[25.0 backport] Backport 7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 to 25.0 #3
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Cory Snider <csnider@mirantis.com> (cherry picked from commit 0046b16) Signed-off-by: Austin Vazquez <macedonv@amazon.com>
Some configuration in a container depends on whether it has support for IPv6 (including default entries for '::1' etc in '/etc/hosts'). Before this change, the container's support for IPv6 was determined by whether it was connected to any IPv6-enabled networks. But, that can change over time, it isn't a property of the container itself. So, instead, detect IPv6 support by looking for '::1' on the container's loopback interface. It will not be present if the kernel does not have IPv6 support, or the user has disabled it in new namespaces by other means. Once IPv6 support has been determined for the container, its '/etc/hosts' is re-generated accordingly. The daemon no longer disables IPv6 on all interfaces during initialisation. It now disables IPv6 only for interfaces that have not been assigned an IPv6 address. (But, even if IPv6 is disabled for the container using the sysctl 'net.ipv6.conf.all.disable_ipv6=1', interfaces connected to IPv6 networks still get IPv6 addresses that appear in the internal DNS. There's more to-do!) Signed-off-by: Rob Murray <rob.murray@docker.com> (cherry picked from commit a8f7c5e) Signed-off-by: Austin Vazquez <macedonv@amazon.com>
When IPv6 is disabled in a container by, for example, using the --sysctl option - an IPv6 address/gateway is still allocated. Don't attempt to apply that config because doing so enables IPv6 on the interface. Signed-off-by: Rob Murray <rob.murray@docker.com> (cherry picked from commit ef5295c) Signed-off-by: Austin Vazquez <macedonv@amazon.com>
No IPAM IPv6 address is given to an interface in a network with '--ipv6=false', but the kernel would assign a link-local address and, in a macvlan/ipvlan network, the interface may get a SLAAC-assigned address. So, disable IPv6 on the interface to avoid that. Signed-off-by: Rob Murray <rob.murray@docker.com> (cherry picked from commit 841c4c8) Signed-off-by: Austin Vazquez <macedonv@amazon.com>
austinvazquez
changed the title
austinvazquez
pushed a commit
that referenced
this pull request
Aug 6, 2024
…protobuf to v1.33.0 These vulnerabilities were found by govulncheck: Vulnerability #1: GO-2024-2611 Infinite loop in JSON unmarshaling in google.golang.org/protobuf More info: https://pkg.go.dev/vuln/GO-2024-2611 Module: google.golang.org/protobuf Found in: google.golang.org/protobuf@v1.28.1 Fixed in: google.golang.org/protobuf@v1.33.0 Example traces found: #1: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Peek #2: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Read #3: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls protojson.Unmarshal Vulnerability #2: GO-2023-2153 Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc More info: https://pkg.go.dev/vuln/GO-2023-2153 Module: google.golang.org/grpc Found in: google.golang.org/grpc@v1.50.1 Fixed in: google.golang.org/grpc@v1.56.3 Example traces found: #1: api/server/router/grpc/grpc.go:20:29: grpc.NewRouter calls grpc.NewServer #2: daemon/daemon.go:1477:23: daemon.Daemon.RawSysInfo calls sync.Once.Do, which eventually calls grpc.Server.Serve #3: daemon/daemon.go:1477:23: daemon.Daemon.RawSysInfo calls sync.Once.Do, which eventually calls transport.NewServerTransport full diffs: - https://github.com/grpc/grpc-go/compare/v1.50.1..v1.56.3 - https://github.com/protocolbuffers/protobuf-go/compare/v1.28.1..v1.33.0 - https://github.com/googleapis/google-api-go-client/compare/v0.93.0..v0.114.0 - https://github.com/golang/oauth2/compare/v0.1.0..v0.7.0 - https://github.com/census-instrumentation/opencensus-go/compare/v0.23.0..v0.24.0 - https://github.com/googleapis/gax-go/compare/v2.4.0..v2.7.1 - https://github.com/googleapis/enterprise-certificate-proxy/compare/v0.1.0..v0.2.3 - https://github.com/golang/protobuf/compare/v1.5.2..v1.5.4 - https://github.com/cespare/xxhash/compare/v2.1.2..v2.2.0 - https://github.com/googleapis/google-cloud-go/compare/v0.102.1..v0.110.0 - https://github.com/googleapis/go-genproto v0.0.0-20230410155749-daa745c078e1 - https://github.com/googleapis/google-cloud-go/compare/logging/v1.4.2..logging/v1.7.0 - https://github.com/googleapis/google-cloud-go/compare/compute/v1.7.0..compute/v1.19.1 Signed-off-by: Andrey Epifanov <aepifanov@mirantis.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
- What I did
- How I did it
- How to verify it
- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)