OpenWrt
/
packages
mirror of https://git.openwrt.org/feed/packages.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #13796 from G-M0N3Y-2503/docker-blocked-interfaces 

docker-ce: Added blocked_interfaces config option
This commit is contained in:
Florian Eckert 2020-11-11 14:25:54 +01:00 committed by GitHub
parent cb45a0d268 fe48902bf0
commit 3ca4fa7c8b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 70 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
utils/docker-ce/Makefile
View File

@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=docker-ce
PKG_VERSION:=19.03.13
PKG_RELEASE:=2
PKG_RELEASE:=3
PKG_LICENSE:=Apache-2.0
PKG_LICENSE_FILES:=components/cli/LICENSE components/engine/LICENSE

107
utils/docker-ce/files/dockerd.init Normal file → Executable file
View File

@ -6,14 +6,15 @@ START=25
extra_command "uciadd" "Add default bridge configuration to network and firewall uci config"
extra_command "ucidel" "Delete default bridge configuration from network and firewall uci config"
DOCKERD_CONF="/tmp/dockerd/daemon.json"
DOCKER_CONF_DIR="/tmp/dockerd"
DOCKERD_CONF="${DOCKER_CONF_DIR}/daemon.json"
uci_quiet() {
uci -q ${@} >/dev/null
uci -q "${@}" >/dev/null
}
json_add_array_string() {
json_add_string "" "$1"
json_add_string "" "${1}"
}
boot() {
@ -22,14 +23,14 @@ boot() {
}
uciupdate() {
local net="$1"
local net="${1}"
uci -q get network.docker >/dev/null || {
uci_quiet get network.docker || {
logger -t "dockerd-init" -p warn "No network uci config section for docker default bridge (docker0) found"
return
}
[ -z "$net" ] && {
[ -z "${net}" ] && {
logger -t "dockerd-init" -p notice "Removing network uci config options for docker default bridge (docker0)"
uci_quiet delete network.docker.netmask
uci_quiet delete network.docker.ipaddr
@ -37,10 +38,10 @@ uciupdate() {
return
}
eval "$(ipcalc.sh "$net")"
logger -t "dockerd-init" -p notice "Updating network uci config option \"$net\" for docker default bridge (docker0)"
uci_quiet set network.docker.netmask="$NETMASK"
uci_quiet set network.docker.ipaddr="$IP"
eval "$(ipcalc.sh "${net}")"
logger -t "dockerd-init" -p notice "Updating network uci config option \"${net}\" for docker default bridge (docker0)"
uci_quiet set network.docker.netmask="${NETMASK}"
uci_quiet set network.docker.ipaddr="${IP}"
uci_quiet commit network
}
@ -51,7 +52,7 @@ uciadd() {
}
# Add network interface
if ! uci -q get network.docker >/dev/null; then
if ! uci_quiet get network.docker; then
logger -t "dockerd-init" -p notice "Adding docker default interface to network uci config (docker)"
uci_quiet add network interface
uci_quiet rename network.@interface[-1]="docker"
@ -62,7 +63,7 @@ uciadd() {
fi
# Add docker bridge device
if ! uci -q get network.docker0 >/dev/null; then
if ! uci_quiet get network.docker0; then
logger -t "dockerd-init" -p notice "Adding docker default bridge device to network uci config (docker0)"
uci_quiet add network device
uci_quiet rename network.@device[-1]="docker0"
@ -73,7 +74,7 @@ uciadd() {
fi
# Add firewall zone
if ! uci -q get firewall.docker >/dev/null; then
if ! uci_quiet get firewall.docker; then
logger -t "dockerd-init" -p notice "Adding docker default firewall zone to firewall uci config (docker)"
uci_quiet add firewall zone
uci_quiet rename firewall.@zone[-1]="docker"
@ -112,19 +113,23 @@ ucidel() {
process_config() {
local alt_config_file data_root log_level bip
rm -f "$DOCKERD_CONF"
[ -f /etc/config/dockerd ] || {
# Use the daemon default configuration
DOCKERD_CONF=""
return 0
}
# reset configuration
rm -fr "${DOCKER_CONF_DIR}"
mkdir -p "${DOCKER_CONF_DIR}"
config_load 'dockerd'
config_list_foreach firewall blocked_interfaces add_docker_firewall_rules
config_get alt_config_file globals alt_config_file
[ -n "$alt_config_file" ] && [ -f "$alt_config_file" ] && {
ln -s "$alt_config_file" "$DOCKERD_CONF"
[ -n "${alt_config_file}" ] && [ -f "${alt_config_file}" ] && {
ln -s "${alt_config_file}" "${DOCKERD_CONF}"
return 0
}
@ -134,9 +139,9 @@ process_config() {
. /usr/share/libubox/jshn.sh
json_init
json_add_string "data-root" "$data_root"
json_add_string "log-level" "$log_level"
[ -z "$bip" ] || json_add_string "bip" "$bip"
json_add_string "data-root" "${data_root}"
json_add_string "log-level" "${log_level}"
[ -z "${bip}" ] || json_add_string "bip" "${bip}"
json_add_array "registry-mirrors"
config_list_foreach globals registry_mirrors json_add_array_string
json_close_array
@ -144,10 +149,9 @@ process_config() {
config_list_foreach globals hosts json_add_array_string
json_close_array
mkdir -p /tmp/dockerd
json_dump > "$DOCKERD_CONF"
json_dump > "${DOCKERD_CONF}"
uciupdate "$bip"
uciupdate "${bip}"
}
start_service() {
@ -157,10 +161,10 @@ start_service() {
procd_open_instance
procd_set_param stderr 1
if [ -z "$DOCKERD_CONF" ]; then
if [ -z "${DOCKERD_CONF}" ]; then
procd_set_param command /usr/bin/dockerd
else
procd_set_param command /usr/bin/dockerd --config-file="$DOCKERD_CONF"
procd_set_param command /usr/bin/dockerd --config-file="${DOCKERD_CONF}"
fi
procd_set_param limits nofile="${nofile} ${nofile}"
procd_close_instance
@ -175,34 +179,43 @@ service_triggers() {
procd_add_reload_trigger 'dockerd'
}
ip4tables_remove_nat() {
iptables -t nat -D OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
add_docker_firewall_rules() {
. /lib/functions/network.sh
local device interface="${1}"
iptables -t nat -F DOCKER
iptables -t nat -X DOCKER
# Ignore errors as it might already be present
iptables --table filter --new DOCKER-USER 2>/dev/null
network_get_physdev device "${interface}"
if ! iptables --table filter --check DOCKER-USER --in-interface "${device}" --out-interface docker0 --jump DROP 2>/dev/null; then
iptables --table filter --insert DOCKER-USER --in-interface "${device}" --out-interface docker0 --jump DROP
fi
}
ip4tables_remove_nat() {
iptables --table nat --delete OUTPUT ! --destination 127.0.0.0/8 --match addrtype --dst-type LOCAL --jump DOCKER
iptables --table nat --delete PREROUTING --match addrtype --dst-type LOCAL --jump DOCKER
iptables --table nat --flush DOCKER
iptables --table nat --delete-chain DOCKER
}
ip4tables_remove_filter() {
# Chain DOCKER-USER is only present,
# if bip option is NOT set, so >/dev/null 2>&1
iptables -t filter -D FORWARD -j DOCKER-USER >/dev/null 2>&1
iptables -t filter -D FORWARD -j DOCKER-ISOLATION-STAGE-1
iptables -t filter -D FORWARD -o docker0 -j DOCKER
iptables --table filter --delete FORWARD --jump DOCKER-USER
iptables --table filter --delete FORWARD --jump DOCKER-ISOLATION-STAGE-1
iptables --table filter --delete FORWARD --out-interface docker0 --jump DOCKER
iptables --table filter --delete FORWARD --out-interface docker0 --match conntrack --ctstate RELATED,ESTABLISHED --jump ACCEPT
iptables --table filter --delete FORWARD --in-interface docker0 --out-interface docker0 --jump ACCEPT
iptables --table filter --delete FORWARD --in-interface docker0 ! --out-interface docker0 --jump ACCEPT
iptables -t filter -F DOCKER
iptables -t filter -F DOCKER-ISOLATION-STAGE-1
iptables -t filter -F DOCKER-ISOLATION-STAGE-2
# Chain DOCKER-USER is only present,
# if bip option is NOT set, so >/dev/null 2>&1
iptables -t filter -F DOCKER-USER >/dev/null 2>&1
iptables --table filter --flush DOCKER
iptables --table filter --flush DOCKER-ISOLATION-STAGE-1
iptables --table filter --flush DOCKER-ISOLATION-STAGE-2
iptables --table filter --flush DOCKER-USER
iptables -t filter -X DOCKER
iptables -t filter -X DOCKER-ISOLATION-STAGE-1
iptables -t filter -X DOCKER-ISOLATION-STAGE-2
# Chain DOCKER-USER is only present,
# if bip option is NOT set, so >/dev/null 2>&1
iptables -t filter -X DOCKER-USER >/dev/null 2>&1
iptables --table filter --delete-chain DOCKER
iptables --table filter --delete-chain DOCKER-ISOLATION-STAGE-1
iptables --table filter --delete-chain DOCKER-ISOLATION-STAGE-2
iptables --table filter --delete-chain DOCKER-USER
}
ip4tables_remove() {

11
utils/docker-ce/files/etc/config/dockerd
View File

@ -1,11 +1,18 @@
# The following settings require a restart to take full effect, A reload will
# only have partial or no effect:
# option bip
# list blocked_interfaces
config globals 'globals'
# option alt_config_file "/etc/docker/daemon.json"
option data_root "/opt/docker/"
option log_level "warn"
list hosts "unix:///var/run/docker.sock"
# If the bip option is changed, dockerd must be restarted.
# A service reload is not enough.
option bip "172.18.0.1/24"
# list registry_mirrors "https://<my-docker-mirror-host>"
# list registry_mirrors "https://hub.docker.com"
# Docker ignores fw3 rules and by default all external source IPs are allowed
# to connect to the Docker host. See https://docs.docker.com/network/iptables/
config firewall 'firewall'
list blocked_interfaces 'wan'