Merge titko's modifications

firewall.yml

@@ -2,6 +2,12 @@ UPNP: false
 ipv4:
   TCP: [22, 25, 53, 80, 137, 138, 139, 443, 445, 5222, 5269, 5280, 6767, 7676]
   UDP: [53, 137, 138]
+  upnp:
+    TCP: [22, 25, 53, 80, 137, 138, 139, 443, 445, 5222, 5269, 5280, 6767, 7676]
+    UDP: [53, 137, 138]
 ipv6:
   TCP: [22]
   UDP: [53]
+  upnp:
+    TCP:
+    UDP:

yunohost_firewall.py

@@ -39,7 +39,6 @@ except ImportError:
 from yunohost import YunoHostError, win_msg
 
 
-
 def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False):
     """
     Allow connection port/protocol
@@ -52,16 +51,16 @@ def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False):
 
     """
     port = int(port)
-    if (upnp):
+    if upnp:
         add_portmapping(protocol, upnp, ipv6, 'a')
 
     if 0 < port < 65536:
         if protocol == "Both":
-            update_yml(port, 'TCP', 'a', ipv6)
+            update_yml(port, 'TCP', 'a', ipv6, upnp)
-            update_yml(port, 'UDP', 'a', ipv6)
+            update_yml(port, 'UDP', 'a', ipv6, upnp)
 
         else:
-            update_yml(port, protocol, 'a', ipv6)
+            update_yml(port, protocol, 'a', ipv6, upnp)
 
         win_msg(_("Port successfully openned"))
 
@@ -85,10 +84,10 @@ def firewall_disallow(protocol=None, port=None, ipv6=None, upnp=False):
 
     port = int(port)
     if protocol == "Both":
-        update_yml(port, 'TCP', 'r', ipv6)
+        update_yml(port, 'TCP', 'r', ipv6, upnp)
-        update_yml(port, 'UDP', 'r', ipv6)
+        update_yml(port, 'UDP', 'r', ipv6, upnp)
     else:
-        update_yml(port, protocol, 'r', ipv6)
+        update_yml(port, protocol, 'r', ipv6, upnp)
     win_msg(_("Port successfully closed"))
 
     return firewall_reload(upnp)
@@ -100,10 +99,11 @@ def firewall_list():
 
 
     """
-    with open ('firewall.yml') as f:
+    with open('/etc/yunohost/firewall.yml') as f:
         firewall = yaml.load(f)
     return firewall
 
+
 def firewall_reload(upnp=False):
     """
     Reload all firewall rules
@@ -112,7 +112,7 @@ def firewall_reload(upnp=False):
         upnp -- upnp
 
     """
-    with open('firewall.yml', 'r') as f:
+    with open('/etc/yunohost/firewall.yml', 'r') as f:
         firewall = yaml.load(f)
 
     os.system("iptables -P INPUT ACCEPT")
@@ -123,7 +123,7 @@ def firewall_reload(upnp=False):
     if 22 not in firewall['ipv4']['TCP']:
         update_yml(22, 'TCP', 'a', False)
 
-    if(os.path.exists("/proc/net/if_inet6")):
+    if os.path.exists("/proc/net/if_inet6"):
         os.system("ip6tables -P INPUT ACCEPT")
         os.system("ip6tables -F")
         os.system("ip6tables -X")
@@ -135,18 +135,18 @@ def firewall_reload(upnp=False):
     if upnp:
         remove_portmapping()
 
-    add_portmapping('TCP', upnp, False,'r');
+    add_portmapping('TCP', upnp, False, 'r')
-    add_portmapping('UDP', upnp, False,'r');
+    add_portmapping('UDP', upnp, False, 'r')
 
-    if(os.path.exists("/proc/net/if_inet6")):
+    if os.path.exists("/proc/net/if_inet6"):
-        add_portmapping('TCP', upnp, True,'r');
+        add_portmapping('TCP', upnp, True, 'r')
-        add_portmapping('UDP', upnp, True,'r');
+        add_portmapping('UDP', upnp, True, 'r')
 
     os.system("iptables -A INPUT -i lo -j ACCEPT")
     os.system("iptables -A INPUT -p icmp -j ACCEPT")
     os.system("iptables -P INPUT DROP")
 
-    if(os.path.exists("/proc/net/if_inet6")):
+    if os.path.exists("/proc/net/if_inet6"):
         os.system("ip6tables -A INPUT -i lo -j ACCEPT")
         os.system("ip6tables -A INPUT -p icmp -j ACCEPT")
         os.system("ip6tables -P INPUT DROP")
@@ -157,7 +157,7 @@ def firewall_reload(upnp=False):
     return firewall_list()
 
 
-def update_yml(port=None, protocol=None, mode=None, ipv6=None):
+def update_yml(port=None, protocol=None, mode=None, ipv6=None, upnp=False):
     """
     Update firewall.yml
     Keyword arguments:
@@ -165,35 +165,56 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None):
         port -- Port to open
         mode -- a=append r=remove
         ipv6 -- Boolean ipv6
+        upnp -- Boolean upnp
 
     Return
         None
     """
-    if ipv6: ip = 'ipv6'
+    if ipv6:
-    else:    ip = 'ipv4'
+        ip = 'ipv6'
+    else:
+        ip = 'ipv4'
 
-    with open('firewall.yml', 'r') as f:
+    with open('/etc/yunohost/firewall.yml', 'r') as f:
         firewall = yaml.load(f)
 
     if mode == 'a':
         if port not in firewall[ip][protocol]:
             firewall[ip][protocol].append(port)
 
+        elif upnp:
+            if port not in firewall[ip]['upnp'][protocol]:
+                firewall[ip]['upnp'][protocol].append(port)
             else:
                 raise YunoHostError(22, _("Port already openned :") + str(port))
 
         else:
+            raise YunoHostError(22, _("Port already openned :") + str(port))
+
+    else:
+        if upnp:
+            if port in firewall[ip]['upnp'][protocol]:
+                firewall[ip]['upnp'][protocol].remove(port)
+
+            else:
+                raise YunoHostError(22, _("Upnp redirection already deleted :") + str(port))
+        else:
+            if port in firewall[ip]['upnp'][protocol]:
+                firewall[ip]['upnp'][protocol].remove(port)
+
+            else:
+                raise YunoHostError(22, _("Upnp redirection alreadu deleted :") + str(port))
+
             if port in firewall[ip][protocol]:
                 firewall[ip][protocol].remove(port)
 
             else:
                 raise YunoHostError(22, _("Port already closed :") + str(port))
-
     firewall[ip][protocol].sort()
 
-    os.system("mv firewall.yml firewall.yml.old")
+    os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
 
-    with open('firewall.yml', 'w') as f:
+    with open('/etc/yunohost/firewall.yml', 'w') as f:
         yaml.dump(firewall, f)
 
 
@@ -217,9 +238,11 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None,mode=None,):
     if upnp and mode == 'a':
         remove_portmapping()
 
-    if ipv6: ip = 'ipv6'
+    if ipv6:
-    else:    ip = 'ipv4'
+        ip = 'ipv6'
-    with open('firewall.yml', 'r') as f:
+    else:
+        ip = 'ipv4'
+    with open('/etc/yunohost/firewall.yml', 'r') as f:
         firewall = yaml.load(f)
 
     for i, port in enumerate(firewall[ip][protocol]):
@@ -228,6 +251,7 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None,mode=None,):
         else:
             os.system("iptables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT")
         if upnp:
+            if port in firewall[ip]['upnp'][protocol]:
                 upnpc = miniupnpc.UPnP()
                 upnpc.discoverdelay = 200
                 nbigd = upnpc.discover()
@@ -237,6 +261,7 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None,mode=None,):
 
     os.system("iptables -P INPUT DROP")
 
+
 def remove_portmapping():
     """
     Remove all portmapping rules in the igd device
@@ -261,7 +286,8 @@ def remove_portmapping():
     # list the redirections :
     for i in xrange(100):
         p = upnp.getgenericportmapping(i)
-        if p is None: break
+        if p is None:
+            break
         upnp.deleteportmapping(p[0], p[1])
 
 
@@ -272,18 +298,18 @@ def firewall_installupnp():
 
     """
 
-    with open('firewall.yml', 'r') as f:
+    with open('/etc/yunohost/firewall.yml', 'r') as f:
         firewall = yaml.load(f)
 
-    firewall['UPNP']=True;
+    firewall['UPNP'] = True
 
     os.system("touch /etc/cron.d/yunohost-firewall")
     os.system("echo '*/50 * * * * root yunohost firewall reload -u>>/dev/null'>/etc/cron.d/yunohost-firewall")
     win_msg(_("UPNP cron installed"))
 
-    os.system("mv firewall.yml firewall.yml.old")
+    os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
 
-    with open('firewall.yml', 'w') as f:
+    with open('/etc/yunohost/firewall.yml', 'w') as f:
         yaml.dump(firewall, f)
 
 
@@ -293,10 +319,10 @@ def firewall_removeupnp():
 
 
     """
-    with open('firewall.yml', 'r') as f:
+    with open('/etc/yunohost/firewall.yml', 'r') as f:
         firewall = yaml.load(f)
 
-    firewall['UPNP']=False;
+    firewall['UPNP'] = False
 
     try:
         os.remove("/etc/cron.d/yunohost-firewall")
@@ -305,18 +331,19 @@ def firewall_removeupnp():
 
     win_msg(_("UPNP cron removed"))
 
-    os.system("mv firewall.yml firewall.yml.old")
+    os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
 
-    with open('firewall.yml', 'w') as f:
+    with open('/etc/yunohost/firewall.yml', 'w') as f:
         yaml.dump(firewall, f)
 
+
 def firewall_checkupnp():
     """
     check if UPNP is install or not (0 yes 1 no)
 
 
     """
-    with open('firewall.yml', 'r') as f:
+    with open('/etc/yunohost/firewall.yml', 'r') as f:
         firewall = yaml.load(f)
 
         if firewall['UPNP']:
@@ -324,6 +351,7 @@ def firewall_checkupnp():
         else:
             raise YunoHostError(167, _("UPNP not activated!"))
 
+
 def firewall_stop():
     """
     Stop iptables and ip6tables
@@ -340,4 +368,3 @@ def firewall_stop():
     os.system("ip6tables -X")
     if(os.path.exists("/etc/cron.d/yunohost-firewall")):
         firewall_removeupnp()
-