("unknown protocol %s", i.Protocol)
+		proto := "tcp4"
+		if isV6 {
+			proto = "tcp6"
+		}
+		server, err := net.ListenTCP(proto, addr)
+		if err != nil {
+			return nil, errors.Wrapf(err, "cannot listen on the TCP port")
+		}
+		file, err = server.File()
+		if err != nil {
+			return nil, errors.Wrapf(err, "cannot get file for TCP socket")
+		}
+		// close the listener
+		// note that this does not affect the fd, see the godoc for server.File()
+		err = server.Close()
+		if err != nil {
+			logrus.Warnf("Failed to close connection: %v", err)
 		}
+
+	case "sctp":
+		if *sctpWarning {
+			logrus.Info("Port reservation for SCTP is not supported")
+			*sctpWarning = false
+		}
+	default:
+		return nil, fmt.Errorf("unknown protocol %s", protocol)
 	}
-	return files, nil
+	return file, nil
 }
 
 func getOCIRuntimeError(runtimeMsg string) error {
diff --git a/libpod/options.go b/libpod/options.go
index f1cf015f8..250b16556 100644
--- a/libpod/options.go
+++ b/libpod/options.go
@@ -1051,7 +1051,7 @@ func WithDependencyCtrs(ctrs []*Container) CtrCreateOption {
 // namespace with a minimal configuration.
 // An optional array of port mappings can be provided.
 // Conflicts with WithNetNSFrom().
-func WithNetNS(portMappings []nettypes.OCICNIPortMapping, exposedPorts map[uint16][]string, postConfigureNetNS bool, netmode string, networks []string) CtrCreateOption {
+func WithNetNS(portMappings []nettypes.PortMapping, exposedPorts map[uint16][]string, postConfigureNetNS bool, netmode string, networks []string) CtrCreateOption {
 	return func(ctr *Container) error {
 		if ctr.valid {
 			return define.ErrCtrFinalized
@@ -2084,21 +2084,6 @@ func WithInfraContainer() PodCreateOption {
 	}
 }
 
-// WithInfraContainerPorts tells the pod to add port bindings to the pause container
-func WithInfraContainerPorts(bindings []nettypes.OCICNIPortMapping, infraSpec *specgen.SpecGenerator) []nettypes.PortMapping {
-	bindingSpec := []nettypes.PortMapping{}
-	for _, bind := range bindings {
-		currBind := nettypes.PortMapping{}
-		currBind.ContainerPort = uint16(bind.ContainerPort)
-		currBind.HostIP = bind.HostIP
-		currBind.HostPort = uint16(bind.HostPort)
-		currBind.Protocol = bind.Protocol
-		bindingSpec = append(bindingSpec, currBind)
-	}
-	infraSpec.PortMappings = bindingSpec
-	return infraSpec.PortMappings
-}
-
 // WithVolatile sets the volatile flag for the container storage.
 // The option can potentially cause data loss when used on a container that must survive a machine reboot.
 func WithVolatile() CtrCreateOption {
diff --git a/libpod/state_test.go b/libpod/state_test.go
index 4799d7b8d..5c3b0d7f7 100644
--- a/libpod/state_test.go
+++ b/libpod/state_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/containers/common/pkg/config"
 	"github.com/containers/podman/v3/libpod/define"
 	"github.com/containers/podman/v3/libpod/lock"
+	"github.com/containers/podman/v3/libpod/network/types"
 	"github.com/containers/storage"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -3705,3 +3706,42 @@ func TestGetContainerConfigNonExistentIDFails(t *testing.T) {
 		assert.Error(t, err)
 	})
 }
+
+// Test that the state will convert the ports to the new format
+func TestConvertPortMapping(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, manager lock.Manager) {
+		testCtr, err := getTestCtr1(manager)
+		assert.NoError(t, err)
+
+		ports := testCtr.config.PortMappings
+
+		oldPorts := []types.OCICNIPortMapping{
+			{
+				HostPort:      80,
+				ContainerPort: 90,
+				Protocol:      "tcp",
+				HostIP:        "192.168.3.3",
+			},
+			{
+				HostPort:      100,
+				ContainerPort: 110,
+				Protocol:      "udp",
+				HostIP:        "192.168.4.4",
+			},
+		}
+
+		testCtr.config.OldPortMappings = oldPorts
+		testCtr.config.PortMappings = nil
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		retrievedCtr, err := state.Container(testCtr.ID())
+		assert.NoError(t, err)
+
+		// set values to expected ones
+		testCtr.config.PortMappings = ports
+
+		testContainersEqual(t, retrievedCtr, testCtr, true)
+	})
+}
diff --git a/libpod/util.go b/libpod/util.go
index 8f8303ff2..5154a261e 100644
--- a/libpod/util.go
+++ b/libpod/util.go
@@ -295,19 +295,21 @@ func writeHijackHeader(r *http.Request, conn io.Writer) {
 }
 
 // Convert OCICNI port bindings into Inspect-formatted port bindings.
-func makeInspectPortBindings(bindings []types.OCICNIPortMapping, expose map[uint16][]string) map[string][]define.InspectHostPort {
+func makeInspectPortBindings(bindings []types.PortMapping, expose map[uint16][]string) map[string][]define.InspectHostPort {
 	portBindings := make(map[string][]define.InspectHostPort)
 	for _, port := range bindings {
-		key := fmt.Sprintf("%d/%s", port.ContainerPort, port.Protocol)
-		hostPorts := portBindings[key]
-		if hostPorts == nil {
-			hostPorts = []define.InspectHostPort{}
+		protocols := strings.Split(port.Protocol, ",")
+		for _, protocol := range protocols {
+			for i := uint16(0); i < port.Range; i++ {
+				key := fmt.Sprintf("%d/%s", port.ContainerPort+i, protocol)
+				hostPorts := portBindings[key]
+				hostPorts = append(hostPorts, define.InspectHostPort{
+					HostIP:   port.HostIP,
+					HostPort: fmt.Sprintf("%d", port.HostPort+i),
+				})
+				portBindings[key] = hostPorts
+			}
 		}
-		hostPorts = append(hostPorts, define.InspectHostPort{
-			HostIP:   port.HostIP,
-			HostPort: fmt.Sprintf("%d", port.HostPort),
-		})
-		portBindings[key] = hostPorts
 	}
 	// add exposed ports without host port information to match docker
 	for port, protocols := range expose {