YunoHost/moulinette
1
0
Fork 0
mirror of https://github.com/YunoHost/moulinette.git synced 2024-09-03 20:06:31 +02:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #9 from titoko/dev

Browse source 
Good job :)
This commit is contained in:
Alexis Gavoty 2012-12-13 08:22:33 -08:00
commit 03b5e53a5d
3 changed files with 217 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
action_map.yml
View file

@ -408,6 +408,10 @@ firewall:
list:
action_help: List all firewall rules
### firewall_reload()
reload:
action_help: Reload all firewall rules
### firewall_allow()
allow:
action_help: Allow connection port/protocol
@ -420,15 +424,28 @@ firewall:
- UDP
- TCP
- Both
name:
help: Reference name of the rule
-i:
full: --ipv6
help: ipv6
action: store_true
### firewall_disallow()
disallow:
action_help: Disallow connection
arguments:
name:
help: Reference name of the rule to delete
port:
help: Port to open
protocol:
help: Protocol associated with port
choices:
- UDP
- TCP
- Both
-i:
full: --ipv6
help: ipv6
action: store_true
#############################

8
firewall.yml
View file

@ -1,8 +1,6 @@
# Ports to open
#
ipv4:
TCP: [22, 25, 53, 80, 443, 5222, 5269, 5280]
UDP: [53]
UDP: []
ipv6:
TCP: [22]
UDP: []

194
yunohost_firewall.py
View file

@ -2,7 +2,197 @@
import os
import sys
try:
import yaml
except ImportError:
sys.stderr.write('Error: Yunohost CLI Require yaml lib\n')
sys.stderr.write('apt-get install python-yaml\n')
sys.exit(1)
def firewall_allow(protocol=None,port=None,ipv6=None):
"""
Allow port in iptables
Keyword arguments:
protocol -- Protocol used
port -- Port to open
ipv6 -- Boolean ipv6
Return
Dict
"""
if ipv6 == True:
ip = 'ipv6'
iptables="ip6tables"
else:
ip = 'ipv4'
iptables="iptables"
if protocol == "Both":
TCP_rule = iptables+" -A INPUT -p tcp -i eth0 --dport "+ port +" -j ACCEPT"
UDP_rule = iptables+" -A INPUT -p udp -i eth0 --dport "+ port +" -j ACCEPT"
update_yml(port,'tcp','a',ip)
update_yml(port,'udp','a',ip)
os.system(TCP_rule)
os.system(UDP_rule)
else:
rule = iptables+" -A INPUT -p "+ protocol +" -i eth0 --dport "+ port +" -j ACCEPT"
update_yml(port,protocol,'a',ip)
os.system(rule)
win_msg(_("Port successfully openned"))
return firewall_list()
def firewall_disallow(protocol=None,port=None,ipv6=None):
"""
Disallow port in iptables
Keyword arguments:
protocol -- Protocol used
port -- Port to open
ipv6 -- Boolean ipv6
Return
Dict
"""
if ipv6 == True:
ip = 'ipv6'
iptables="ip6tables"
else:
ip = 'ipv4'
iptables="ip6tables"
if protocol == "Both":
TCP_rule = iptables+" -A INPUT -p tcp -i eth0 --dport "+ port +" -j REJECT"
UDP_rule = iptables+" -A INPUT -p udp -i eth0 --dport "+ port +" -j REJECT"
update_yml(port,'tcp','r',ip)
update_yml(port,'udp','r',ip)
os.system(TCP_rule)
os.system(UDP_rule)
else:
rule = iptables+" -A INPUT -p "+ protocol +" -i eth0 --dport "+ port +" -j REJECT"
update_yml(port,protocol,'r',ip)
os.system(rule)
win_msg(_("Port successfully closed"))
return firewall_list
def firewall_list():
"""
Allow port in iptables
Keyword arguments:
None
Return
Dict
"""
with open ('firewall.yml') as f:
firewall = yaml.load(f)
return firewall
def firewall_reload():
'''
Reload iptables configuration
Keyword arguments:
None
Return
Dict
'''
with open('firewall.yml','r') as f:
firewall = yaml.load(f)
os.system ("iptables -P INPUT ACCEPT")
os.system ("iptables -F")
os.system ("iptables -X")
os.system ("iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT")
update_yml('22','TCP','a',False)
os.system ("ip6tables -P INPUT ACCEPT")
os.system ("ip6tables -F")
os.system ("ip6tables -X")
os.system ("ip6tables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT")
update_yml('22','TCP','a',True)
for i,port in enumerate (firewall['ipv4']['TCP']):
os.system ("iptables -A INPUT -p tcp -i eth0 --dport "+ str(port) +" -j ACCEPT")
for i,port in enumerate (firewall['ipv4']['UDP']):
os.system ("iptables -A INPUT -p udp -i eth0 --dport "+ str(port) +" -j ACCEPT")
for i,port in enumerate (firewall['ipv6']['TCP']):
os.system ("ip6tables -A INPUT -p tcp -i eth0 --dport "+ str(port) +" -j ACCEPT")
for i,port in enumerate (firewall['ipv6']['UDP']):
os.system ("ip6tables -A INPUT -p udp -i eth0 --dport "+ str(port) +" -j ACCEPT")
os.system ("iptables -P INPUT DROP")
os.system ("ip6tables -P INPUT DROP")
win_msg(_("Firewall successfully reloaded"))
return firewall_list()
def update_yml(port=None,protocol=None,mode=None,ip=None):
"""
Update firewall.yml
Keyword arguments:
protocol -- Protocol used
port -- Port to open
mode -- a=append r=remove
ipv6 -- Boolean ipv6
Return
None
"""
with open('firewall.yml','r') as f:
firewall = yaml.load(f)
if mode == 'a':
if int(port) not in firewall[ip][protocol]:
firewall[ip][protocol].append(int(port))
print("Port "+port+" on protocol "+protocol+" with "+ip+" Open")
else:
print("Port already open")
else:
if int(port) in firewall[ip][protocol]:
firewall[ip][protocol].remove(int(port))
print("Port "+port+" on protocol "+protocol+" with "+ip+" Close")
else:
print("Port already close")
firewall[ip][protocol].sort()
os.system("mv firewall.yml firewall.yml.old")
with open('firewall.yml','w') as f:
yaml.dump(firewall,f)
def firewall_allow(args):
pass