mirror of
https://github.com/containernetworking/plugins.git
synced 2025-12-15 18:53:19 +00:00
Some reference and example networking plugins, maintained by the CNI team.
9b3772e1a7
portmap iptables backend uses `-m addrtype --dst-type LOCAL`
and a common chain (CNI-HOSTPORT-DNAT) for both hostPort and hostIP/hostPort.
Before this commit, nftables backend was using 2 separate chains,
`hostip_hostports` and `hostports`. The goal was to avoid using
`fib daddr type local` before we jump to `hostip_hostports`,
but this is a behavior change compared to iptables backend,
and a security issue (hostIP: 1.1.1.1 / hostPort: 53).
Also while switching from input to prerouting hook, we forgot to
add the fib lookup for `hostports`, rendering the nftables backend half broken.
To allow transparent upgrades and avoid running the fib lookup twice,
we use an intermediate chain (`hostports_all`)
```
chain hostports_all {
jump hostip_hostports
jump hostports
}
```
Long-term we want to remove `hostip_hostports`,
so all new rules are created in the `hostports` chain.
We can't use implicit chains (`jump { jump hostip_hostports; jump hostports }`)
as it's not supported by knftables.Fake yet.
Fixes
|
||
|---|---|---|
| .github | ||
| integration | ||
| pkg | ||
| plugins | ||
| vendor | ||
| .gitignore | ||
| .golangci.yml | ||
| .yamllint.yml | ||
| build_linux.sh | ||
| build_windows.sh | ||
| CONTRIBUTING.md | ||
| DCO | ||
| go.mod | ||
| go.sum | ||
| LICENSE | ||
| OWNERS.md | ||
| README.md | ||
| RELEASING.md | ||
| test_linux.sh | ||
| test_windows.sh | ||
Plugins
Some CNI network plugins, maintained by the containernetworking team. For more information, see the CNI website.
Read CONTRIBUTING for build and test instructions.
Plugins supplied:
Main: interface-creating
bridge: Creates a bridge, adds the host and the container to it.ipvlan: Adds an ipvlan interface in the container.loopback: Set the state of loopback interface to up.macvlan: Creates a new MAC address, forwards all traffic to that to the container.ptp: Creates a veth pair.vlan: Allocates a vlan device.host-device: Move an already-existing device into a container.dummy: Creates a new Dummy device in the container.
Windows: Windows specific
win-bridge: Creates a bridge, adds the host and the container to it.win-overlay: Creates an overlay interface to the container.
IPAM: IP address allocation
dhcp: Runs a daemon on the host to make DHCP requests on behalf of the containerhost-local: Maintains a local database of allocated IPsstatic: Allocate a single static IPv4/IPv6 address to container. It's useful in debugging purpose.
Meta: other plugins
tuning: Tweaks sysctl parameters of an existing interfaceportmap: An iptables-based portmapping plugin. Maps ports from the host's address space to the container.bandwidth: Allows bandwidth-limiting through use of traffic control tbf (ingress/egress).sbr: A plugin that configures source based routing for an interface (from which it is chained).firewall: A firewall plugin which uses iptables or firewalld to add rules to allow traffic to/from the container.
Sample
The sample plugin provides an example for building your own plugin.
Contact
For any questions about CNI, please reach out via:
- Email: cni-dev
- Slack: #cni on the CNCF slack.
If you have a security issue to report, please do so privately to the email addresses listed in the OWNERS file.