containernetworking / plugins / 1192

54%

master: 55%

Pull #469

travis-ci

portmap: Apply the DNAT hairpin to the whole subnet

The DNAT hairpin rule only allow the container itself to access the
ports it is exposing thru the host IP. Other containers in the same
subnet might also want to access this service via the host IP, so
apply this rule to the whole subnet instead of just for the container.

This is particularly useful with setups using a reverse proxy for
https. With such a setup connections between containers (for ex.
oauth2) have to downgrade to http, or need complex dns setup to make
use of the internal IP of the reverse proxy. On the other hand going
thru the host IP is easy as that is probably what the service name
already resolve to.

Signed-off-by: Alban Bedel <albeu@free.fr>
--
v2: Fixed the tests
v3: Updated iptables rules documentation in README.md

18 of 18 new or added lines in 2 files covered. (100.0%)

3372 of 6229 relevant lines covered (54.13%)

1.84 hits per line