mirror
/
openwrt-packages
mirror of https://git.openwrt.org/feed/packages.git
1
0
Fork 0
Code Releases Activity

dockerd: Added iptables wait to ensure rules are added 

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>
This commit is contained in:
Gerard Ryan 2021-02-20 19:31:55 +10:00
parent 774a0e8be0
commit e64d4bd05b
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
utils/dockerd/files/dockerd.init
View File

@ -206,11 +206,14 @@ iptables_add_blocking_rule() {
return
}
# Wait for a maximum of 10 second per command, retrying every millisecond
local iptables_wait_args="--wait 10 --wait-interval 1000"
# Ignore errors as it might already be present
iptables --table filter --new DOCKER-USER 2>/dev/null
if ! iptables --table filter --check DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump REJECT 2>/dev/null; then
iptables ${iptables_wait_args} --table filter --new DOCKER-USER 2>/dev/null
if ! iptables ${iptables_wait_args} --table filter --check DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump REJECT 2>/dev/null; then
logger -t "dockerd-init" -p notice "Drop traffic from ${inbound} to ${outbound}"
iptables --table filter --insert DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump REJECT
iptables ${iptables_wait_args} --table filter --insert DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump REJECT
fi
}