From da4e8314a25dabba8bde06213d448ecf48e95086 Mon Sep 17 00:00:00 2001 From: titoko Date: Mon, 24 Jun 2013 19:25:01 +0200 Subject: [PATCH 1/5] move firewall.yml to /etc/yunohost --- yunohost_firewall.py | 151 ++++++++++++++++++++++--------------------- 1 file changed, 79 insertions(+), 72 deletions(-) diff --git a/yunohost_firewall.py b/yunohost_firewall.py index b9f86ad9..8663bfc9 100644 --- a/yunohost_firewall.py +++ b/yunohost_firewall.py @@ -16,7 +16,6 @@ except ImportError: from yunohost import YunoHostError, win_msg - def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False): """ Allow port in iptables @@ -33,7 +32,7 @@ def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False): """ port = int(port) if (upnp): - add_portmapping(protocol, upnp, ipv6,'a') + add_portmapping(protocol, upnp, ipv6, 'a') if 0 < port < 65536: if protocol == "Both": @@ -46,7 +45,7 @@ def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False): win_msg(_("Port successfully openned")) else: - raise YunoHostError(22, _("Port not between 1 and 65535 : ")+ str(port)) + raise YunoHostError(22, _("Port not between 1 and 65535:") + str(port)) return firewall_reload(upnp) @@ -88,10 +87,11 @@ def firewall_list(): Dict """ - with open ('firewall.yml') as f: + with open('/etc/yunohost/firewall.yml') as f: firewall = yaml.load(f) return firewall + def firewall_reload(upnp=False): ''' Reload iptables configuration @@ -102,44 +102,44 @@ def firewall_reload(upnp=False): Return Dict ''' - with open('firewall.yml', 'r') as f: + with open('/etc/yunohost/firewall.yml', 'r') as f: firewall = yaml.load(f) - os.system ("iptables -P INPUT ACCEPT") - os.system ("iptables -F") - os.system ("iptables -X") - os.system ("iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT") + os.system("iptables -P INPUT ACCEPT") + os.system("iptables -F") + os.system("iptables -X") + os.system("iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT") if 22 not in firewall['ipv4']['TCP']: update_yml(22, 'TCP', 'a', False) if(os.path.exists("/proc/net/if_inet6")): - os.system ("ip6tables -P INPUT ACCEPT") - os.system ("ip6tables -F") - os.system ("ip6tables -X") - os.system ("ip6tables -A INPUT -m state --state ESTABLISHED -j ACCEPT") + os.system("ip6tables -P INPUT ACCEPT") + os.system("ip6tables -F") + os.system("ip6tables -X") + os.system("ip6tables -A INPUT -m state --state ESTABLISHED -j ACCEPT") if 22 not in firewall['ipv6']['TCP']: update_yml(22, 'TCP', 'a', False) if upnp: remove_portmapping() - - add_portmapping('TCP', upnp, False,'r'); - add_portmapping('UDP', upnp, False,'r'); - - if(os.path.exists("/proc/net/if_inet6")): - add_portmapping('TCP', upnp, True,'r'); - add_portmapping('UDP', upnp, True,'r'); - os.system ("iptables -A INPUT -i lo -j ACCEPT") - os.system ("iptables -A INPUT -p icmp -j ACCEPT") - os.system ("iptables -P INPUT DROP") - + add_portmapping('TCP', upnp, False, 'r') + add_portmapping('UDP', upnp, False, 'r') + if(os.path.exists("/proc/net/if_inet6")): - os.system ("ip6tables -A INPUT -i lo -j ACCEPT") - os.system ("ip6tables -A INPUT -p icmp -j ACCEPT") - os.system ("ip6tables -P INPUT DROP") + add_portmapping('TCP', upnp, True, 'r') + add_portmapping('UDP', upnp, True, 'r') + + os.system("iptables -A INPUT -i lo -j ACCEPT") + os.system("iptables -A INPUT -p icmp -j ACCEPT") + os.system("iptables -P INPUT DROP") + + if(os.path.exists("/proc/net/if_inet6")): + os.system("ip6tables -A INPUT -i lo -j ACCEPT") + os.system("ip6tables -A INPUT -p icmp -j ACCEPT") + os.system("ip6tables -P INPUT DROP") os.system("service fail2ban restart") win_msg(_("Firewall successfully reloaded")) @@ -159,10 +159,12 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None): Return None """ - if ipv6: ip = 'ipv6' - else: ip = 'ipv4' + if ipv6: + ip = 'ipv6' + else: + ip = 'ipv4' - with open('firewall.yml', 'r') as f: + with open('/etc/yunohost/firewall.yml', 'r') as f: firewall = yaml.load(f) if mode == 'a': @@ -170,24 +172,24 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None): firewall[ip][protocol].append(port) else: - raise YunoHostError(22,_("Port already openned :")+ str(port)) + raise YunoHostError(22, _("Port already openned :") + str(port)) else: if port in firewall[ip][protocol]: firewall[ip][protocol].remove(port) else: - raise YunoHostError(22,_("Port already closed :")+ str(port)) + raise YunoHostError(22, _("Port already closed :") + str(port)) firewall[ip][protocol].sort() - os.system("mv firewall.yml firewall.yml.old") + os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old") - with open('firewall.yml', 'w') as f: + with open('/etc/yunohost/firewall.yml', 'w') as f: yaml.dump(firewall, f) -def add_portmapping(protocol=None, upnp=False, ipv6=None,mode=None,): +def add_portmapping(protocol=None, upnp=False, ipv6=None, mode=None,): """ Send a port mapping rules to igd device Keyword arguments: @@ -200,23 +202,25 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None,mode=None,): None """ if ipv6: - os.system ("ip6tables -P INPUT ACCEPT") + os.system _("ip6tables -P INPUT ACCEPT") else: - os.system ("iptables -P INPUT ACCEPT") + os.system _("iptables -P INPUT ACCEPT") - if upnp and mode=='a': + if upnp and mode == 'a': remove_portmapping() - - if ipv6: ip = 'ipv6' - else: ip = 'ipv4' - with open('firewall.yml', 'r') as f: + + if ipv6: + ip = 'ipv6' + else: + ip = 'ipv4' + with open('/etc/yunohost/firewall.yml', 'r') as f: firewall = yaml.load(f) - for i,port in enumerate (firewall[ip][protocol]): + for i, port in enumerate(firewall[ip][protocol]): if ipv6: - os.system ("ip6tables -A INPUT -p "+ protocol +" -i eth0 --dport "+ str(port) +" -j ACCEPT") + os.system("ip6tables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT") else: - os.system ("iptables -A INPUT -p "+ protocol +" -i eth0 --dport "+ str(port) +" -j ACCEPT") + os.system("iptables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT") if upnp: upnpc = miniupnpc.UPnP() upnpc.discoverdelay = 200 @@ -225,7 +229,8 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None,mode=None,): upnpc.selectigd() upnpc.addportmapping(port, protocol, upnpc.lanaddr, port, 'yunohost firewall : port %u' % port, '') - os.system ("iptables -P INPUT DROP") + os.system("iptables -P INPUT DROP") + def remove_portmapping(): """ @@ -243,18 +248,19 @@ def remove_portmapping(): upnp.selectigd() except: firewall_reload(False) - raise YunoHostError(167,_("No upnp devices found")) + raise YunoHostError(167, _("No upnp devices found")) else: firewall_reload(False) - raise YunoHostError(22,_("Can't connect to the igd device")) + raise YunoHostError(22, _("Can't connect to the igd device")) # list the redirections : for i in xrange(100): p = upnp.getgenericportmapping(i) - if p is None: break + if p is None: + break upnp.deleteportmapping(p[0], p[1]) - - + + def firewall_installupnp(): """ Add upnp cron @@ -263,19 +269,19 @@ def firewall_installupnp(): Return None """ - - with open('firewall.yml', 'r') as f: + + with open('/etc/yunohost/firewall.yml', 'r') as f: firewall = yaml.load(f) - firewall['UPNP']=True; + firewall['UPNP'] = True os.system("touch /etc/cron.d/yunohost-firewall") os.system("echo '*/50 * * * * root yunohost firewall reload -u>>/dev/null'>/etc/cron.d/yunohost-firewall") win_msg(_("UPNP cron installed")) - os.system("mv firewall.yml firewall.yml.old") + os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old") - with open('firewall.yml', 'w') as f: + with open('/etc/yunohost/firewall.yml', 'w') as f: yaml.dump(firewall, f) @@ -287,23 +293,24 @@ def firewall_removeupnp(): Return None """ - with open('firewall.yml', 'r') as f: + with open('/etc/yunohost/firewall.yml', 'r') as f: firewall = yaml.load(f) - firewall['UPNP']=False; + firewall['UPNP'] = False try: os.remove("/etc/cron.d/yunohost-firewall") except: - raise YunoHostError(167,_("UPNP cron was not installed!")) + raise YunoHostError(167, _("UPNP cron was not installed!")) win_msg(_("UPNP cron removed")) - os.system("mv firewall.yml firewall.yml.old") + os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old") - with open('firewall.yml', 'w') as f: + with open('/etc/yunohost/firewall.yml', 'w') as f: yaml.dump(firewall, f) + def firewall_checkupnp(): """ Check if UPNP is installed @@ -313,13 +320,14 @@ def firewall_checkupnp(): 0 if installed 1 if not """ - with open('firewall.yml', 'r') as f: + with open('/etc/yunohost/firewall.yml', 'r') as f: firewall = yaml.load(f) - + if firewall['UPNP']: win_msg(_("UPNP is activated")) else: - raise YunoHostError(167,_("UPNP not activated!")) + raise YunoHostError(167, _("UPNP not activated!")) + def firewall_stop(): """ @@ -330,13 +338,12 @@ def firewall_stop(): None """ - os.system ("iptables -P INPUT ACCEPT") - os.system ("iptables -F") - os.system ("iptables -X") - - os.system ("ip6tables -P INPUT ACCEPT") - os.system ("ip6tables -F") - os.system ("ip6tables -X") + os.system("iptables -P INPUT ACCEPT") + os.system("iptables -F") + os.system("iptables -X") + + os.system("ip6tables -P INPUT ACCEPT") + os.system("ip6tables -F") + os.system("ip6tables -X") if(os.path.exists("/etc/cron.d/yunohost-firewall")): firewall_removeupnp() - From 9b73e30882b0665dc91bc6904ab0d2611c863fd4 Mon Sep 17 00:00:00 2001 From: titoko Date: Mon, 24 Jun 2013 19:59:01 +0200 Subject: [PATCH 2/5] bugfix --- yunohost_firewall.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/yunohost_firewall.py b/yunohost_firewall.py index 8663bfc9..8c53a37b 100644 --- a/yunohost_firewall.py +++ b/yunohost_firewall.py @@ -202,9 +202,9 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None, mode=None,): None """ if ipv6: - os.system _("ip6tables -P INPUT ACCEPT") + os.system("ip6tables -P INPUT ACCEPT") else: - os.system _("iptables -P INPUT ACCEPT") + os.system("iptables -P INPUT ACCEPT") if upnp and mode == 'a': remove_portmapping() From 5626d1667b4ce84c018acdcd1b06aef635e5c16a Mon Sep 17 00:00:00 2001 From: titoko Date: Sat, 29 Jun 2013 14:21:30 +0200 Subject: [PATCH 3/5] change firewall.yml and separate upnp redirection and port oppening ! --- firewall.yml | 8 +++++- yunohost_firewall.py | 67 ++++++++++++++++++++++++++++---------------- 2 files changed, 50 insertions(+), 25 deletions(-) diff --git a/firewall.yml b/firewall.yml index 617999a3..d76de820 100644 --- a/firewall.yml +++ b/firewall.yml @@ -1,7 +1,13 @@ -UPNP: false +UPNP: true ipv4: TCP: [22, 25, 53, 80, 443, 5222, 5269, 5280, 6767, 8888] UDP: [53] + upnp: + TCP: [22, 25, 53, 80, 443, 5222, 5269, 5280, 6767, 8888] + UDP: [53] ipv6: TCP: [22] UDP: [53] + upnp: + TCP: [22] + UDP: [53] diff --git a/yunohost_firewall.py b/yunohost_firewall.py index 8c53a37b..d44561e0 100644 --- a/yunohost_firewall.py +++ b/yunohost_firewall.py @@ -31,16 +31,16 @@ def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False): """ port = int(port) - if (upnp): + if upnp: add_portmapping(protocol, upnp, ipv6, 'a') if 0 < port < 65536: if protocol == "Both": - update_yml(port, 'TCP', 'a', ipv6) - update_yml(port, 'UDP', 'a', ipv6) + update_yml(port, 'TCP', 'a', ipv6, upnp) + update_yml(port, 'UDP', 'a', ipv6, upnp) else: - update_yml(port, protocol, 'a', ipv6) + update_yml(port, protocol, 'a', ipv6, upnp) win_msg(_("Port successfully openned")) @@ -67,10 +67,10 @@ def firewall_disallow(protocol=None, port=None, ipv6=None, upnp=False): port = int(port) if protocol == "Both": - update_yml(port, 'TCP', 'r', ipv6) - update_yml(port, 'UDP', 'r', ipv6) + update_yml(port, 'TCP', 'r', ipv6, upnp) + update_yml(port, 'UDP', 'r', ipv6, upnp) else: - update_yml(port, protocol, 'r', ipv6) + update_yml(port, protocol, 'r', ipv6, upnp) win_msg(_("Port successfully closed")) return firewall_reload(upnp) @@ -113,7 +113,7 @@ def firewall_reload(upnp=False): if 22 not in firewall['ipv4']['TCP']: update_yml(22, 'TCP', 'a', False) - if(os.path.exists("/proc/net/if_inet6")): + if os.path.exists("/proc/net/if_inet6"): os.system("ip6tables -P INPUT ACCEPT") os.system("ip6tables -F") os.system("ip6tables -X") @@ -128,7 +128,7 @@ def firewall_reload(upnp=False): add_portmapping('TCP', upnp, False, 'r') add_portmapping('UDP', upnp, False, 'r') - if(os.path.exists("/proc/net/if_inet6")): + if os.path.exists("/proc/net/if_inet6"): add_portmapping('TCP', upnp, True, 'r') add_portmapping('UDP', upnp, True, 'r') @@ -136,7 +136,7 @@ def firewall_reload(upnp=False): os.system("iptables -A INPUT -p icmp -j ACCEPT") os.system("iptables -P INPUT DROP") - if(os.path.exists("/proc/net/if_inet6")): + if os.path.exists("/proc/net/if_inet6"): os.system("ip6tables -A INPUT -i lo -j ACCEPT") os.system("ip6tables -A INPUT -p icmp -j ACCEPT") os.system("ip6tables -P INPUT DROP") @@ -147,7 +147,7 @@ def firewall_reload(upnp=False): return firewall_list() -def update_yml(port=None, protocol=None, mode=None, ipv6=None): +def update_yml(port=None, protocol=None, mode=None, ipv6=None, upnp=False): """ Update firewall.yml Keyword arguments: @@ -155,6 +155,7 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None): port -- Port to open mode -- a=append r=remove ipv6 -- Boolean ipv6 + upnp -- Boolean upnp Return None @@ -173,14 +174,32 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None): else: raise YunoHostError(22, _("Port already openned :") + str(port)) - - else: - if port in firewall[ip][protocol]: - firewall[ip][protocol].remove(port) + if upnp: + if port not in firewall[ip]['upnp'][protocol]: + firewall[ip]['upnp'][protocol].append(port) else: - raise YunoHostError(22, _("Port already closed :") + str(port)) + raise YunoHostError(22, _("Port already openned :") + str(port)) + else: + if upnp: + if port in firewall[ip]['upnp'][protocol]: + firewall[ip]['upnp'][protocol].remove(port) + + else: + raise YunoHostError(22, _("Upnp redirection already deleted :") + str(port)) + else: + if port in firewall[ip]['upnp'][protocol]: + firewall[ip]['upnp'][protocol].remove(port) + + else: + raise YunoHostError(22, _("Upnp redirection alreadu deleted :") + str(port)) + + if port in firewall[ip][protocol]: + firewall[ip][protocol].remove(port) + + else: + raise YunoHostError(22, _("Port already closed :") + str(port)) firewall[ip][protocol].sort() os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old") @@ -222,12 +241,13 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None, mode=None,): else: os.system("iptables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT") if upnp: - upnpc = miniupnpc.UPnP() - upnpc.discoverdelay = 200 - nbigd = upnpc.discover() - if nbigd: - upnpc.selectigd() - upnpc.addportmapping(port, protocol, upnpc.lanaddr, port, 'yunohost firewall : port %u' % port, '') + if port in firewall[ip]['upnp'][protocol]: + upnpc = miniupnpc.UPnP() + upnpc.discoverdelay = 200 + nbigd = upnpc.discover() + if nbigd: + upnpc.selectigd() + upnpc.addportmapping(port, protocol, upnpc.lanaddr, port, 'yunohost firewall : port %u' % port, '') os.system("iptables -P INPUT DROP") @@ -317,8 +337,7 @@ def firewall_checkupnp(): Keyword arguments: None Return - 0 if installed - 1 if not + None """ with open('/etc/yunohost/firewall.yml', 'r') as f: firewall = yaml.load(f) From 726c16ab709a45df45e21041ca38bcdc7cea86ed Mon Sep 17 00:00:00 2001 From: titoko Date: Sat, 29 Jun 2013 15:54:32 +0200 Subject: [PATCH 4/5] bugfix when port already add! --- yunohost_firewall.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yunohost_firewall.py b/yunohost_firewall.py index d44561e0..53a19a0b 100644 --- a/yunohost_firewall.py +++ b/yunohost_firewall.py @@ -172,11 +172,11 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None, upnp=False): if port not in firewall[ip][protocol]: firewall[ip][protocol].append(port) - else: - raise YunoHostError(22, _("Port already openned :") + str(port)) - if upnp: + else if upnp: if port not in firewall[ip]['upnp'][protocol]: firewall[ip]['upnp'][protocol].append(port) + else: + raise YunoHostError(22, _("Port already openned :") + str(port)) else: raise YunoHostError(22, _("Port already openned :") + str(port)) From 74a5caa7fc241697b5bc9dc45e2a86dc9931fe7c Mon Sep 17 00:00:00 2001 From: titoko Date: Sat, 29 Jun 2013 15:57:47 +0200 Subject: [PATCH 5/5] elif is better than else if! --- yunohost_firewall.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yunohost_firewall.py b/yunohost_firewall.py index 53a19a0b..d3c4eb8f 100644 --- a/yunohost_firewall.py +++ b/yunohost_firewall.py @@ -172,7 +172,7 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None, upnp=False): if port not in firewall[ip][protocol]: firewall[ip][protocol].append(port) - else if upnp: + elif upnp: if port not in firewall[ip]['upnp'][protocol]: firewall[ip]['upnp'][protocol].append(port) else: