summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--go.mod2
-rw-r--r--go.sum3
-rw-r--r--libpod/container_internal_linux.go34
-rw-r--r--test/system/500-networking.bats58
-rw-r--r--vendor/github.com/docker/docker/pkg/archive/archive.go16
-rw-r--r--vendor/modules.txt2
6 files changed, 103 insertions, 12 deletions
diff --git a/go.mod b/go.mod
index c6b995390..b66f6f9dc 100644
--- a/go.mod
+++ b/go.mod
@@ -25,7 +25,7 @@ require (
github.com/davecgh/go-spew v1.1.1
github.com/digitalocean/go-qemu v0.0.0-20210209191958-152a1535e49f
github.com/docker/distribution v2.7.1+incompatible
- github.com/docker/docker v20.10.6+incompatible
+ github.com/docker/docker v20.10.7+incompatible
github.com/docker/go-connections v0.4.0
github.com/docker/go-plugins-helpers v0.0.0-20200102110956-c9a8a2d92ccc
github.com/docker/go-units v0.4.0
diff --git a/go.sum b/go.sum
index 8790d54c8..cfd726570 100644
--- a/go.sum
+++ b/go.sum
@@ -297,8 +297,9 @@ github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BU
github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
github.com/docker/docker v1.4.2-0.20191219165747-a9416c67da9f/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
github.com/docker/docker v20.10.3-0.20210216175712-646072ed6524+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v20.10.6+incompatible h1:oXI3Vas8TI8Eu/EjH4srKHJBVqraSzJybhxY7Om9faQ=
github.com/docker/docker v20.10.6+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v20.10.7+incompatible h1:Z6O9Nhsjv+ayUEeI1IojKbYcsGdgYSNqxe1s2MYzUhQ=
+github.com/docker/docker v20.10.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
github.com/docker/docker-credential-helpers v0.6.3 h1:zI2p9+1NQYdnG6sMU26EX4aVGlqbInSQxQXLvzJ4RPQ=
github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index 1b2f5a496..74a3fec32 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -1668,17 +1668,16 @@ func (c *Container) generateResolvConf() (string, error) {
return "", err
}
- // Ensure that the container's /etc/resolv.conf is compatible with its
- // network configuration.
- // TODO: set ipv6 enable bool more sanely
- resolv, err := resolvconf.FilterResolvDNS(contents, true, c.config.CreateNetNS)
- if err != nil {
- return "", errors.Wrapf(err, "error parsing host resolv.conf")
- }
-
+ ipv6 := false
// Check if CNI gave back and DNS servers for us to add in
cniResponse := c.state.NetworkStatus
for _, i := range cniResponse {
+ for _, ip := range i.IPs {
+ // Note: only using To16() does not work since it also returns a vaild ip for ipv4
+ if ip.Address.IP.To4() == nil && ip.Address.IP.To16() != nil {
+ ipv6 = true
+ }
+ }
if i.DNS.Nameservers != nil {
cniNameServers = append(cniNameServers, i.DNS.Nameservers...)
logrus.Debugf("adding nameserver(s) from cni response of '%q'", i.DNS.Nameservers)
@@ -1689,6 +1688,25 @@ func (c *Container) generateResolvConf() (string, error) {
}
}
+ if c.config.NetMode.IsSlirp4netns() {
+ ctrNetworkSlipOpts := []string{}
+ if c.config.NetworkOptions != nil {
+ ctrNetworkSlipOpts = append(ctrNetworkSlipOpts, c.config.NetworkOptions["slirp4netns"]...)
+ }
+ slirpOpts, err := parseSlirp4netnsNetworkOptions(c.runtime, ctrNetworkSlipOpts)
+ if err != nil {
+ return "", err
+ }
+ ipv6 = slirpOpts.enableIPv6
+ }
+
+ // Ensure that the container's /etc/resolv.conf is compatible with its
+ // network configuration.
+ resolv, err := resolvconf.FilterResolvDNS(contents, ipv6, c.config.CreateNetNS)
+ if err != nil {
+ return "", errors.Wrapf(err, "error parsing host resolv.conf")
+ }
+
dns := make([]net.IP, 0, len(c.runtime.config.Containers.DNSServers))
for _, i := range c.runtime.config.Containers.DNSServers {
result := net.ParseIP(i)
diff --git a/test/system/500-networking.bats b/test/system/500-networking.bats
index 63b9a7c14..55ec80bb2 100644
--- a/test/system/500-networking.bats
+++ b/test/system/500-networking.bats
@@ -329,4 +329,62 @@ load helpers
run_podman network rm -f $mynetname
}
+@test "podman ipv6 in /etc/resolv.conf" {
+ ipv6_regex='([0-9A-Fa-f]{0,4}:){2,7}([0-9A-Fa-f]{0,4})(%\w+)?'
+
+ # Make sure to read the correct /etc/resolv.conf file in case of systemd-resolved.
+ resolve_file=$(readlink -f /etc/resolv.conf)
+ if [[ "$resolve_file" == "/run/systemd/resolve/stub-resolv.conf" ]]; then
+ resolve_file="/run/systemd/resolve/resolv.conf"
+ fi
+
+ # If the host doesn't have an ipv6 in resolv.conf skip this test.
+ # We should never modify resolv.conf on the host.
+ if ! grep -E "$ipv6_regex" "$resolve_file"; then
+ skip "This test needs an ipv6 nameserver in $resolve_file"
+ fi
+
+ # ipv4 slirp
+ run_podman run --rm --network slirp4netns:enable_ipv6=false $IMAGE cat /etc/resolv.conf
+ if grep -E "$ipv6_regex" <<< $output; then
+ die "resolv.conf contains a ipv6 nameserver"
+ fi
+
+ # ipv6 slirp
+ run_podman run --rm --network slirp4netns:enable_ipv6=true $IMAGE cat /etc/resolv.conf
+ # "is" does not like the ipv6 regex
+ if ! grep -E "$ipv6_regex" <<< $output; then
+ die "resolv.conf does not contain a ipv6 nameserver"
+ fi
+
+ # ipv4 cni
+ local mysubnet=$(random_rfc1918_subnet)
+ local netname=testnet-$(random_string 10)
+
+ run_podman network create --subnet $mysubnet.0/24 $netname
+ is "$output" ".*/cni/net.d/$netname.conflist" "output of 'network create'"
+
+ run_podman run --rm --network $netname $IMAGE cat /etc/resolv.conf
+ if grep -E "$ipv6_regex" <<< $output; then
+ die "resolv.conf contains a ipv6 nameserver"
+ fi
+
+ run_podman network rm -f $netname
+
+ # ipv6 cni
+ mysubnet=fd00:4:4:4:4::/64
+ netname=testnet-$(random_string 10)
+
+ run_podman network create --subnet $mysubnet $netname
+ is "$output" ".*/cni/net.d/$netname.conflist" "output of 'network create'"
+
+ run_podman run --rm --network $netname $IMAGE cat /etc/resolv.conf
+ # "is" does not like the ipv6 regex
+ if ! grep -E "$ipv6_regex" <<< $output; then
+ die "resolv.conf does not contain a ipv6 nameserver"
+ fi
+
+ run_podman network rm -f $netname
+}
+
# vim: filetype=sh
diff --git a/vendor/github.com/docker/docker/pkg/archive/archive.go b/vendor/github.com/docker/docker/pkg/archive/archive.go
index 8d14b7869..50b83c62c 100644
--- a/vendor/github.com/docker/docker/pkg/archive/archive.go
+++ b/vendor/github.com/docker/docker/pkg/archive/archive.go
@@ -402,10 +402,24 @@ func fillGo18FileTypeBits(mode int64, fi os.FileInfo) int64 {
// ReadSecurityXattrToTarHeader reads security.capability xattr from filesystem
// to a tar header
func ReadSecurityXattrToTarHeader(path string, hdr *tar.Header) error {
+ const (
+ // Values based on linux/include/uapi/linux/capability.h
+ xattrCapsSz2 = 20
+ versionOffset = 3
+ vfsCapRevision2 = 2
+ vfsCapRevision3 = 3
+ )
capability, _ := system.Lgetxattr(path, "security.capability")
if capability != nil {
+ length := len(capability)
+ if capability[versionOffset] == vfsCapRevision3 {
+ // Convert VFS_CAP_REVISION_3 to VFS_CAP_REVISION_2 as root UID makes no
+ // sense outside the user namespace the archive is built in.
+ capability[versionOffset] = vfsCapRevision2
+ length = xattrCapsSz2
+ }
hdr.Xattrs = make(map[string]string)
- hdr.Xattrs["security.capability"] = string(capability)
+ hdr.Xattrs["security.capability"] = string(capability[:length])
}
return nil
}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 60f50eee8..fbf1075f7 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -280,7 +280,7 @@ github.com/docker/distribution/registry/client/auth/challenge
github.com/docker/distribution/registry/client/transport
github.com/docker/distribution/registry/storage/cache
github.com/docker/distribution/registry/storage/cache/memory
-# github.com/docker/docker v20.10.6+incompatible
+# github.com/docker/docker v20.10.7+incompatible
github.com/docker/docker/api
github.com/docker/docker/api/types
github.com/docker/docker/api/types/blkiodev