docker-ce: Added blocked_interfaces config option

* blocked_interfaces blocks all packets to docker0 from the given
  interface. This is needed because all the iptables commands dockerd
  adds operate before any of the fw3 generated rules.

Signed-off-by: Gerard Ryan <redacted>

diff --git a/utils/docker-ce/files/dockerd.init b/utils/docker-ce/files/dockerd.init
index ad5ba00f8decefe474840d83b3806bf03ef9d519..549b060d9a2039131b5daf367202330014863079 100755 (executable)
--- a/utils/docker-ce/files/dockerd.init
+++ b/utils/docker-ce/files/dockerd.init
@@ -125,6 +125,8 @@ process_config() {
 
        config_load 'dockerd'
 
+       config_list_foreach firewall blocked_interfaces add_docker_firewall_rules
+
        config_get alt_config_file globals alt_config_file
        [ -n "${alt_config_file}" ] && [ -f "${alt_config_file}" ] && {
                ln -s "${alt_config_file}" "${DOCKERD_CONF}"
@@ -177,6 +179,18 @@ service_triggers() {
        procd_add_reload_trigger 'dockerd'
 }
 
+add_docker_firewall_rules() {
+       . /lib/functions/network.sh
+       local device interface="${1}"
+
+       # Ignore errors as it might already be present
+       iptables --table filter --new DOCKER-USER 2>/dev/null
+       network_get_physdev device "${interface}"
+       if ! iptables --table filter --check DOCKER-USER --in-interface "${device}" --out-interface docker0 --jump DROP 2>/dev/null; then
+               iptables --table filter --insert DOCKER-USER --in-interface "${device}" --out-interface docker0 --jump DROP
+       fi
+}
+
 ip4tables_remove_nat() {
        iptables --table nat --delete OUTPUT ! --destination 127.0.0.0/8 --match addrtype --dst-type LOCAL --jump DOCKER
        iptables --table nat --delete PREROUTING --match addrtype --dst-type LOCAL --jump DOCKER
@@ -186,25 +200,22 @@ ip4tables_remove_nat() {
 }
 
 ip4tables_remove_filter() {
-       # Chain DOCKER-USER is only present,
-       # if bip option is NOT set, so >/dev/null 2>&1
-       iptables --table filter --delete FORWARD --jump DOCKER-USER >/dev/null 2>&1
+       iptables --table filter --delete FORWARD --jump DOCKER-USER
        iptables --table filter --delete FORWARD --jump DOCKER-ISOLATION-STAGE-1
        iptables --table filter --delete FORWARD --out-interface docker0 --jump DOCKER
+       iptables --table filter --delete FORWARD --out-interface docker0 --match conntrack --ctstate RELATED,ESTABLISHED --jump ACCEPT
+       iptables --table filter --delete FORWARD --in-interface docker0 --out-interface docker0 --jump ACCEPT
+       iptables --table filter --delete FORWARD --in-interface docker0 ! --out-interface docker0 --jump ACCEPT
 
        iptables --table filter --flush DOCKER
        iptables --table filter --flush DOCKER-ISOLATION-STAGE-1
        iptables --table filter --flush DOCKER-ISOLATION-STAGE-2
-       # Chain DOCKER-USER is only present,
-       # if bip option is NOT set, so >/dev/null 2>&1
-       iptables --table filter --flush DOCKER-USER >/dev/null 2>&1
+       iptables --table filter --flush DOCKER-USER
 
        iptables --table filter --delete-chain DOCKER
        iptables --table filter --delete-chain DOCKER-ISOLATION-STAGE-1
        iptables --table filter --delete-chain DOCKER-ISOLATION-STAGE-2
-       # Chain DOCKER-USER is only present,
-       # if bip option is NOT set, so >/dev/null 2>&1
-       iptables --table filter --delete-chain DOCKER-USER >/dev/null 2>&1
+       iptables --table filter --delete-chain DOCKER-USER
 }
 
 ip4tables_remove() {

diff --git a/utils/docker-ce/files/etc/config/dockerd b/utils/docker-ce/files/etc/config/dockerd
index 6e01d0406596f49ef0b438d7ac6fd5de11b9cc46..13d9845c67c83445b62c0934a9e54fcecc2e694d 100644 (file)
--- a/utils/docker-ce/files/etc/config/dockerd
+++ b/utils/docker-ce/files/etc/config/dockerd
@@ -1,11 +1,18 @@
+# The following settings require a restart to take full effect, A reload will
+# only have partial or no effect:
+# option bip
+# list blocked_interfaces
 
 config globals 'globals'
 #      option alt_config_file "/etc/docker/daemon.json"
        option data_root "/opt/docker/"
        option log_level "warn"
        list hosts "unix:///var/run/docker.sock"
-       # If the bip option is changed, dockerd must be restarted.
-       # A service reload is not enough.
        option bip "172.18.0.1/24"
 #      list registry_mirrors "https://<my-docker-mirror-host>"
 #      list registry_mirrors "https://hub.docker.com"
+
+# Docker ignores fw3 rules and by default all external source IPs are allowed
+# to connect to the Docker host. See https://docs.docker.com/network/iptables/
+config firewall 'firewall'
+       list blocked_interfaces 'wan'