Albin Kerouanton 27adcd596b libnet/d/bridge: port mappings: drop direct-access when gw_mode=nat ...

When a NAT-based port mapping is created, the daemon adds a DNAT rule in
nat-DOCKER to replace the dest addr with the container IP. However, the
daemon never sets up rules to filter packets destined directly to the
container port. This allows a rogue neighbor (ie. a host that shares a
L2 segment with the host) to send packets directly to the container on
its container-side exposed port.

For instance, if container port 5000 is mapped to host port 6000, a
neighbor could send packets directly to the container on its port 5000.

Since nat-DOCKER mangles the dest addr, and the nat table forbids DROP
rules, this change adds a new rule in the raw-PREROUTING chain to filter
ingress connections targeting the container's IP address.

This filtering is only done when gw_mode=nat. For the unprotected
variant, no filtering is done.

Signed-off-by: Albin Kerouanton <albinker@gmail.com>

2025-01-27 18:41:20 +01:00

..

conntrack.go

Add nlutil functions to retry on netlink EINTR

2024-09-15 12:28:58 +01:00

firewalld_test.go

libnetwork/iptables: deprecate Passthrough

2024-12-16 23:23:11 +01:00

firewalld.go

libnetwork/iptables: remove deprecated Passthrough()

2024-12-17 18:49:10 +01:00

iptables_test.go

libnet/d/bridge: move iptRule to iptables pkg

2024-12-18 11:01:27 +01:00

iptables.go

libnet/d/bridge: port mappings: drop direct-access when gw_mode=nat

2025-01-27 18:41:20 +01:00