YunoHost/moulinette
1
0
Fork 0
mirror of https://github.com/YunoHost/moulinette.git synced 2024-09-03 20:06:31 +02:00
Code Issues Projects Releases Packages Wiki Activity

Update yunohost_firewall.py

Browse source 
Refactoring
This commit is contained in:
titoko 2012-12-13 10:29:53 +01:00 committed by Titoko
parent ace2253eae
commit 3fb7702a86
1 changed files with 37 additions and 65 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

102
yunohost_firewall.py
View file

@ -11,8 +11,8 @@ except ImportError:
def firewall_allow(protocol=None,port=None,ip=None): def firewall_allow(protocol=None,port=None,ipv6=None):
if ip == True: if ipv6 == True:
ip = 'ipv6' ip = 'ipv6'
iptables="ip6tables" iptables="ip6tables"
else: else:
@ -20,24 +20,25 @@ def firewall_allow(protocol=None,port=None,ip=None):
iptables="iptables" iptables="iptables"
if protocol == "Both": if protocol == "Both":
TCP_rule = iptables+" -A INPUT -p tcp -i eth0 --dport "+ port +" -j ACCEPT" TCP_rule = iptables+" -A INPUT -p tcp -i eth0 --dport "+ port +" -j ACCEPT"
UDP_rule = iptables+" -A INPUT -p udp -i eth0 --dport "+ port +" -j ACCEPT" UDP_rule = iptables+" -A INPUT -p udp -i eth0 --dport "+ port +" -j ACCEPT"
append_remove_port(port,'tcp','a',ip)
append_remove_port(port,'udp','a',ip) update_yml(port,'tcp','a',ip)
update_yml(port,'udp','a',ip)
os.system(TCP_rule) os.system(TCP_rule)
os.system(UDP_rule) os.system(UDP_rule)
else: else:
rule = iptables+" -A INPUT -p "+ protocol +" -i eth0 --dport "+ port +" -j ACCEPT" rule = iptables+" -A INPUT -p "+ protocol +" -i eth0 --dport "+ port +" -j ACCEPT"
append_remove_port(port,protocol,'a',ip) update_yml(port,protocol,'a',ip)
os.system(rule) os.system(rule)
def firewall_disallow(protocol=None,port=None,ip=None): def firewall_disallow(protocol=None,port=None,ipv6=None):
if ip == True: if ipv6 == True:
ip = 'ipv6' ip = 'ipv6'
iptables="ip6tables" iptables="ip6tables"
else: else:
@ -47,13 +48,16 @@ def firewall_disallow(protocol=None,port=None,ip=None):
if protocol == "Both": if protocol == "Both":
TCP_rule = iptables+" -A INPUT -p tcp -i eth0 --dport "+ port +" -j REJECT" TCP_rule = iptables+" -A INPUT -p tcp -i eth0 --dport "+ port +" -j REJECT"
UDP_rule = iptables+" -A INPUT -p udp -i eth0 --dport "+ port +" -j REJECT" UDP_rule = iptables+" -A INPUT -p udp -i eth0 --dport "+ port +" -j REJECT"
append_remove_port(port,'tcp','r',ip)
append_remove_port(port,'udp','r',ip) update_yml(port,'tcp','r',ip)
update_yml(port,'udp','r',ip)
os.system(TCP_rule) os.system(TCP_rule)
os.system(UDP_rule) os.system(UDP_rule)
else: else:
rule = iptables+" -A INPUT -p "+ protocol +" -i eth0 --dport "+ port +" -j REJECT" rule = iptables+" -A INPUT -p "+ protocol +" -i eth0 --dport "+ port +" -j REJECT"
append_remove_port(port,protocol,'r',ip) update_yml(port,protocol,'r',ip)
os.system(rule) os.system(rule)
@ -64,27 +68,7 @@ def firewall_list():
''' '''
with open ('firewall.yml') as f: with open ('firewall.yml') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
TCP_port_list_ipv4 = firewall['ipv4']['TCP'] return firewall
UDP_port_list_ipv4 = firewall['ipv4']['UDP']
TCP_port_list_ipv6 = firewall['ipv6']['TCP']
UDP_port_list_ipv6 = firewall['ipv6']['UDP']
print("Port TCP Open for ipv4:")
for i,port in enumerate (TCP_port_list_ipv4):
print("-"+str(port))
print("Port UDP Open for ipv4 :")
for i,port in enumerate (UDP_port_list_ipv4):
print("-"+str(port))
print("Port TCP Open for ipv6:")
for i,port in enumerate (TCP_port_list_ipv6):
print("-"+str(port))
print("Port UDP Open for ipv6 :")
for i,port in enumerate (UDP_port_list_ipv6):
print("-"+str(port))
f.close()
@ -99,39 +83,32 @@ def firewall_reload():
with open('firewall.yml','r') as f: with open('firewall.yml','r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
TCP_port_list_ipv4 = firewall['ipv4']['TCP']
UDP_port_list_ipv4 = firewall['ipv4']['UDP']
TCP_port_list_ipv6 = firewall['ipv6']['TCP']
UDP_port_list_ipv6 = firewall['ipv6']['UDP']
f.close()
os.system ("iptables -P INPUT ACCEPT") os.system ("iptables -P INPUT ACCEPT")
os.system ("iptables -F") os.system ("iptables -F")
os.system ("iptables -X") os.system ("iptables -X")
os.system ("iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT") os.system ("iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT")
append_remove_port('22','TCP','a',False) update_yml('22','TCP','a',False)
os.system ("ip6tables -P INPUT ACCEPT") os.system ("ip6tables -P INPUT ACCEPT")
os.system ("ip6tables -F") os.system ("ip6tables -F")
os.system ("ip6tables -X") os.system ("ip6tables -X")
os.system ("ip6tables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT") os.system ("ip6tables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT")
append_remove_port('22','TCP','a',True) update_yml('22','TCP','a',True)
for i,port in enumerate (TCP_port_list_ipv4): for i,port in enumerate (firewall['ipv4']['TCP']):
os.system ("iptables -A INPUT -p tcp -i eth0 --dport "+ str(port) +" -j ACCEPT") os.system ("iptables -A INPUT -p tcp -i eth0 --dport "+ str(port) +" -j ACCEPT")
print("Port "+str(port)+" on protocol TCP with ipv4 Open") print("Port "+str(port)+" on protocol TCP with ipv4 Open")
for i,port in enumerate (UDP_port_list_ipv4): for i,port in enumerate (firewall['ipv4']['UDP']):
os.system ("iptables -A INPUT -p udp -i eth0 --dport "+ str(port) +" -j ACCEPT") os.system ("iptables -A INPUT -p udp -i eth0 --dport "+ str(port) +" -j ACCEPT")
print("Port "+str(port)+" on protocol UDP with ipv4 Open") print("Port "+str(port)+" on protocol UDP with ipv4 Open")
for i,port in enumerate (TCP_port_list_ipv6): for i,port in enumerate (firewall['ipv6']['TCP']):
os.system ("ip6tables -A INPUT -p tcp -i eth0 --dport "+ str(port) +" -j ACCEPT") os.system ("ip6tables -A INPUT -p tcp -i eth0 --dport "+ str(port) +" -j ACCEPT")
print("Port "+str(port)+" on protocol TCP with ipv6 Open") print("Port "+str(port)+" on protocol TCP with ipv6 Open")
for i,port in enumerate (UDP_port_list_ipv6): for i,port in enumerate (firewall['ipv6']['UDP']):
os.system ("ip6tables -A INPUT -p udp -i eth0 --dport "+ str(port) +" -j ACCEPT") os.system ("ip6tables -A INPUT -p udp -i eth0 --dport "+ str(port) +" -j ACCEPT")
print("Port "+str(port)+" on protocol UDP with ipv6 Open") print("Port "+str(port)+" on protocol UDP with ipv6 Open")
@ -140,36 +117,31 @@ def firewall_reload():
def append_remove_port(port=None,protocol=None,mode=None,ip=None): def update_yml(port=None,protocol=None,mode=None,ip=None):
''' '''
Append port in firewall.yml Append port in firewall.yml
''' '''
if ip == True:
ip = 'ipv6'
else:
ip = 'ipv4'
with open('firewall.yml','r') as f: with open('firewall.yml','r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
if mode == 'a': if mode == 'a':
if int(port) not in firewall[ip][protocol]: if int(port) not in firewall[ip][protocol]:
firewall[ip][protocol].append(int(port)) firewall[ip][protocol].append(int(port))
print("Port "+port+" on protocol "+protocol+" with "+ip+" Open") print("Port "+port+" on protocol "+protocol+" with "+ip+" Open")
else:
print("Port already open")
else: else:
if int(port) in firewall[ip][protocol]: print("Port already open")
firewall[ip][protocol].remove(int(port)) else:
print("Port "+port+" on protocol "+protocol+" with "+ip+" Close") if int(port) in firewall[ip][protocol]:
else: firewall[ip][protocol].remove(int(port))
print("Port already close") print("Port "+port+" on protocol "+protocol+" with "+ip+" Close")
else:
print("Port already close")
firewall[ip][protocol].sort() firewall[ip][protocol].sort()
f.close
os.system("mv firewall.yml firewall.yml.old") os.system("mv firewall.yml firewall.yml.old")
with open('firewall.yml','w') as f: with open('firewall.yml','w') as f:
yaml.dump(firewall,f) yaml.dump(firewall,f)
f.close