Difuse/packages
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

docker-ce: add device option to expand interface blocking

Browse source 
If docker-ce handles the firewall and fw3 is not envolved because the
rules get not proceed, then not only docker0 should be handled but also
other interfaces and therefore other docker networks.

This commit extends the handling and introduces a new uci option
`device` in the docker config firewall section. This can be used to specify
which device is allowed to access the container. Up to now only docker0
is covert.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
This commit is contained in:
Florian Eckert 2020-11-11 15:05:38 +01:00
parent 7c9ed12fa1
commit 19fc933330
2 changed files with 33 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

41
utils/docker-ce/files/dockerd.init
View file

@ -181,16 +181,39 @@ service_triggers() {
procd_add_reload_trigger 'dockerd' procd_add_reload_trigger 'dockerd'
} }
add_docker_firewall_rules() { iptables_add_blocking_rule() {
. /lib/functions/network.sh local cfg="$1"
local device interface="${1}"
# Ignore errors as it might already be present local device=""
iptables --table filter --new DOCKER-USER 2>/dev/null
network_get_physdev device "${interface}" handle_iptables_rule() {
if ! iptables --table filter --check DOCKER-USER --in-interface "${device}" --out-interface docker0 --jump DROP 2>/dev/null; then local interface="$1"
iptables --table filter --insert DOCKER-USER --in-interface "${device}" --out-interface docker0 --jump DROP local outbound="$2"
fi
local inbound=""
. /lib/functions/network.sh
network_get_physdev inbound "${interface}"
[ -z "$inbound" ] && {
logger -t "dockerd-init" -p notice "Unable to get physical device for interface ${interface}"
return
}
if ! iptables --table filter --check DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" --jump DROP 2>/dev/null; then
logger -t "dockerd-init" -p notice "Drop traffic from ${inbound} to ${outbound}"
iptables --table filter --insert DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" --jump DROP
fi
}
config_get device "$cfg" device
[ -z "$device" ] && {
logger -t "dockerd-init" -p notice "No device configured for ${cfg}"
return
}
config_list_foreach "$cfg" blocked_interfaces handle_iptables_rule "$device"
} }
ip4tables_remove_nat() { ip4tables_remove_nat() {

1
utils/docker-ce/files/etc/config/dockerd
View file

@ -16,4 +16,5 @@ config globals 'globals'
# Docker ignores fw3 rules and by default all external source IPs are allowed # Docker ignores fw3 rules and by default all external source IPs are allowed
# to connect to the Docker host. See https://docs.docker.com/network/iptables/ # to connect to the Docker host. See https://docs.docker.com/network/iptables/
config firewall 'firewall' config firewall 'firewall'
option device 'docker0'
list blocked_interfaces 'wan' list blocked_interfaces 'wan'