frodovdr/csf-post-docker
1
0
Fork 0
mirror of https://github.com/juliengk/csf-post-docker.git synced 2023-10-10 13:37:41 +02:00
Code Issues Releases Wiki Activity

Use multiple isolation levels & fix bridges with custom names

Browse Source
This commit is contained in:
Kurounin 2019-07-06 21:23:31 +03:00 committed by Julien Kassar
parent c75b0f1cf0
commit 61513b408f
1 changed files with 69 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
docker.sh
View File

@ -16,21 +16,26 @@ add_to_forward() {
local docker_int=$1
if [ `iptables -nvL FORWARD | grep ${docker_int} | wc -l` -eq 0 ]; then
iptables -A FORWARD -o ${docker_int} -j DOCKER
iptables -A FORWARD -o ${docker_int} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -o ${docker_int} -j DOCKER
iptables -A FORWARD -i ${docker_int} ! -o ${docker_int} -j ACCEPT
iptables -A FORWARD -i ${docker_int} -o ${docker_int} -j ACCEPT
fi
}
add_to_docker_isolation() {
local int_in=$1
local int_out=$2
add_to_nat() {
local docker_int=$1
local subnet=$2
iptables -C -A DOCKER-ISOLATION -i ${int_in} -o ${int_out} -j DROP > /dev/null 2>&1
if [ $? -eq 0 ]; then
iptables -A DOCKER-ISOLATION -i ${int_in} -o ${int_out} -j DROP
fi
iptables -t nat -A POSTROUTING -s ${subnet} ! -o ${docker_int} -j MASQUERADE
iptables -t nat -A DOCKER -i ${docker_int} -j RETURN
}
add_to_docker_isolation() {
local docker_int=$1
iptables -A DOCKER-ISOLATION-STAGE-1 -i ${docker_int} ! -o ${docker_int} -j DOCKER-ISOLATION-STAGE-2
iptables -A DOCKER-ISOLATION-STAGE-2 -o ${docker_int} -j DROP
}
DOCKER_INT="docker0"
@ -41,45 +46,43 @@ chain_exists DOCKER && iptables -X DOCKER
chain_exists DOCKER nat && iptables -t nat -X DOCKER
iptables -N DOCKER
iptables -N DOCKER-ISOLATION
iptables -N DOCKER-ISOLATION-STAGE-1
iptables -N DOCKER-ISOLATION-STAGE-2
iptables -N DOCKER-USER
iptables -t nat -N DOCKER
iptables -A FORWARD -j DOCKER-ISOLATION
iptables -A FORWARD -j DOCKER-USER
iptables -A FORWARD -j DOCKER-ISOLATION-STAGE-1
add_to_forward ${DOCKER_INT}
iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -A POSTROUTING -s ${DOCKER_NETWORK} ! -o ${DOCKER_INT} -j MASQUERADE
bridges=`docker network ls -q --filter='Driver=bridge'`
for bridge in $bridges; do
DOCKER_NET_INT=`docker network inspect -f '{{"br-$bridge" | or (index .Options "com.docker.network.bridge.name")}}' $bridge`
subnet=`docker network inspect -f '{{(index .IPAM.Config 0).Subnet}}' $bridge`
add_to_nat ${DOCKER_NET_INT} ${subnet}
add_to_forward ${DOCKER_NET_INT}
add_to_docker_isolation ${DOCKER_NET_INT}
done
containers=`docker ps -q`
if [ `echo ${containers} | wc -c` -gt "1" ]; then
for container in ${containers}; do
netmode=`docker inspect -f "{{.HostConfig.NetworkMode}}" ${container}`
if [ $netmode == "default" ]; then
DOCKER_NET_INT=${DOCKER_INT}
ipaddr=`docker inspect -f "{{.NetworkSettings.IPAddress}}" ${container}`
else
DOCKER_NET_INT="br-$(docker inspect -f "{{.NetworkSettings.Networks.${netmode}.NetworkID}}" ${container} | cut -c -12)"
bridge=$(docker inspect -f "{{.NetworkSettings.Networks.${netmode}.NetworkID}}" ${container} | cut -c -12)
DOCKER_NET_INT=`docker network inspect -f '{{"br-$bridge" | or (index .Options "com.docker.network.bridge.name")}}' $bridge`
ipaddr=`docker inspect -f "{{.NetworkSettings.Networks.${netmode}.IPAddress}}" ${container}`
add_to_docker_isolation ${DOCKER_NET_INT} ${DOCKER_INT}
add_to_docker_isolation ${DOCKER_INT} ${DOCKER_NET_INT}
for net in `docker network ls | awk '{ print $2 }' | grep -Ev "bridge|host|null|ID|${netmode}"`; do
dint="br-$(docker network inspect -f '{{.Id}}' ${net} | cut -c -12)"
add_to_docker_isolation ${DOCKER_NET_INT} ${dint}
done
add_to_forward ${DOCKER_NET_INT}
iptables -C -t nat -I DOCKER -i ${DOCKER_NET_INT} -j RETURN > /dev/null 2>&1
if [ $? -eq 0 ]; then
iptables -t nat -I DOCKER -i ${DOCKER_NET_INT} -j RETURN
fi
fi
rules=`docker port ${container} | sed 's/ //g'`
@ -109,5 +112,10 @@ if [ `echo ${containers} | wc -c` -gt "1" ]; then
done
fi
iptables -A DOCKER-ISOLATION -j RETURN
iptables -t nat -I DOCKER -i ${DOCKER_INT} -j RETURN
iptables -A DOCKER-ISOLATION-STAGE-1 -j RETURN
iptables -A DOCKER-ISOLATION-STAGE-2 -j RETURN
iptables -A DOCKER-USER -j RETURN
if [ `iptables -t nat -nvL DOCKER | grep ${DOCKER_INT} | wc -l` -eq 0 ]; then
iptables -t nat -I DOCKER -i ${DOCKER_INT} -j RETURN
fi