From a1370a201392e68355766e098782bafd6a903524 Mon Sep 17 00:00:00 2001 From: ddrager Date: Tue, 12 Apr 2016 10:12:04 -0400 Subject: [PATCH 1/4] Add paths, fixes error while csf is upgrading --- docker.sh | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/docker.sh b/docker.sh index a178677..fb84d4a 100644 --- a/docker.sh +++ b/docker.sh @@ -7,36 +7,36 @@ chain_exists() { } local chain_name="$1" ; shift [ $# -eq 1 ] && local table="--table $1" - iptables $table -n --list "$chain_name" >/dev/null 2>&1 + /sbin/iptables $table -n --list "$chain_name" >/dev/null 2>&1 } DOCKER_INT="docker0" DOCKER_NETWORK="172.17.0.0/16" -iptables-save | grep -v -- '-j DOCKER' | iptables-restore -chain_exists DOCKER && iptables -X DOCKER -chain_exists DOCKER nat && iptables -t nat -X DOCKER +/sbin/iptables-save | grep -v -- '-j DOCKER' | /sbin/iptables-restore +chain_exists DOCKER && /sbin/iptables -X DOCKER +chain_exists DOCKER nat && /sbin/iptables -t nat -X DOCKER -iptables -N DOCKER -iptables -t nat -N DOCKER +/sbin/iptables -N DOCKER +/sbin/iptables -t nat -N DOCKER -iptables -A FORWARD -o ${DOCKER_INT} -j DOCKER -iptables -A FORWARD -o ${DOCKER_INT} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -iptables -A FORWARD -i ${DOCKER_INT} ! -o ${DOCKER_INT} -j ACCEPT -iptables -A FORWARD -i ${DOCKER_INT} -o ${DOCKER_INT} -j ACCEPT +/sbin/iptables -A FORWARD -o ${DOCKER_INT} -j DOCKER +/sbin/iptables -A FORWARD -o ${DOCKER_INT} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +/sbin/iptables -A FORWARD -i ${DOCKER_INT} ! -o ${DOCKER_INT} -j ACCEPT +/sbin/iptables -A FORWARD -i ${DOCKER_INT} -o ${DOCKER_INT} -j ACCEPT -iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER -iptables -t nat -A POSTROUTING -s ${DOCKER_NETWORK} ! -o ${DOCKER_INT} -j MASQUERADE +/sbin/iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +/sbin/iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +/sbin/iptables -t nat -A POSTROUTING -s ${DOCKER_NETWORK} ! -o ${DOCKER_INT} -j MASQUERADE -containers=`docker ps -q` +containers=`/bin/docker ps -q` if [ `echo ${containers} | wc -c` -gt "1" ] ; then for container in ${containers} ; do - rules=`docker port ${container} | sed 's/ //g'` + rules=`/bin/docker port ${container} | sed 's/ //g'` if [ `echo ${rules} | wc -c` -gt "1" ] ; then - ipaddr=`docker inspect -f "{{.NetworkSettings.IPAddress}}" ${container}` + ipaddr=`/bin/docker inspect -f "{{.NetworkSettings.IPAddress}}" ${container}` for rule in ${rules} ; do src=`echo ${rule} | awk -F'->' '{ print $2 }'` @@ -48,10 +48,10 @@ if [ `echo ${containers} | wc -c` -gt "1" ] ; then dst_port=`echo ${dst} | awk -F'/' '{ print $1 }'` dst_proto=`echo ${dst} | awk -F'/' '{ print $2 }'` - iptables -A DOCKER -d ${ipaddr}/32 ! -i ${DOCKER_INT} -o ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j ACCEPT + /sbin/iptables -A DOCKER -d ${ipaddr}/32 ! -i ${DOCKER_INT} -o ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j ACCEPT - iptables -t nat -A POSTROUTING -s ${ipaddr}/32 -d ${ipaddr}/32 -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j MASQUERADE - iptables -t nat -A DOCKER ! -i ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${src_port} -j DNAT --to-destination ${ipaddr}:${dst_port} + /sbin/iptables -t nat -A POSTROUTING -s ${ipaddr}/32 -d ${ipaddr}/32 -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j MASQUERADE + /sbin/iptables -t nat -A DOCKER ! -i ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${src_port} -j DNAT --to-destination ${ipaddr}:${dst_port} done fi done From d931666874c46547ee850ead4d9e7cc7cfa15fca Mon Sep 17 00:00:00 2001 From: ddrager Date: Tue, 12 Apr 2016 10:21:31 -0400 Subject: [PATCH 2/4] Add variable for binary locations --- docker.sh | 41 ++++++++++++++++++++++------------------- 1 file changed, 22 insertions(+), 19 deletions(-) mode change 100644 => 100755 docker.sh diff --git a/docker.sh b/docker.sh old mode 100644 new mode 100755 index fb84d4a..2ad9f80 --- a/docker.sh +++ b/docker.sh @@ -1,5 +1,8 @@ #!/bin/bash +DOCKER_DIR="/bin" +IPTABLES_DIR="/sbin" + chain_exists() { [ $# -lt 1 -o $# -gt 2 ] && { echo "Usage: chain_exists [table]" >&2 @@ -7,36 +10,36 @@ chain_exists() { } local chain_name="$1" ; shift [ $# -eq 1 ] && local table="--table $1" - /sbin/iptables $table -n --list "$chain_name" >/dev/null 2>&1 + ${IPTABLES_DIR}/iptables $table -n --list "$chain_name" >/dev/null 2>&1 } DOCKER_INT="docker0" DOCKER_NETWORK="172.17.0.0/16" -/sbin/iptables-save | grep -v -- '-j DOCKER' | /sbin/iptables-restore -chain_exists DOCKER && /sbin/iptables -X DOCKER -chain_exists DOCKER nat && /sbin/iptables -t nat -X DOCKER +${IPTABLES_DIR}/iptables-save | grep -v -- '-j DOCKER' | ${IPTABLES_DIR}/iptables-restore +chain_exists DOCKER && ${IPTABLES_DIR}/iptables -X DOCKER +chain_exists DOCKER nat && ${IPTABLES_DIR}/iptables -t nat -X DOCKER -/sbin/iptables -N DOCKER -/sbin/iptables -t nat -N DOCKER +${IPTABLES_DIR}/iptables -N DOCKER +${IPTABLES_DIR}/iptables -t nat -N DOCKER -/sbin/iptables -A FORWARD -o ${DOCKER_INT} -j DOCKER -/sbin/iptables -A FORWARD -o ${DOCKER_INT} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -/sbin/iptables -A FORWARD -i ${DOCKER_INT} ! -o ${DOCKER_INT} -j ACCEPT -/sbin/iptables -A FORWARD -i ${DOCKER_INT} -o ${DOCKER_INT} -j ACCEPT +${IPTABLES_DIR}/iptables -A FORWARD -o ${DOCKER_INT} -j DOCKER +${IPTABLES_DIR}/iptables -A FORWARD -o ${DOCKER_INT} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +${IPTABLES_DIR}/iptables -A FORWARD -i ${DOCKER_INT} ! -o ${DOCKER_INT} -j ACCEPT +${IPTABLES_DIR}/iptables -A FORWARD -i ${DOCKER_INT} -o ${DOCKER_INT} -j ACCEPT -/sbin/iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -/sbin/iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER -/sbin/iptables -t nat -A POSTROUTING -s ${DOCKER_NETWORK} ! -o ${DOCKER_INT} -j MASQUERADE +${IPTABLES_DIR}/iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER +${IPTABLES_DIR}/iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +${IPTABLES_DIR}/iptables -t nat -A POSTROUTING -s ${DOCKER_NETWORK} ! -o ${DOCKER_INT} -j MASQUERADE -containers=`/bin/docker ps -q` +containers=`${DOCKER_DIR}/docker ps -q` if [ `echo ${containers} | wc -c` -gt "1" ] ; then for container in ${containers} ; do - rules=`/bin/docker port ${container} | sed 's/ //g'` + rules=`${DOCKER_DIR}/docker port ${container} | sed 's/ //g'` if [ `echo ${rules} | wc -c` -gt "1" ] ; then - ipaddr=`/bin/docker inspect -f "{{.NetworkSettings.IPAddress}}" ${container}` + ipaddr=`${DOCKER_DIR}/docker inspect -f "{{.NetworkSettings.IPAddress}}" ${container}` for rule in ${rules} ; do src=`echo ${rule} | awk -F'->' '{ print $2 }'` @@ -48,10 +51,10 @@ if [ `echo ${containers} | wc -c` -gt "1" ] ; then dst_port=`echo ${dst} | awk -F'/' '{ print $1 }'` dst_proto=`echo ${dst} | awk -F'/' '{ print $2 }'` - /sbin/iptables -A DOCKER -d ${ipaddr}/32 ! -i ${DOCKER_INT} -o ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j ACCEPT + ${IPTABLES_DIR}/iptables -A DOCKER -d ${ipaddr}/32 ! -i ${DOCKER_INT} -o ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j ACCEPT - /sbin/iptables -t nat -A POSTROUTING -s ${ipaddr}/32 -d ${ipaddr}/32 -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j MASQUERADE - /sbin/iptables -t nat -A DOCKER ! -i ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${src_port} -j DNAT --to-destination ${ipaddr}:${dst_port} + ${IPTABLES_DIR}/iptables -t nat -A POSTROUTING -s ${ipaddr}/32 -d ${ipaddr}/32 -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j MASQUERADE + ${IPTABLES_DIR}/iptables -t nat -A DOCKER ! -i ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${src_port} -j DNAT --to-destination ${ipaddr}:${dst_port} done fi done From 5508dfe0c005f33724f935ae6ead05f4fe51cab8 Mon Sep 17 00:00:00 2001 From: ddrager Date: Tue, 12 Apr 2016 10:24:24 -0400 Subject: [PATCH 3/4] Revert perms --- docker.sh | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 docker.sh diff --git a/docker.sh b/docker.sh old mode 100755 new mode 100644 From 921c85354f682fff04d8d81c446315bd54d01211 Mon Sep 17 00:00:00 2001 From: ddrager Date: Tue, 12 Apr 2016 10:30:34 -0400 Subject: [PATCH 4/4] System binary variables --- docker.sh | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/docker.sh b/docker.sh index 2ad9f80..dbe7647 100644 --- a/docker.sh +++ b/docker.sh @@ -2,6 +2,8 @@ DOCKER_DIR="/bin" IPTABLES_DIR="/sbin" +SYS_DIR="/usr/bin" + chain_exists() { [ $# -lt 1 -o $# -gt 2 ] && { @@ -16,7 +18,7 @@ chain_exists() { DOCKER_INT="docker0" DOCKER_NETWORK="172.17.0.0/16" -${IPTABLES_DIR}/iptables-save | grep -v -- '-j DOCKER' | ${IPTABLES_DIR}/iptables-restore +${IPTABLES_DIR}/iptables-save | ${SYS_DIR}/grep -v -- '-j DOCKER' | ${IPTABLES_DIR}/iptables-restore chain_exists DOCKER && ${IPTABLES_DIR}/iptables -X DOCKER chain_exists DOCKER nat && ${IPTABLES_DIR}/iptables -t nat -X DOCKER @@ -34,22 +36,22 @@ ${IPTABLES_DIR}/iptables -t nat -A POSTROUTING -s ${DOCKER_NETWORK} ! -o ${DOCKE containers=`${DOCKER_DIR}/docker ps -q` -if [ `echo ${containers} | wc -c` -gt "1" ] ; then +if [ `echo ${containers} | ${SYS_DIR}/wc -c` -gt "1" ] ; then for container in ${containers} ; do - rules=`${DOCKER_DIR}/docker port ${container} | sed 's/ //g'` + rules=`${DOCKER_DIR}/docker port ${container} | ${SYS_DIR}/sed 's/ //g'` - if [ `echo ${rules} | wc -c` -gt "1" ] ; then + if [ `echo ${rules} | ${SYS_DIR}/wc -c` -gt "1" ] ; then ipaddr=`${DOCKER_DIR}/docker inspect -f "{{.NetworkSettings.IPAddress}}" ${container}` for rule in ${rules} ; do - src=`echo ${rule} | awk -F'->' '{ print $2 }'` - dst=`echo ${rule} | awk -F'->' '{ print $1 }'` + src=`echo ${rule} | ${SYS_DIR}/awk -F'->' '{ print $2 }'` + dst=`echo ${rule} | ${SYS_DIR}/awk -F'->' '{ print $1 }'` - src_ip=`echo ${src} | awk -F':' '{ print $1 }'` - src_port=`echo ${src} | awk -F':' '{ print $2 }'` + src_ip=`echo ${src} | ${SYS_DIR}/awk -F':' '{ print $1 }'` + src_port=`echo ${src} | ${SYS_DIR}/awk -F':' '{ print $2 }'` - dst_port=`echo ${dst} | awk -F'/' '{ print $1 }'` - dst_proto=`echo ${dst} | awk -F'/' '{ print $2 }'` + dst_port=`echo ${dst} | ${SYS_DIR}/awk -F'/' '{ print $1 }'` + dst_proto=`echo ${dst} | ${SYS_DIR}/awk -F'/' '{ print $2 }'` ${IPTABLES_DIR}/iptables -A DOCKER -d ${ipaddr}/32 ! -i ${DOCKER_INT} -o ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j ACCEPT