Implement docker outgoing firewall

restful_tango/tangoREST.py

@@ -169,6 +169,12 @@ def convertJobObj(self, dirName, jobObj):
         if "disable_network" in jobObj and isinstance(jobObj["disable_network"], bool):
             disableNetwork = jobObj["disable_network"]
 
+        allowedOutgoingIPs = None
+        if "allowed_outgoing_ips" in jobObj and isinstance(
+            jobObj["allowed_outgoing_ips"], list
+        ):
+            allowedOutgoingIPs = jobObj["allowed_outgoing_ips"]
+
         job = TangoJob(
             name=name,
             vm=vm,
@@ -180,6 +186,7 @@ def convertJobObj(self, dirName, jobObj):
             accessKey=accessKey,
             accessKeyId=accessKeyId,
             disableNetwork=disableNetwork,
+            allowedOutgoingIPs=allowedOutgoingIPs,
         )
 
         self.log.debug("inputFiles: %s" % [file.localFile for file in input])

tangoObjects.py

@@ -94,6 +94,7 @@ def __init__(
         accessKeyId=None,
         accessKey=None,
         disableNetwork=None,
+        allowedOutgoingIPs=None,
     ):
         self.assigned = False
         self.retries = 0
@@ -114,6 +115,7 @@ def __init__(
         self.accessKeyId = accessKeyId
         self.accessKey = accessKey
         self.disableNetwork = disableNetwork
+        self.allowedOutgoingIPs = allowedOutgoingIPs
 
     def makeAssigned(self):
         self.syncRemote()

vmms/localDocker.py

@@ -142,7 +142,9 @@ def copyIn(self, vm, inputFiles):
             )
         return 0
 
-    def runJob(self, vm, runTimeout, maxOutputFileSize, disableNetwork):
+    def runJob(
+        self, vm, runTimeout, maxOutputFileSize, disableNetwork, allowedOutgoingIPs
+    ):
         """runJob - Run a docker container by doing the follows:
         - mount directory corresponding to this job to /home/autolab
           in the container
@@ -163,6 +165,8 @@ def runJob(self, vm, runTimeout, maxOutputFileSize, disableNetwork):
             args = args + ["-m", f"{vm.memory}m"]
         if disableNetwork:
             args = args + ["--network", "none"]
+        if not disableNetwork and allowedOutgoingIPs:
+            args = args + ["--dns", "8.8.8.8", "--cap-add=NET_ADMIN"]
         args = args + [vm.image]
         args = args + ["sh", "-c"]
 
@@ -176,10 +180,17 @@ def runJob(self, vm, runTimeout, maxOutputFileSize, disableNetwork):
             )
         )
 
+        iptablesCmd = ""
+        if not disableNetwork and allowedOutgoingIPs:
+            iptablesCmd += "iptables -A OUTPUT -d 8.8.8.8 -j ACCEPT; "
+            for IP in allowedOutgoingIPs:
+                iptablesCmd += f"iptables -A OUTPUT -d {IP} -j ACCEPT; "
+            iptablesCmd += "iptables -A OUTPUT -j DROP;"
+
         args = args + [
-            'cp -r mount/* autolab/; su autolab -c "%s"; \
+            '%s cp -r mount/* autolab/; su autolab -c "%s"; \
                         cp output/feedback mount/feedback'
-            % autodriverCmd
+            % (iptablesCmd, autodriverCmd)
         ]
 
         self.log.debug("Running job: %s" % str(args))

worker.py

@@ -292,6 +292,7 @@ def run(self):
                 self.job.timeout,
                 self.job.maxOutputFileSize,
                 self.job.disableNetwork,
+                self.job.allowedOutgoingIPs,
             )
             if ret["runjob"] != 0:
                 Config.runjob_errors += 1