YunoHost/moulinette
1
0
Fork 0
mirror of https://github.com/YunoHost/moulinette.git synced 2024-09-03 20:06:31 +02:00
Code Issues Projects Releases Packages Wiki Activity

firewall refactoring

Browse source
This commit is contained in:
titoko 2013-07-07 15:26:59 +02:00
parent e951cda55e
commit cb22adf7b6
2 changed files with 33 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
firewall.yml
View file

@ -1,13 +1,12 @@
UPNP: false UPNP:
cron: false
ports:
TCP: [22, 25, 53, 80, 137, 138, 139, 443, 445, 5222, 5269, 5280, 6767, 7676]
UDP: [53, 137, 138]
ipv4: ipv4:
TCP: [22, 25, 53, 80, 137, 138, 139, 443, 445, 5222, 5269, 5280, 6767, 7676]
UDP: [53, 137, 138]
upnp:
TCP: [22, 25, 53, 80, 137, 138, 139, 443, 445, 5222, 5269, 5280, 6767, 7676] TCP: [22, 25, 53, 80, 137, 138, 139, 443, 445, 5222, 5269, 5280, 6767, 7676]
UDP: [53, 137, 138] UDP: [53, 137, 138]
ipv6: ipv6:
TCP: [22] TCP: [22]
UDP: [53] UDP: [53]
upnp:
TCP:
UDP:

44
yunohost_firewall.py
View file

@ -181,10 +181,11 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None, upnp=False):
if mode == 'a': if mode == 'a':
if port not in firewall[ip][protocol]: if port not in firewall[ip][protocol]:
firewall[ip][protocol].append(port) firewall[ip][protocol].append(port)
if !ipv6 and upnp:
elif upnp: firewall['UPNP']['ports'][protocol].append(port)
if port not in firewall[ip]['upnp'][protocol]: elif !ipv6 and upnp:
firewall[ip]['upnp'][protocol].append(port) if port not in firewall['UPNP']['ports'][protocol]:
firewall['UPNP']['ports'][protocol].append(port)
else: else:
raise YunoHostError(22, _("Port already openned :") + str(port)) raise YunoHostError(22, _("Port already openned :") + str(port))
@ -192,25 +193,30 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None, upnp=False):
raise YunoHostError(22, _("Port already openned :") + str(port)) raise YunoHostError(22, _("Port already openned :") + str(port))
else: else:
if upnp: if !ipv6 and upnp:
if port in firewall[ip]['upnp'][protocol]: if port in firewall['UPNP']['ports'][protocol]:
firewall[ip]['upnp'][protocol].remove(port) firewall['UPNP']['ports'][protocol].remove(port)
else: else:
raise YunoHostError(22, _("Upnp redirection already deleted :") + str(port)) raise YunoHostError(22, _("Upnp redirection already deleted :") + str(port))
else: elif !ipv6:
if port in firewall[ip]['upnp'][protocol]: if port in firewall['UPNP']['ports'][protocol]:
firewall[ip]['upnp'][protocol].remove(port) firewall['UPNP']['ports'][protocol].remove(port)
else:
raise YunoHostError(22, _("Upnp redirection alreadu deleted :") + str(port))
if port in firewall[ip][protocol]: if port in firewall[ip][protocol]:
firewall[ip][protocol].remove(port) firewall[ip][protocol].remove(port)
else: else:
raise YunoHostError(22, _("Port already closed :") + str(port)) raise YunoHostError(22, _("Port already closed :") + str(port))
else:
if port in firewall[ip][protocol]:
firewall[ip][protocol].remove(port)
else:
raise YunoHostError(22, _("Port already closed :") + str(port))
firewall[ip][protocol].sort() firewall[ip][protocol].sort()
firewall['UPNP']['ports'][protocol].sort()
os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old") os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
@ -235,7 +241,7 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None, mode=None,):
else: else:
os.system("iptables -P INPUT ACCEPT") os.system("iptables -P INPUT ACCEPT")
if upnp and mode == 'a': if upnp and !ipv6 and mode == 'a':
remove_portmapping() remove_portmapping()
if ipv6: if ipv6:
@ -250,8 +256,8 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None, mode=None,):
os.system("ip6tables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT") os.system("ip6tables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT")
else: else:
os.system("iptables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT") os.system("iptables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT")
if upnp: if upnp and !ipv6:
if port in firewall[ip]['upnp'][protocol]: if port in firewall['UPNP']['ports'][protocol]:
upnpc = miniupnpc.UPnP() upnpc = miniupnpc.UPnP()
upnpc.discoverdelay = 200 upnpc.discoverdelay = 200
nbigd = upnpc.discover() nbigd = upnpc.discover()
@ -301,7 +307,7 @@ def firewall_installupnp():
with open('/etc/yunohost/firewall.yml', 'r') as f: with open('/etc/yunohost/firewall.yml', 'r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
firewall['UPNP'] = True firewall['UPNP']['cron'] = True
os.system("touch /etc/cron.d/yunohost-firewall") os.system("touch /etc/cron.d/yunohost-firewall")
os.system("echo '*/50 * * * * root yunohost firewall reload -u>>/dev/null'>/etc/cron.d/yunohost-firewall") os.system("echo '*/50 * * * * root yunohost firewall reload -u>>/dev/null'>/etc/cron.d/yunohost-firewall")
@ -322,7 +328,7 @@ def firewall_removeupnp():
with open('/etc/yunohost/firewall.yml', 'r') as f: with open('/etc/yunohost/firewall.yml', 'r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
firewall['UPNP'] = False firewall['UPNP']['cron'] = False
try: try:
os.remove("/etc/cron.d/yunohost-firewall") os.remove("/etc/cron.d/yunohost-firewall")
@ -346,7 +352,7 @@ def firewall_checkupnp():
with open('/etc/yunohost/firewall.yml', 'r') as f: with open('/etc/yunohost/firewall.yml', 'r') as f:
firewall = yaml.load(f) firewall = yaml.load(f)
if firewall['UPNP']: if firewall['UPNP']['cron']:
win_msg(_("UPNP is activated")) win_msg(_("UPNP is activated"))
else: else:
raise YunoHostError(167, _("UPNP not activated!")) raise YunoHostError(167, _("UPNP not activated!"))