mirror of
https://github.com/1Panel-dev/1Panel.git
synced 2026-10-12 16:00:33 +00:00
ssongliu
e119239d3d
Replace database rule synchronization with native rule operations and file-based backup, import, and recovery. Update firewall management views, descriptions, whitelist handling, and translations. Include terminal reconnect fixes and xpack build tags for Darwin build targets. Remove temporary regression test files before committing.
123 lines
2.9 KiB
Go
123 lines
2.9 KiB
Go
package docker_guard
|
|
|
|
import (
|
|
"github.com/1Panel-dev/1Panel/agent/buserr"
|
|
|
|
"fmt"
|
|
"os"
|
|
"strings"
|
|
|
|
"github.com/1Panel-dev/1Panel/agent/constant"
|
|
)
|
|
|
|
const (
|
|
Chain = "1PANEL_DOCKER"
|
|
DockerChain = "DOCKER-USER"
|
|
FamilyIPv4 = constant.FirewallFamilyIPv4
|
|
FamilyIPv6 = constant.FirewallFamilyIPv6
|
|
ModeSources = "deny_sources"
|
|
ModeAllow = "allow_sources"
|
|
ModeAll = "deny_all"
|
|
ModeAcceptSources = "accept_sources"
|
|
ModeAcceptAll = "accept_all"
|
|
StatusEffective = "effective"
|
|
StatusDisabled = "disabled"
|
|
StatusNotEffective = "not_effective"
|
|
ReasonCommandMissing = "command_missing"
|
|
ReasonDockerChainMissing = "docker_chain_missing"
|
|
ReasonGuardChainMissing = "guard_chain_missing"
|
|
ReasonJumpMissing = "jump_missing"
|
|
ReasonJumpNotFirst = "jump_not_first"
|
|
ReasonJumpDuplicate = "jump_duplicate"
|
|
ReasonInspectFailed = "inspect_failed"
|
|
)
|
|
|
|
type FamilyError struct {
|
|
Family string
|
|
Err error
|
|
}
|
|
|
|
func (e *FamilyError) Error() string {
|
|
if err, ok := e.Err.(buserr.BusinessError); ok && err.Msg == "ErrDockerForwardPolicyDrop" {
|
|
return err.Error()
|
|
}
|
|
return fmt.Sprintf("%s Docker port guard: %v", e.Family, e.Err)
|
|
}
|
|
func (e *FamilyError) Unwrap() error { return e.Err }
|
|
|
|
type ProxyEndpoint struct {
|
|
Protocol string
|
|
HostIP string
|
|
HostPort uint16
|
|
}
|
|
|
|
type ProxyEndpoints struct {
|
|
Items []ProxyEndpoint
|
|
Inspected bool
|
|
}
|
|
|
|
type DNATRules struct {
|
|
Output string
|
|
Inspected bool
|
|
}
|
|
|
|
type Policy struct {
|
|
UUID string
|
|
Family string
|
|
HostIP string
|
|
HostPort uint16
|
|
Protocol string
|
|
Mode string
|
|
Sources []string
|
|
NativeRules []NativeRule `json:",omitempty"`
|
|
}
|
|
|
|
type FamilyStatus struct {
|
|
Partial bool
|
|
State string
|
|
Reason string
|
|
Initialized bool
|
|
Bound bool
|
|
Effective bool
|
|
}
|
|
|
|
type NativeRule struct {
|
|
Family string `json:"family"`
|
|
Order int64 `json:"order"`
|
|
Tokens []string `json:"tokens"`
|
|
}
|
|
|
|
type PolicyInventory struct {
|
|
Policies []Policy
|
|
RuleOrders map[string][]int64
|
|
}
|
|
|
|
type Runtime interface {
|
|
Initialize([]Policy, PolicyInventory, ...string) error
|
|
Bind(...string) error
|
|
OperateFamily(string, bool) error
|
|
ReplacePolicies([]Policy, PolicyInventory) error
|
|
Unbind(...string) error
|
|
Cleanup() error
|
|
Initialized(string) (bool, error)
|
|
Status(string) FamilyStatus
|
|
ListPolicies() (PolicyInventory, error)
|
|
}
|
|
|
|
const ipv4ForwardingPath = "/proc/sys/net/ipv4/ip_forward"
|
|
|
|
func CheckIPv4Forwarding() error {
|
|
return checkIPv4Forwarding(os.ReadFile)
|
|
}
|
|
|
|
func checkIPv4Forwarding(readFile func(string) ([]byte, error)) error {
|
|
value, err := readFile(ipv4ForwardingPath)
|
|
if err != nil {
|
|
return fmt.Errorf("inspect IPv4 forwarding: %w", err)
|
|
}
|
|
if strings.TrimSpace(string(value)) != "1" {
|
|
return buserr.New("ErrDockerIPv4ForwardingDisabled")
|
|
}
|
|
return nil
|
|
}
|