github/linuxkit
1
0
Fork 0
mirror of https://github.com/linuxkit/linuxkit.git synced 2025-07-23 11:00:25 +00:00
Code Issues Projects Releases Wiki Activity

iptables: only open host ports if native/port-forwarding=true in the db

Browse Source 
Signed-off-by: David Scott <dave.scott@docker.com>
This commit is contained in:
David Scott 2016-06-17 16:00:25 +01:00
parent d0876fb05e
commit 55a2becfb4
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
alpine/packages/iptables/main.ml
View File

@ -80,8 +80,14 @@ let parse_ip_port ip_port = match Astring.String.cut ~sep:":" ip_port with
let _ =
( try Unix.mkdir _pid_dir 0o0755 with Unix.Unix_error(Unix.EEXIST, _, _) -> () );
logf "intercepted arguments [%s]" (String.concat "; " (Array.to_list Sys.argv));
( match Array.to_list Sys.argv with
let port_forwarding =
try
let ic = open_in "/Database/branch/master/ro/com.docker.driver.amd64-linux/native/port-forwarding" in
bool_of_string (String.trim (input_line ic))
with _ -> false in
logf "port_forwarding=%b intercepted arguments [%s]" port_forwarding (String.concat "; " (Array.to_list Sys.argv));
if port_forwarding then begin
match Array.to_list Sys.argv with
| [ _; "--wait"; "-t"; "nat"; "-I"; "DOCKER-INGRESS"; "-p"; proto; "--dport"; dport; "-j"; "DNAT"; "--to-destination"; ip_port ] ->
let ip, port = parse_ip_port ip_port in
insert { proto; dport; ip; port }
@ -90,5 +96,5 @@ let _ =
delete { proto; dport; ip; port }
| _ ->
()
);
end;
Unix.execv _iptables Sys.argv