YunoHost/moulinette
1
0
Fork 0
mirror of https://github.com/YunoHost/moulinette.git synced 2024-09-03 20:06:31 +02:00
Code Issues Projects Releases Packages Wiki Activity

Firewall code sexyness

Browse source
This commit is contained in:
Kload 2013-03-09 13:01:54 +01:00
parent ad4e8e57c2
commit 11c2a78835
1 changed files with 54 additions and 87 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

141
yunohost_firewall.py
View file

@ -17,64 +17,66 @@ from yunohost import YunoHostError, win_msg
def firewall_allow(protocol=None,port=None,ipv6=None,upnp=False): def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False):
""" """
Allow port in iptables Allow port in iptables
Keyword arguments: Keyword arguments:
protocol -- Protocol used protocol -- Protocol used
port -- Port to open port -- Port to open
ipv6 -- Boolean ipv6 ipv6 -- Boolean ipv6
upnp --Boolean upnp upnp -- Boolean upnp
Return Return
Dict Dict
""" """
port=int(port) port = int(port)
if (upnp): if (upnp):
add_portmapping(protocol, upnp, ipv6) add_portmapping(protocol, upnp, ipv6)
if port<65536 and port>0: if 0 < port < 65536:
if protocol == "Both": if protocol == "Both":
update_yml(port,'TCP','a',ipv6) update_yml(port, 'TCP', 'a', ipv6)
update_yml(port,'UDP','a',ipv6) update_yml(port, 'UDP', 'a', ipv6)
else: else:
update_yml(port,protocol,'a',ipv6) update_yml(port, protocol, 'a', ipv6)
win_msg(_("Port successfully openned")) win_msg(_("Port successfully openned"))
else: else:
raise YunoHostError(22,_("Port not between 1 and 65535 : ")+str(port)) raise YunoHostError(22, _("Port not between 1 and 65535 : ")+ str(port))
return firewall_reload(upnp) return firewall_reload(upnp)
def firewall_disallow(protocol=None,port=None,ipv6=None,upnp=False):
def firewall_disallow(protocol=None, port=None, ipv6=None, upnp=False):
""" """
Disallow port in iptables Disallow port in iptables
Keyword arguments: Keyword arguments:
protocol -- Protocol used protocol -- Protocol used
port -- Port to open port -- Port to open
ipv6 -- Boolean ipv6 ipv6 -- Boolean ipv6
upnp --Boolan upnp upnp -- Boolan upnp
Return Return
Dict Dict
""" """
port=int(port) port = int(port)
if protocol == "Both": if protocol == "Both":
update_yml(port,'TCP','r',ipv6) update_yml(port, 'TCP', 'r', ipv6)
update_yml(port,'UDP','r',ipv6) update_yml(port, 'UDP', 'r', ipv6)
else: else:
update_yml(port,protocol,'r',ipv6) update_yml(port, protocol, 'r', ipv6)
win_msg(_("Port successfully closed")) win_msg(_("Port successfully closed"))
return firewall_reload(upnp) return firewall_reload(upnp)
def firewall_list(): def firewall_list():
""" """
Allow port in iptables Allow port in iptables
@ -95,60 +97,34 @@ def firewall_reload(upnp=False):
Reload iptables configuration Reload iptables configuration
Keyword arguments: Keyword arguments:
upnp --Boolean upnp upnp -- Boolean upnp
Return Return
Dict Dict
''' '''
with open('firewall.yml','r') as f: with open('firewall.yml', 'r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
os.system ("iptables -P INPUT ACCEPT") os.system ("iptables -P INPUT ACCEPT")
os.system ("iptables -F") os.system ("iptables -F")
os.system ("iptables -X") os.system ("iptables -X")
if 22 not in firewall['ipv4']['TCP']: if 22 not in firewall['ipv4']['TCP']:
update_yml(22,'TCP','a',False) update_yml(22, 'TCP', 'a', False)
os.system ("ip6tables -P INPUT ACCEPT") os.system ("ip6tables -P INPUT ACCEPT")
os.system ("ip6tables -F") os.system ("ip6tables -F")
os.system ("ip6tables -X") os.system ("ip6tables -X")
if 22 not in firewall['ipv6']['TCP']: if 22 not in firewall['ipv6']['TCP']:
update_yml(22,'TCP','a',False) update_yml(22, 'TCP', 'a', False)
add_portmapping('TCP',upnp,False); add_portmapping('TCP', upnp, False);
add_portmapping('UDP',upnp,False); add_portmapping('UDP', upnp, False);
add_portmapping('TCP',upnp,True); add_portmapping('TCP', upnp, True);
add_portmapping('UDP',upnp,True); add_portmapping('UDP', upnp, True);
"""for i,port in enumerate (firewall['ipv4']['TCP']):
os.system ("iptables -A INPUT -p tcp -i eth0 --dport "+ str(port) +" -j ACCEPT")
if upnp:
add_portmapping(port,'TCP',upnp)
for i,port in enumerate (firewall['ipv4']['UDP']):
os.system ("iptables -A INPUT -p udp -i eth0 --dport "+ str(port) +" -j ACCEPT")
if upnp:
add_portmapping(port,'UDP',upnp)
for i,port in enumerate (firewall['ipv6']['TCP']):
os.system ("ip6tables -A INPUT -p tcp -i eth0 --dport "+ str(port) +" -j ACCEPT")
if upnp:
add_portmapping(port,'TCP',upnp)
for i,port in enumerate (firewall['ipv6']['UDP']):
os.system ("ip6tables -A INPUT -p udp -i eth0 --dport "+ str(port) +" -j ACCEPT")
if upnp:
add_portmapping(port,'UDP',upnp)"""
os.system ("iptables -P INPUT DROP") os.system ("iptables -P INPUT DROP")
os.system ("ip6tables -P INPUT DROP") os.system ("ip6tables -P INPUT DROP")
@ -157,7 +133,8 @@ def firewall_reload(upnp=False):
return firewall_list() return firewall_list()
def update_yml(port=None,protocol=None,mode=None,ipv6=None):
def update_yml(port=None, protocol=None, mode=None, ipv6=None):
""" """
Update firewall.yml Update firewall.yml
Keyword arguments: Keyword arguments:
@ -169,12 +146,10 @@ def update_yml(port=None,protocol=None,mode=None,ipv6=None):
Return Return
None None
""" """
if ipv6: if ipv6: ip = 'ipv6'
ip = 'ipv6' else: ip = 'ipv4'
else:
ip = 'ipv4'
with open('firewall.yml','r') as f: with open('firewall.yml', 'r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
if mode == 'a': if mode == 'a':
@ -182,26 +157,25 @@ def update_yml(port=None,protocol=None,mode=None,ipv6=None):
firewall[ip][protocol].append(port) firewall[ip][protocol].append(port)
else: else:
raise YunoHostError(22,_("Port already openned :")+str(port)) raise YunoHostError(22,_("Port already openned :")+ str(port))
else: else:
if port in firewall[ip][protocol]: if port in firewall[ip][protocol]:
firewall[ip][protocol].remove(port) firewall[ip][protocol].remove(port)
else: else:
raise YunoHostError(22,_("Port already closed :")+str(port)) raise YunoHostError(22,_("Port already closed :")+ str(port))
firewall[ip][protocol].sort() firewall[ip][protocol].sort()
os.system("mv firewall.yml firewall.yml.old") os.system("mv firewall.yml firewall.yml.old")
with open('firewall.yml','w') as f: with open('firewall.yml', 'w') as f:
yaml.dump(firewall,f) yaml.dump(firewall, f)
def add_portmapping(protocol=None,upnp=False,ipv6=None):
def add_portmapping(protocol=None, upnp=False, ipv6=None):
""" """
Send a port mapping rules to igd device Send a port mapping rules to igd device
Keyword arguments: Keyword arguments:
protocol -- Protocol used protocol -- Protocol used
@ -212,9 +186,9 @@ def add_portmapping(protocol=None,upnp=False,ipv6=None):
""" """
os.system ("iptables -P INPUT ACCEPT") os.system ("iptables -P INPUT ACCEPT")
if upnp: if upnp:
upnp=miniupnpc.UPnP() upnp = miniupnpc.UPnP()
upnp.discoverdelay=200 upnp.discoverdelay = 200
nbigd= upnp.discover() nbigd = upnp.discover()
if nbigd: if nbigd:
try: try:
upnp.selectigd() upnp.selectigd()
@ -226,27 +200,20 @@ def add_portmapping(protocol=None,upnp=False,ipv6=None):
raise YunoHostError(22,_("Can't connect to the igd device")) raise YunoHostError(22,_("Can't connect to the igd device"))
# list the redirections : # list the redirections :
i = 0 for i in xrange(100):
for i in (0,100):
p = upnp.getgenericportmapping(i) p = upnp.getgenericportmapping(i)
if p==None: if p is None: break
break upnp.deleteportmapping(p[0], p[1])
port=p[0]
proto=p[1]
upnp.deleteportmapping(port,proto);
i += 1
if ipv6: if ipv6: ip = 'ipv6'
ip = 'ipv6' else: ip = 'ipv4'
else: with open('firewall.yml', 'r') as f:
ip = 'ipv4'
with open('firewall.yml','r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
for i,port in enumerate (firewall[ip][protocol]): for i,port in enumerate (firewall[ip][protocol]):
os.system ("iptables -A INPUT -p "+ protocol +" -i eth0 --dport "+ str(port) +" -j ACCEPT") os.system ("iptables -A INPUT -p "+ protocol +" -i eth0 --dport "+ str(port) +" -j ACCEPT")
if upnp: if upnp:
upnp.addportmapping(port,protocol,upnp.lanaddr,port,'yunohost firewall : port %u' % port, '') upnp.addportmapping(port, protocol, upnp.lanaddr, port, 'yunohost firewall : port %u' % port, '')
os.system ("iptables -P INPUT DROP") os.system ("iptables -P INPUT DROP")