Difuse/packages
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #14064 from G-M0N3Y-2503/docker-blocked-interface-allow-outbound

Browse source 
docker-ce: Added firewall.extra_iptables_args
This commit is contained in:
Florian Eckert 2020-12-04 09:12:41 +01:00 committed by GitHub
commit bdd26d8f26
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 33 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
utils/docker-ce/Makefile
View file

@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=docker-ce PKG_NAME:=docker-ce
PKG_VERSION:=19.03.13 PKG_VERSION:=19.03.13
PKG_RELEASE:=4 PKG_RELEASE:=5
PKG_LICENSE:=Apache-2.0 PKG_LICENSE:=Apache-2.0
PKG_LICENSE_FILES:=components/cli/LICENSE components/engine/LICENSE PKG_LICENSE_FILES:=components/cli/LICENSE components/engine/LICENSE

39
utils/docker-ce/files/dockerd.init
View file

@ -23,11 +23,11 @@ boot() {
} }
uciadd() { uciadd() {
local iface="$1" local iface="${1}"
local device="$2" local device="${2}"
local zone="$3" local zone="${3}"
[ -z "$iface" ] && { [ -z "${iface}" ] && {
iface="docker" iface="docker"
device="docker0" device="docker0"
zone="docker" zone="docker"
@ -77,11 +77,11 @@ uciadd() {
} }
ucidel() { ucidel() {
local iface="$1" local iface="${1}"
local device="$2" local device="${2}"
local zone="$3" local zone="${3}"
[ -z "$iface" ] && { [ -z "${iface}" ] && {
iface="docker" iface="docker"
device="docker0" device="docker0"
zone="docker" zone="docker"
@ -182,38 +182,43 @@ service_triggers() {
} }
iptables_add_blocking_rule() { iptables_add_blocking_rule() {
local cfg="$1" local cfg="${1}"
local device="" local device=""
local extra_iptables_args=""
handle_iptables_rule() { handle_iptables_rule() {
local interface="$1" local interface="${1}"
local outbound="$2" local outbound="${2}"
local extra_iptables_args="${3}"
local inbound="" local inbound=""
. /lib/functions/network.sh . /lib/functions/network.sh
network_get_physdev inbound "${interface}" network_get_physdev inbound "${interface}"
[ -z "$inbound" ] && { [ -z "${inbound}" ] && {
logger -t "dockerd-init" -p notice "Unable to get physical device for interface ${interface}" logger -t "dockerd-init" -p notice "Unable to get physical device for interface ${interface}"
return return
} }
if ! iptables --table filter --check DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" --jump DROP 2>/dev/null; then # Ignore errors as it might already be present
iptables --table filter --new DOCKER-USER 2>/dev/null
if ! iptables --table filter --check DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump DROP 2>/dev/null; then
logger -t "dockerd-init" -p notice "Drop traffic from ${inbound} to ${outbound}" logger -t "dockerd-init" -p notice "Drop traffic from ${inbound} to ${outbound}"
iptables --table filter --insert DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" --jump DROP iptables --table filter --insert DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump DROP
fi fi
} }
config_get device "$cfg" device config_get device "${cfg}" device
[ -z "$device" ] && { [ -z "${device}" ] && {
logger -t "dockerd-init" -p notice "No device configured for ${cfg}" logger -t "dockerd-init" -p notice "No device configured for ${cfg}"
return return
} }
config_list_foreach "$cfg" blocked_interfaces handle_iptables_rule "$device" config_get extra_iptables_args "${cfg}" extra_iptables_args
config_list_foreach "${cfg}" blocked_interfaces handle_iptables_rule "${device}" "${extra_iptables_args}"
} }
stop_service() { stop_service() {

16
utils/docker-ce/files/etc/config/dockerd
View file

@ -1,7 +1,8 @@
# The following settings require a restart to take full effect, A reload will # The following settings require a restart of docker to take full effect, A reload will only have partial or no effect:
# only have partial or no effect: # bip
# option bip # blocked_interfaces
# list blocked_interfaces # extra_iptables_args
# device
config globals 'globals' config globals 'globals'
# option alt_config_file "/etc/docker/daemon.json" # option alt_config_file "/etc/docker/daemon.json"
@ -13,8 +14,11 @@ config globals 'globals'
# list registry_mirrors "https://<my-docker-mirror-host>" # list registry_mirrors "https://<my-docker-mirror-host>"
# list registry_mirrors "https://hub.docker.com" # list registry_mirrors "https://hub.docker.com"
# Docker ignores fw3 rules and by default all external source IPs are allowed # Docker ignores fw3 rules and by default all external source IPs are allowed to connect to the Docker host.
# to connect to the Docker host. See https://docs.docker.com/network/iptables/ # See https://docs.docker.com/network/iptables/ for more details.
# firewall config changes are only additive i.e firewall will need to be restarted first to clear old changes,
# then docker restarted to load in new changes.
config firewall 'firewall' config firewall 'firewall'
option device 'docker0' option device 'docker0'
list blocked_interfaces 'wan' list blocked_interfaces 'wan'
# option extra_iptables_args '--match conntrack ! --ctstate RELATED,ESTABLISHED' # allow outbound connections