Merge branch 'dev' of https://github.com/titoko/moulinette into dev

Conflicts:
	parse_args

action_map.yml

@@ -442,7 +442,11 @@ firewall:
         ### firewall_reload()
         reload:
             action_help: Reload  all firewall rules
-
+            arguments:
+                -u:
+                    full: --upnp
+                    help: upnp
+                    action: store_true
         ### firewall_allow()
         allow:
             action_help: Allow connection port/protocol
@@ -459,6 +463,10 @@ firewall:
                     full: --ipv6
                     help: ipv6
                     action: store_true
+                -u:
+                    full: --upnp
+                    help: upnp
+                    action: store_true
 
 
         ### firewall_disallow()
@@ -477,6 +485,10 @@ firewall:
                     full: --ipv6
                     help: ipv6
                     action: store_true
+                -u:
+                    full: --upnp
+                    help: upnp
+                    action: store_true
 
 
 #############################

yunohost_firewall.py

@@ -2,6 +2,8 @@
 
 import os
 import sys
+import miniupnpc
+
 try:
     import yaml
 except ImportError:
@@ -12,7 +14,7 @@ from yunohost import YunoHostError, win_msg
 
 
 
-def firewall_allow(protocol=None,port=None,ipv6=None):
+def firewall_allow(protocol=None,port=None,ipv6=None,upnp=False):
     """
     Allow port in iptables
 
@@ -20,6 +22,7 @@ def firewall_allow(protocol=None,port=None,ipv6=None):
         protocol -- Protocol used
         port    -- Port to open
         ipv6    -- Boolean ipv6
+        upnp    --Boolean upnp
     
     Return
         Dict
@@ -39,11 +42,11 @@ def firewall_allow(protocol=None,port=None,ipv6=None):
     else:
         raise YunoHostError(22,_("Port not between 1 and 65535 : ")+str(port))
 
-    return firewall_reload()
+    return firewall_reload(upnp)
 
 
 
-def firewall_disallow(protocol=None,port=None,ipv6=None):
+def firewall_disallow(protocol=None,port=None,ipv6=None,upnp=False):
     """
     Disallow port in iptables
 
@@ -51,6 +54,7 @@ def firewall_disallow(protocol=None,port=None,ipv6=None):
         protocol -- Protocol used
         port    -- Port to open
         ipv6    -- Boolean ipv6
+        upnp    --Boolan upnp
 
     Return
         Dict
@@ -65,7 +69,7 @@ def firewall_disallow(protocol=None,port=None,ipv6=None):
         update_yml(port,protocol,'r',ipv6)
     win_msg(_("Port successfully closed"))
 
-    return firewall_reload()
+    return firewall_reload(upnp)
 
 
 
@@ -86,12 +90,12 @@ def firewall_list():
 
 
 
-def firewall_reload():
+def firewall_reload(upnp=False):
     '''
     Reload iptables configuration
 
     Keyword arguments:
-    None
+        upnp    --Boolean upnp
 
     Return
         Dict
@@ -102,6 +106,7 @@ def firewall_reload():
     os.system ("iptables -P INPUT ACCEPT")
     os.system ("iptables -F")
     os.system ("iptables -X")
+    
     if 22 not in firewall['ipv4']['TCP']:
         update_yml(22,'TCP','a',False)
 
@@ -109,23 +114,40 @@ def firewall_reload():
     os.system ("ip6tables -P INPUT ACCEPT")
     os.system ("ip6tables -F")
     os.system ("ip6tables -X")
-    if 22 not in firewall['ipv6']['TCP']:
-        update_yml(22,'TCP','a',True)
     
-    for i,port in enumerate (firewall['ipv4']['TCP']):
+    if 22 not in firewall['ipv6']['TCP']:
+        update_yml(22,'TCP','a',False)
+
+
+    add_portmapping('TCP',upnp,False);
+    add_portmapping('UDP',upnp,False);
+    add_portmapping('TCP',upnp,True);
+    add_portmapping('UDP',upnp,True);
+
+    """for i,port in enumerate (firewall['ipv4']['TCP']):
         os.system ("iptables -A INPUT -p tcp -i eth0 --dport "+ str(port) +" -j ACCEPT")
+        if upnp:
+            add_portmapping(port,'TCP',upnp)
+
 
 
     for i,port in enumerate (firewall['ipv4']['UDP']):
         os.system ("iptables -A INPUT -p udp -i eth0 --dport "+ str(port) +" -j ACCEPT")
+        if upnp:
+            add_portmapping(port,'UDP',upnp)
 
 
     for i,port in enumerate (firewall['ipv6']['TCP']):
         os.system ("ip6tables -A INPUT -p tcp -i eth0 --dport "+ str(port) +" -j ACCEPT")
+        if upnp:
+            add_portmapping(port,'TCP',upnp)
+
 
 
     for i,port in enumerate (firewall['ipv6']['UDP']):
         os.system ("ip6tables -A INPUT -p udp -i eth0 --dport "+ str(port) +" -j ACCEPT")
+        if upnp:
+            add_portmapping(port,'UDP',upnp)"""
 
 
     os.system ("iptables -P INPUT DROP")
@@ -136,7 +158,6 @@ def firewall_reload():
     return firewall_list()
 
 
-
 def update_yml(port=None,protocol=None,mode=None,ipv6=None):
     """
     Update firewall.yml
@@ -177,3 +198,54 @@ def update_yml(port=None,protocol=None,mode=None,ipv6=None):
 
     with open('firewall.yml','w') as f:
         yaml.dump(firewall,f)
+
+
+def add_portmapping(protocol=None,upnp=False,ipv6=None):
+    """
+
+
+    Send a port mapping rules to igd device
+    Keyword arguments:
+        protocol -- Protocol used
+        port -- Port to open
+
+    Return
+        None
+    """
+
+    if upnp:
+        upnp=miniupnpc.UPnP()
+        upnp.discoverdelay=200
+        nbigd= upnp.discover()
+        if nbigd:
+            try:
+                upnp.selectigd()
+            except:
+                raise YunoHostError(167,_("No upnp devices found"))
+        else:
+            raise YunoHostError(22,_("Can't connect to the igd device"))
+
+        # list the redirections :
+        i = 0
+        for i in (0,100):
+            p = upnp.getgenericportmapping(i)
+            if p==None:
+                break
+            port=p[0]
+            proto=p[1]
+            upnp.deleteportmapping(port,proto);
+            i += 1
+
+
+    if ipv6:
+        ip = 'ipv6'
+    else:
+        ip = 'ipv4'
+    with open('firewall.yml','r') as f:
+        firewall = yaml.load(f)
+
+    for i,port in enumerate (firewall[ip][protocol]):
+        os.system ("iptables -A INPUT -p"+ protocol +"-i eth0 --dport "+ str(port) +" -j ACCEPT")
+        if upnp:
+            upnp.addportmapping(port,protocol,upnp.lanaddr,port,'yunohost firewall : port %u' % port, '')
+