moby / moby/libnetwork

docker firewall "fails open" when DOCKER-USER chain already exists

Open
#2,631 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
2.2k
Forks
875
PR merge metrics
No merged PRs in 30d

Description

when docker is launched, if the DOCKER-USER chain already exists, the jump DOCKER-USER rule is not inserted into the FORWARD chain, which results in the firewall "failing open".

this is potentially very hazardous from a security perspective. all that is required for this to happen is for a iptables/nftables "save" to contain the DOCKER-USER chain, and for the restore service to start before docker is started.

the culprit code is here:

https://github.com/moby/libnetwork/blob/b3507428be5b458cb0e2b4086b13531fb0706e46/firewall_linux.go#L33

one potential fix is to insert the jump even if the chain already exists, though in this case it may also be important to also always insert the return to the DOCKER-USER chain as well if it isn't already there.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in firewall_linux.go around line 33 and trace how the existing DOCKER-USER chain is handled during Docker startup. Reproduce the described saved iptables/nftables state, then verify that the FORWARD jump and the DOCKER-USER return behavior remain correct when the chain already exists.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
networking, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.