libnetwork/drivers/overlay: only program xt_bpf rules

[corhere]

Drop support for platforms which only have xt_u32 but not xt_bpf. No attempt is made to clean up old xt_u32 iptables rules left over from a previous daemon instance.

- What I did

- How I did it

- How to verify it

- Description for the changelog

• The xt_bpf kernel module is now required to use encrypted overlay networks

- A picture of a cute animal (not mandatory but encouraged)

[neersighted]

LGTM, with one comment nit.

[akerouanton]

Drop support for platforms which only have xt_u32 but not xt_bpf

Is there any Linux distribution that don't ship xt_bpf yet?

[neersighted]

It's present in RHEL 7.9's 3.10; since it's a default netfilter extension, it's more a matter of "are there platforms that deliberately exclude this module, and do we care about them?"

It would be good to get some more confirmation of availability before merge, across the platforms that Docker CE and Mirantis Container Runtime support.

[thaJeztah]

It's present in RHEL 7.9's 3.10

Does that exclude RHEL 7.8 and below?

From a "docker ce" perspective, we always considered CentOS to be a "rolling release" (so effectively only "latest" 7, 8, 9 are actual releases). That said, I frequently encounter users that may have "upgraded" their install .... except for the kernel 🙈, or running older versions as a "free" alternative to match their RHEL servers.

IBM also builds binaries of Docker CE (which we publish on download.docker.com), which includes RHEL packages for s390x (CentOS does not support that architecture, but RHEL does).

For my understanding (and if older 7.x versions do not support this) what is the effect of this patch for those platforms? (and how does it surface to the user)?

[neersighted]

We haven't confirmed below 7.9 because we do not currently support those platforms; I agree that 'latest' is the gold standard, and by that standard, we do support CentOS 7. Still, it could be interesting/reassuring to characterize presence in older CentOS/RHEL 7 kernels.

[corhere]

xt_bpf.ko is shipped with CentOS kernel-3.10.0-123.el7 (the kernel version which shipped with CentOS 7.0) according to the repo filelists.

  <file>/lib/modules/3.10.0-123.el7.x86_64/kernel/net/netfilter/xt_bpf.ko</file>

[cpuguy83]

LGTM

[thaJeztah]

LGTM, thanks for checking kernel support!