YunoHost/moulinette
1
0
Fork 0
mirror of https://github.com/YunoHost/moulinette.git synced 2024-09-03 20:06:31 +02:00
Code Issues Projects Releases Packages Wiki Activity

change firewall.yml and separate upnp redirection and port oppening !

Browse source
This commit is contained in:
titoko 2013-06-29 14:21:30 +02:00
parent 89f8cb2a58
commit 5626d1667b
2 changed files with 50 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
firewall.yml
View file

@ -1,7 +1,13 @@
UPNP: false UPNP: true
ipv4: ipv4:
TCP: [22, 25, 53, 80, 443, 5222, 5269, 5280, 6767, 8888] TCP: [22, 25, 53, 80, 443, 5222, 5269, 5280, 6767, 8888]
UDP: [53] UDP: [53]
upnp:
TCP: [22, 25, 53, 80, 443, 5222, 5269, 5280, 6767, 8888]
UDP: [53]
ipv6: ipv6:
TCP: [22] TCP: [22]
UDP: [53] UDP: [53]
upnp:
TCP: [22]
UDP: [53]

67
yunohost_firewall.py
View file

@ -31,16 +31,16 @@ def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False):
""" """
port = int(port) port = int(port)
if (upnp): if upnp:
add_portmapping(protocol, upnp, ipv6, 'a') add_portmapping(protocol, upnp, ipv6, 'a')
if 0 < port < 65536: if 0 < port < 65536:
if protocol == "Both": if protocol == "Both":
update_yml(port, 'TCP', 'a', ipv6) update_yml(port, 'TCP', 'a', ipv6, upnp)
update_yml(port, 'UDP', 'a', ipv6) update_yml(port, 'UDP', 'a', ipv6, upnp)
else: else:
update_yml(port, protocol, 'a', ipv6) update_yml(port, protocol, 'a', ipv6, upnp)
win_msg(_("Port successfully openned")) win_msg(_("Port successfully openned"))
@ -67,10 +67,10 @@ def firewall_disallow(protocol=None, port=None, ipv6=None, upnp=False):
port = int(port) port = int(port)
if protocol == "Both": if protocol == "Both":
update_yml(port, 'TCP', 'r', ipv6) update_yml(port, 'TCP', 'r', ipv6, upnp)
update_yml(port, 'UDP', 'r', ipv6) update_yml(port, 'UDP', 'r', ipv6, upnp)
else: else:
update_yml(port, protocol, 'r', ipv6) update_yml(port, protocol, 'r', ipv6, upnp)
win_msg(_("Port successfully closed")) win_msg(_("Port successfully closed"))
return firewall_reload(upnp) return firewall_reload(upnp)
@ -113,7 +113,7 @@ def firewall_reload(upnp=False):
if 22 not in firewall['ipv4']['TCP']: if 22 not in firewall['ipv4']['TCP']:
update_yml(22, 'TCP', 'a', False) update_yml(22, 'TCP', 'a', False)
if(os.path.exists("/proc/net/if_inet6")): if os.path.exists("/proc/net/if_inet6"):
os.system("ip6tables -P INPUT ACCEPT") os.system("ip6tables -P INPUT ACCEPT")
os.system("ip6tables -F") os.system("ip6tables -F")
os.system("ip6tables -X") os.system("ip6tables -X")
@ -128,7 +128,7 @@ def firewall_reload(upnp=False):
add_portmapping('TCP', upnp, False, 'r') add_portmapping('TCP', upnp, False, 'r')
add_portmapping('UDP', upnp, False, 'r') add_portmapping('UDP', upnp, False, 'r')
if(os.path.exists("/proc/net/if_inet6")): if os.path.exists("/proc/net/if_inet6"):
add_portmapping('TCP', upnp, True, 'r') add_portmapping('TCP', upnp, True, 'r')
add_portmapping('UDP', upnp, True, 'r') add_portmapping('UDP', upnp, True, 'r')
@ -136,7 +136,7 @@ def firewall_reload(upnp=False):
os.system("iptables -A INPUT -p icmp -j ACCEPT") os.system("iptables -A INPUT -p icmp -j ACCEPT")
os.system("iptables -P INPUT DROP") os.system("iptables -P INPUT DROP")
if(os.path.exists("/proc/net/if_inet6")): if os.path.exists("/proc/net/if_inet6"):
os.system("ip6tables -A INPUT -i lo -j ACCEPT") os.system("ip6tables -A INPUT -i lo -j ACCEPT")
os.system("ip6tables -A INPUT -p icmp -j ACCEPT") os.system("ip6tables -A INPUT -p icmp -j ACCEPT")
os.system("ip6tables -P INPUT DROP") os.system("ip6tables -P INPUT DROP")
@ -147,7 +147,7 @@ def firewall_reload(upnp=False):
return firewall_list() return firewall_list()
def update_yml(port=None, protocol=None, mode=None, ipv6=None): def update_yml(port=None, protocol=None, mode=None, ipv6=None, upnp=False):
""" """
Update firewall.yml Update firewall.yml
Keyword arguments: Keyword arguments:
@ -155,6 +155,7 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None):
port -- Port to open port -- Port to open
mode -- a=append r=remove mode -- a=append r=remove
ipv6 -- Boolean ipv6 ipv6 -- Boolean ipv6
upnp -- Boolean upnp
Return Return
None None
@ -173,14 +174,32 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None):
else: else:
raise YunoHostError(22, _("Port already openned :") + str(port)) raise YunoHostError(22, _("Port already openned :") + str(port))
if upnp:
else: if port not in firewall[ip]['upnp'][protocol]:
if port in firewall[ip][protocol]: firewall[ip]['upnp'][protocol].append(port)
firewall[ip][protocol].remove(port)
else: else:
raise YunoHostError(22, _("Port already closed :") + str(port)) raise YunoHostError(22, _("Port already openned :") + str(port))
else:
if upnp:
if port in firewall[ip]['upnp'][protocol]:
firewall[ip]['upnp'][protocol].remove(port)
else:
raise YunoHostError(22, _("Upnp redirection already deleted :") + str(port))
else:
if port in firewall[ip]['upnp'][protocol]:
firewall[ip]['upnp'][protocol].remove(port)
else:
raise YunoHostError(22, _("Upnp redirection alreadu deleted :") + str(port))
if port in firewall[ip][protocol]:
firewall[ip][protocol].remove(port)
else:
raise YunoHostError(22, _("Port already closed :") + str(port))
firewall[ip][protocol].sort() firewall[ip][protocol].sort()
os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old") os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
@ -222,12 +241,13 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None, mode=None,):
else: else:
os.system("iptables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT") os.system("iptables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT")
if upnp: if upnp:
upnpc = miniupnpc.UPnP() if port in firewall[ip]['upnp'][protocol]:
upnpc.discoverdelay = 200 upnpc = miniupnpc.UPnP()
nbigd = upnpc.discover() upnpc.discoverdelay = 200
if nbigd: nbigd = upnpc.discover()
upnpc.selectigd() if nbigd:
upnpc.addportmapping(port, protocol, upnpc.lanaddr, port, 'yunohost firewall : port %u' % port, '') upnpc.selectigd()
upnpc.addportmapping(port, protocol, upnpc.lanaddr, port, 'yunohost firewall : port %u' % port, '')
os.system("iptables -P INPUT DROP") os.system("iptables -P INPUT DROP")
@ -317,8 +337,7 @@ def firewall_checkupnp():
Keyword arguments: Keyword arguments:
None None
Return Return
0 if installed None
1 if not
""" """
with open('/etc/yunohost/firewall.yml', 'r') as f: with open('/etc/yunohost/firewall.yml', 'r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)