YunoHost/moulinette
1
0
Fork 0
mirror of https://github.com/YunoHost/moulinette.git synced 2024-09-03 20:06:31 +02:00
Code Issues Projects Releases Packages Wiki Activity

Merge titko's modifications

Browse source
This commit is contained in:
Kload 2013-07-07 09:07:50 +02:00
commit c2e57d5e0a
2 changed files with 114 additions and 81 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
firewall.yml
View file

@ -2,6 +2,12 @@ UPNP: false
ipv4: ipv4:
TCP: [22, 25, 53, 80, 137, 138, 139, 443, 445, 5222, 5269, 5280, 6767, 7676] TCP: [22, 25, 53, 80, 137, 138, 139, 443, 445, 5222, 5269, 5280, 6767, 7676]
UDP: [53, 137, 138] UDP: [53, 137, 138]
upnp:
TCP: [22, 25, 53, 80, 137, 138, 139, 443, 445, 5222, 5269, 5280, 6767, 7676]
UDP: [53, 137, 138]
ipv6: ipv6:
TCP: [22] TCP: [22]
UDP: [53] UDP: [53]
upnp:
TCP:
UDP:

189
yunohost_firewall.py
View file

@ -39,7 +39,6 @@ except ImportError:
from yunohost import YunoHostError, win_msg from yunohost import YunoHostError, win_msg
def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False): def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False):
""" """
Allow connection port/protocol Allow connection port/protocol
@ -52,21 +51,21 @@ def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False):
""" """
port = int(port) port = int(port)
if (upnp): if upnp:
add_portmapping(protocol, upnp, ipv6,'a') add_portmapping(protocol, upnp, ipv6, 'a')
if 0 < port < 65536: if 0 < port < 65536:
if protocol == "Both": if protocol == "Both":
update_yml(port, 'TCP', 'a', ipv6) update_yml(port, 'TCP', 'a', ipv6, upnp)
update_yml(port, 'UDP', 'a', ipv6) update_yml(port, 'UDP', 'a', ipv6, upnp)
else: else:
update_yml(port, protocol, 'a', ipv6) update_yml(port, protocol, 'a', ipv6, upnp)
win_msg(_("Port successfully openned")) win_msg(_("Port successfully openned"))
else: else:
raise YunoHostError(22, _("Port not between 1 and 65535 : ")+ str(port)) raise YunoHostError(22, _("Port not between 1 and 65535:") + str(port))
return firewall_reload(upnp) return firewall_reload(upnp)
@ -85,10 +84,10 @@ def firewall_disallow(protocol=None, port=None, ipv6=None, upnp=False):
port = int(port) port = int(port)
if protocol == "Both": if protocol == "Both":
update_yml(port, 'TCP', 'r', ipv6) update_yml(port, 'TCP', 'r', ipv6, upnp)
update_yml(port, 'UDP', 'r', ipv6) update_yml(port, 'UDP', 'r', ipv6, upnp)
else: else:
update_yml(port, protocol, 'r', ipv6) update_yml(port, protocol, 'r', ipv6, upnp)
win_msg(_("Port successfully closed")) win_msg(_("Port successfully closed"))
return firewall_reload(upnp) return firewall_reload(upnp)
@ -100,10 +99,11 @@ def firewall_list():
""" """
with open ('firewall.yml') as f: with open('/etc/yunohost/firewall.yml') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
return firewall return firewall
def firewall_reload(upnp=False): def firewall_reload(upnp=False):
""" """
Reload all firewall rules Reload all firewall rules
@ -112,22 +112,22 @@ def firewall_reload(upnp=False):
upnp -- upnp upnp -- upnp
""" """
with open('firewall.yml', 'r') as f: with open('/etc/yunohost/firewall.yml', 'r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
os.system ("iptables -P INPUT ACCEPT") os.system("iptables -P INPUT ACCEPT")
os.system ("iptables -F") os.system("iptables -F")
os.system ("iptables -X") os.system("iptables -X")
os.system ("iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT") os.system("iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT")
if 22 not in firewall['ipv4']['TCP']: if 22 not in firewall['ipv4']['TCP']:
update_yml(22, 'TCP', 'a', False) update_yml(22, 'TCP', 'a', False)
if(os.path.exists("/proc/net/if_inet6")): if os.path.exists("/proc/net/if_inet6"):
os.system ("ip6tables -P INPUT ACCEPT") os.system("ip6tables -P INPUT ACCEPT")
os.system ("ip6tables -F") os.system("ip6tables -F")
os.system ("ip6tables -X") os.system("ip6tables -X")
os.system ("ip6tables -A INPUT -m state --state ESTABLISHED -j ACCEPT") os.system("ip6tables -A INPUT -m state --state ESTABLISHED -j ACCEPT")
if 22 not in firewall['ipv6']['TCP']: if 22 not in firewall['ipv6']['TCP']:
update_yml(22, 'TCP', 'a', False) update_yml(22, 'TCP', 'a', False)
@ -135,21 +135,21 @@ def firewall_reload(upnp=False):
if upnp: if upnp:
remove_portmapping() remove_portmapping()
add_portmapping('TCP', upnp, False,'r'); add_portmapping('TCP', upnp, False, 'r')
add_portmapping('UDP', upnp, False,'r'); add_portmapping('UDP', upnp, False, 'r')
if(os.path.exists("/proc/net/if_inet6")): if os.path.exists("/proc/net/if_inet6"):
add_portmapping('TCP', upnp, True,'r'); add_portmapping('TCP', upnp, True, 'r')
add_portmapping('UDP', upnp, True,'r'); add_portmapping('UDP', upnp, True, 'r')
os.system ("iptables -A INPUT -i lo -j ACCEPT") os.system("iptables -A INPUT -i lo -j ACCEPT")
os.system ("iptables -A INPUT -p icmp -j ACCEPT") os.system("iptables -A INPUT -p icmp -j ACCEPT")
os.system ("iptables -P INPUT DROP") os.system("iptables -P INPUT DROP")
if(os.path.exists("/proc/net/if_inet6")): if os.path.exists("/proc/net/if_inet6"):
os.system ("ip6tables -A INPUT -i lo -j ACCEPT") os.system("ip6tables -A INPUT -i lo -j ACCEPT")
os.system ("ip6tables -A INPUT -p icmp -j ACCEPT") os.system("ip6tables -A INPUT -p icmp -j ACCEPT")
os.system ("ip6tables -P INPUT DROP") os.system("ip6tables -P INPUT DROP")
os.system("service fail2ban restart") os.system("service fail2ban restart")
win_msg(_("Firewall successfully reloaded")) win_msg(_("Firewall successfully reloaded"))
@ -157,7 +157,7 @@ def firewall_reload(upnp=False):
return firewall_list() return firewall_list()
def update_yml(port=None, protocol=None, mode=None, ipv6=None): def update_yml(port=None, protocol=None, mode=None, ipv6=None, upnp=False):
""" """
Update firewall.yml Update firewall.yml
Keyword arguments: Keyword arguments:
@ -165,39 +165,60 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None):
port -- Port to open port -- Port to open
mode -- a=append r=remove mode -- a=append r=remove
ipv6 -- Boolean ipv6 ipv6 -- Boolean ipv6
upnp -- Boolean upnp
Return Return
None None
""" """
if ipv6: ip = 'ipv6' if ipv6:
else: ip = 'ipv4' ip = 'ipv6'
else:
ip = 'ipv4'
with open('firewall.yml', 'r') as f: with open('/etc/yunohost/firewall.yml', 'r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
if mode == 'a': if mode == 'a':
if port not in firewall[ip][protocol]: if port not in firewall[ip][protocol]:
firewall[ip][protocol].append(port) firewall[ip][protocol].append(port)
elif upnp:
if port not in firewall[ip]['upnp'][protocol]:
firewall[ip]['upnp'][protocol].append(port)
else:
raise YunoHostError(22, _("Port already openned :") + str(port))
else: else:
raise YunoHostError(22,_("Port already openned :")+ str(port)) raise YunoHostError(22, _("Port already openned :") + str(port))
else: else:
if port in firewall[ip][protocol]: if upnp:
firewall[ip][protocol].remove(port) if port in firewall[ip]['upnp'][protocol]:
firewall[ip]['upnp'][protocol].remove(port)
else:
raise YunoHostError(22, _("Upnp redirection already deleted :") + str(port))
else: else:
raise YunoHostError(22,_("Port already closed :")+ str(port)) if port in firewall[ip]['upnp'][protocol]:
firewall[ip]['upnp'][protocol].remove(port)
else:
raise YunoHostError(22, _("Upnp redirection alreadu deleted :") + str(port))
if port in firewall[ip][protocol]:
firewall[ip][protocol].remove(port)
else:
raise YunoHostError(22, _("Port already closed :") + str(port))
firewall[ip][protocol].sort() firewall[ip][protocol].sort()
os.system("mv firewall.yml firewall.yml.old") os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
with open('firewall.yml', 'w') as f: with open('/etc/yunohost/firewall.yml', 'w') as f:
yaml.dump(firewall, f) yaml.dump(firewall, f)
def add_portmapping(protocol=None, upnp=False, ipv6=None,mode=None,): def add_portmapping(protocol=None, upnp=False, ipv6=None, mode=None,):
""" """
Send a port mapping rules to igd device Send a port mapping rules to igd device
Keyword arguments: Keyword arguments:
@ -210,32 +231,36 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None,mode=None,):
None None
""" """
if ipv6: if ipv6:
os.system ("ip6tables -P INPUT ACCEPT") os.system("ip6tables -P INPUT ACCEPT")
else: else:
os.system ("iptables -P INPUT ACCEPT") os.system("iptables -P INPUT ACCEPT")
if upnp and mode=='a': if upnp and mode == 'a':
remove_portmapping() remove_portmapping()
if ipv6: ip = 'ipv6' if ipv6:
else: ip = 'ipv4' ip = 'ipv6'
with open('firewall.yml', 'r') as f: else:
ip = 'ipv4'
with open('/etc/yunohost/firewall.yml', 'r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
for i,port in enumerate (firewall[ip][protocol]): for i, port in enumerate(firewall[ip][protocol]):
if ipv6: if ipv6:
os.system ("ip6tables -A INPUT -p "+ protocol +" -i eth0 --dport "+ str(port) +" -j ACCEPT") os.system("ip6tables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT")
else: else:
os.system ("iptables -A INPUT -p "+ protocol +" -i eth0 --dport "+ str(port) +" -j ACCEPT") os.system("iptables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT")
if upnp: if upnp:
upnpc = miniupnpc.UPnP() if port in firewall[ip]['upnp'][protocol]:
upnpc.discoverdelay = 200 upnpc = miniupnpc.UPnP()
nbigd = upnpc.discover() upnpc.discoverdelay = 200
if nbigd: nbigd = upnpc.discover()
upnpc.selectigd() if nbigd:
upnpc.addportmapping(port, protocol, upnpc.lanaddr, port, 'yunohost firewall : port %u' % port, '') upnpc.selectigd()
upnpc.addportmapping(port, protocol, upnpc.lanaddr, port, 'yunohost firewall : port %u' % port, '')
os.system("iptables -P INPUT DROP")
os.system ("iptables -P INPUT DROP")
def remove_portmapping(): def remove_portmapping():
""" """
@ -253,15 +278,16 @@ def remove_portmapping():
upnp.selectigd() upnp.selectigd()
except: except:
firewall_reload(False) firewall_reload(False)
raise YunoHostError(167,_("No upnp devices found")) raise YunoHostError(167, _("No upnp devices found"))
else: else:
firewall_reload(False) firewall_reload(False)
raise YunoHostError(22,_("Can't connect to the igd device")) raise YunoHostError(22, _("Can't connect to the igd device"))
# list the redirections : # list the redirections :
for i in xrange(100): for i in xrange(100):
p = upnp.getgenericportmapping(i) p = upnp.getgenericportmapping(i)
if p is None: break if p is None:
break
upnp.deleteportmapping(p[0], p[1]) upnp.deleteportmapping(p[0], p[1])
@ -272,18 +298,18 @@ def firewall_installupnp():
""" """
with open('firewall.yml', 'r') as f: with open('/etc/yunohost/firewall.yml', 'r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
firewall['UPNP']=True; firewall['UPNP'] = True
os.system("touch /etc/cron.d/yunohost-firewall") os.system("touch /etc/cron.d/yunohost-firewall")
os.system("echo '*/50 * * * * root yunohost firewall reload -u>>/dev/null'>/etc/cron.d/yunohost-firewall") os.system("echo '*/50 * * * * root yunohost firewall reload -u>>/dev/null'>/etc/cron.d/yunohost-firewall")
win_msg(_("UPNP cron installed")) win_msg(_("UPNP cron installed"))
os.system("mv firewall.yml firewall.yml.old") os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
with open('firewall.yml', 'w') as f: with open('/etc/yunohost/firewall.yml', 'w') as f:
yaml.dump(firewall, f) yaml.dump(firewall, f)
@ -293,36 +319,38 @@ def firewall_removeupnp():
""" """
with open('firewall.yml', 'r') as f: with open('/etc/yunohost/firewall.yml', 'r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
firewall['UPNP']=False; firewall['UPNP'] = False
try: try:
os.remove("/etc/cron.d/yunohost-firewall") os.remove("/etc/cron.d/yunohost-firewall")
except: except:
raise YunoHostError(167,_("UPNP cron was not installed!")) raise YunoHostError(167, _("UPNP cron was not installed!"))
win_msg(_("UPNP cron removed")) win_msg(_("UPNP cron removed"))
os.system("mv firewall.yml firewall.yml.old") os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
with open('firewall.yml', 'w') as f: with open('/etc/yunohost/firewall.yml', 'w') as f:
yaml.dump(firewall, f) yaml.dump(firewall, f)
def firewall_checkupnp(): def firewall_checkupnp():
""" """
check if UPNP is install or not (0 yes 1 no) check if UPNP is install or not (0 yes 1 no)
""" """
with open('firewall.yml', 'r') as f: with open('/etc/yunohost/firewall.yml', 'r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
if firewall['UPNP']: if firewall['UPNP']:
win_msg(_("UPNP is activated")) win_msg(_("UPNP is activated"))
else: else:
raise YunoHostError(167,_("UPNP not activated!")) raise YunoHostError(167, _("UPNP not activated!"))
def firewall_stop(): def firewall_stop():
""" """
@ -331,13 +359,12 @@ def firewall_stop():
""" """
os.system ("iptables -P INPUT ACCEPT") os.system("iptables -P INPUT ACCEPT")
os.system ("iptables -F") os.system("iptables -F")
os.system ("iptables -X") os.system("iptables -X")
os.system ("ip6tables -P INPUT ACCEPT") os.system("ip6tables -P INPUT ACCEPT")
os.system ("ip6tables -F") os.system("ip6tables -F")
os.system ("ip6tables -X") os.system("ip6tables -X")
if(os.path.exists("/etc/cron.d/yunohost-firewall")): if(os.path.exists("/etc/cron.d/yunohost-firewall")):
firewall_removeupnp() firewall_removeupnp()