diff --git a/Cargo.lock b/Cargo.lock index d1d4479e..9d148e63 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -334,7 +334,7 @@ dependencies = [ [[package]] name = "dfw" -version = "1.3.0" +version = "1.3.1" dependencies = [ "bollard", "clap", diff --git a/Cargo.toml b/Cargo.toml index 3c0171cf..a6ae6ec6 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "dfw" -version = "1.3.0" +version = "1.3.1" edition = "2021" authors = ["Pit Kleyersburg "] license = "MIT/Apache-2.0" diff --git a/src/iptables/process.rs b/src/iptables/process.rs index e10263d4..d3f0a44e 100644 --- a/src/iptables/process.rs +++ b/src/iptables/process.rs @@ -254,8 +254,7 @@ impl Process for ContainerToContainer { if let Some(same_network_verdict) = self.same_network_verdict { for network in ctx.network_map.values() { - let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -304,7 +303,7 @@ impl Process for ContainerToContainerRule { "network" => format!("{:?}", network))); let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -327,7 +326,7 @@ impl Process for ContainerToContainerRule { o!("network_name" => &network.name, "src_network" => format!("{:?}", src_network))); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -359,7 +358,7 @@ impl Process for ContainerToContainerRule { o!("network_name" => &network.name, "dst_network" => format!("{:?}", dst_network))); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -415,8 +414,7 @@ impl Process for ContainerToWiderWorld { "external_network_interface" => external_network_interface, "default_policy" => &self.default_policy)); for network in ctx.network_map.values() { - let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -464,7 +462,7 @@ impl Process for ContainerToWiderWorldRule { o!("network_name" => &network.name, "src_network" => format!("{:?}", src_network))); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -479,7 +477,7 @@ impl Process for ContainerToWiderWorldRule { ); } } else { - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -540,8 +538,7 @@ impl Process for ContainerToHost { // Default policy for network in ctx.network_map.values() { - let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -578,7 +575,7 @@ impl Process for ContainerToHostRule { "network" => format!("{:?}", network))); let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -671,7 +668,7 @@ impl Process for WiderWorldToContainerRule { "network" => format!("{:?}", network))); let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -883,7 +880,7 @@ impl Process for ContainerDNATRule { "network" => format!("{:?}", network))); let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -901,7 +898,7 @@ impl Process for ContainerDNATRule { o!("network_name" => &network.name, "src_network" => format!("{:?}", src_network))); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -937,7 +934,7 @@ impl Process for ContainerDNATRule { o!("network_name" => &network.name, "dst_network" => format!("{:?}", dst_network))); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); diff --git a/src/nftables/process.rs b/src/nftables/process.rs index 3da0fd9b..1c16d82a 100644 --- a/src/nftables/process.rs +++ b/src/nftables/process.rs @@ -332,8 +332,7 @@ impl Process for ContainerToContainer { if let Some(same_network_verdict) = self.same_network_verdict { for network in ctx.network_map.values() { - let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -370,7 +369,7 @@ impl Process for ContainerToContainerRule { o!("network_name" => &self.network, "network" => format!("{:?}", network))); let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -394,7 +393,7 @@ impl Process for ContainerToContainerRule { o!("network_name" => &network.name, "src_network" => format!("{:?}", src_network))); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -426,8 +425,7 @@ impl Process for ContainerToContainerRule { o!("network_name" => &network.name, "dst_network" => format!("{:?}", dst_network))); - let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -474,8 +472,7 @@ impl Process for ContainerToWiderWorld { "external_network_interface" => external_network_interface, "default_policy" => &self.default_policy)); for network in ctx.network_map.values() { - let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -512,7 +509,7 @@ impl Process for ContainerToWiderWorldRule { if let Some(ref network) = self.network { if let Some(network) = ctx.network_map.get(network) { let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -530,7 +527,7 @@ impl Process for ContainerToWiderWorldRule { o!("network_name" => &network.name, "src_network" => format!("{:?}", src_network))); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -545,7 +542,7 @@ impl Process for ContainerToWiderWorldRule { ); } } else { - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -603,8 +600,7 @@ impl Process for ContainerToHost { // Default policy for network in ctx.network_map.values() { - let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -642,7 +638,7 @@ impl Process for ContainerToHostRule { "network" => format!("{:?}", network))); let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -821,7 +817,7 @@ impl Process for WiderWorldToContainerRule { "network" => format!("{:?}", network))); let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -1003,7 +999,7 @@ impl Process for ContainerDNATRule { "network" => format!("{:?}", network))); let network_id = network.id.as_ref().expect("Docker network ID missing"); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -1021,7 +1017,7 @@ impl Process for ContainerDNATRule { o!("network_name" => &network.name, "src_network" => format!("{:?}", src_network))); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); @@ -1057,7 +1053,7 @@ impl Process for ContainerDNATRule { o!("network_name" => &network.name, "dst_network" => format!("{:?}", dst_network))); - let bridge_name = get_bridge_name(network_id)?; + let bridge_name = get_bridge_name(network)?; trace!(ctx.logger, "Got bridge name"; o!("network_name" => &network.name, "bridge_name" => &bridge_name)); diff --git a/src/process.rs b/src/process.rs index 8d5f1875..e0347ff4 100644 --- a/src/process.rs +++ b/src/process.rs @@ -155,7 +155,7 @@ where let network_map = get_network_map(&networks).ok_or_else(|| format_err!("no networks found"))?; trace!(logger, "Got map of networks"; - o!("container_map" => format!("{:#?}", container_map))); + o!("network_map" => format!("{:#?}", network_map))); let external_network_interfaces = dfw .global_defaults @@ -215,11 +215,17 @@ impl Default for ProcessingOptions { } } -pub(crate) fn get_bridge_name(network_id: &str) -> Result { - if network_id.len() < 12 { - bail!("network has to be longer than 12 characters"); - } - Ok(format!("br-{}", &network_id[..12])) +pub(crate) fn get_bridge_name(network: &Network) -> Result { + return network.options.as_ref() + .and_then(|options| options.get("com.docker.network.bridge.name")) + .map(|value| Ok(value.to_owned())) + .unwrap_or_else(|| { + let network_id = network.id.as_ref().expect("Docker network ID missing"); + if network_id.len() < 12 { + bail!("network has to be longer than 12 characters"); + } + return Ok(format!("br-{}", &network_id[..12])); + }); } pub(crate) fn get_network_for_container(