mirror of
https://github.com/YunoHost/moulinette.git
synced 2024-09-03 20:06:31 +02:00
move firewall.yml to /etc/yunohost
This commit is contained in:
titoko
parent
79a0f93144
commit
da4e8314a2
1 changed files with 79 additions and 72 deletions
|
|
@ -16,7 +16,6 @@ except ImportError:
|
|||
from yunohost import YunoHostError, win_msg
|
||||
|
||||
|
||||
|
||||
def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False):
|
||||
"""
|
||||
Allow port in iptables
|
||||
|
|
@ -33,7 +32,7 @@ def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False):
|
|||
"""
|
||||
port = int(port)
|
||||
if (upnp):
|
||||
add_portmapping(protocol, upnp, ipv6,'a')
|
||||
add_portmapping(protocol, upnp, ipv6, 'a')
|
||||
|
||||
if 0 < port < 65536:
|
||||
if protocol == "Both":
|
||||
|
|
@ -46,7 +45,7 @@ def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False):
|
|||
win_msg(_("Port successfully openned"))
|
||||
|
||||
else:
|
||||
raise YunoHostError(22, _("Port not between 1 and 65535 : ")+ str(port))
|
||||
raise YunoHostError(22, _("Port not between 1 and 65535:") + str(port))
|
||||
|
||||
return firewall_reload(upnp)
|
||||
|
||||
|
|
@ -88,10 +87,11 @@ def firewall_list():
|
|||
Dict
|
||||
|
||||
"""
|
||||
with open ('firewall.yml') as f:
|
||||
with open('/etc/yunohost/firewall.yml') as f:
|
||||
firewall = yaml.load(f)
|
||||
return firewall
|
||||
|
||||
|
||||
def firewall_reload(upnp=False):
|
||||
'''
|
||||
Reload iptables configuration
|
||||
|
|
@ -102,44 +102,44 @@ def firewall_reload(upnp=False):
|
|||
Return
|
||||
Dict
|
||||
'''
|
||||
with open('firewall.yml', 'r') as f:
|
||||
with open('/etc/yunohost/firewall.yml', 'r') as f:
|
||||
firewall = yaml.load(f)
|
||||
|
||||
os.system ("iptables -P INPUT ACCEPT")
|
||||
os.system ("iptables -F")
|
||||
os.system ("iptables -X")
|
||||
os.system ("iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT")
|
||||
os.system("iptables -P INPUT ACCEPT")
|
||||
os.system("iptables -F")
|
||||
os.system("iptables -X")
|
||||
os.system("iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT")
|
||||
|
||||
if 22 not in firewall['ipv4']['TCP']:
|
||||
update_yml(22, 'TCP', 'a', False)
|
||||
|
||||
if(os.path.exists("/proc/net/if_inet6")):
|
||||
os.system ("ip6tables -P INPUT ACCEPT")
|
||||
os.system ("ip6tables -F")
|
||||
os.system ("ip6tables -X")
|
||||
os.system ("ip6tables -A INPUT -m state --state ESTABLISHED -j ACCEPT")
|
||||
os.system("ip6tables -P INPUT ACCEPT")
|
||||
os.system("ip6tables -F")
|
||||
os.system("ip6tables -X")
|
||||
os.system("ip6tables -A INPUT -m state --state ESTABLISHED -j ACCEPT")
|
||||
|
||||
if 22 not in firewall['ipv6']['TCP']:
|
||||
update_yml(22, 'TCP', 'a', False)
|
||||
|
||||
if upnp:
|
||||
remove_portmapping()
|
||||
|
||||
add_portmapping('TCP', upnp, False,'r');
|
||||
add_portmapping('UDP', upnp, False,'r');
|
||||
|
||||
if(os.path.exists("/proc/net/if_inet6")):
|
||||
add_portmapping('TCP', upnp, True,'r');
|
||||
add_portmapping('UDP', upnp, True,'r');
|
||||
|
||||
os.system ("iptables -A INPUT -i lo -j ACCEPT")
|
||||
os.system ("iptables -A INPUT -p icmp -j ACCEPT")
|
||||
os.system ("iptables -P INPUT DROP")
|
||||
|
||||
add_portmapping('TCP', upnp, False, 'r')
|
||||
add_portmapping('UDP', upnp, False, 'r')
|
||||
|
||||
if(os.path.exists("/proc/net/if_inet6")):
|
||||
os.system ("ip6tables -A INPUT -i lo -j ACCEPT")
|
||||
os.system ("ip6tables -A INPUT -p icmp -j ACCEPT")
|
||||
os.system ("ip6tables -P INPUT DROP")
|
||||
add_portmapping('TCP', upnp, True, 'r')
|
||||
add_portmapping('UDP', upnp, True, 'r')
|
||||
|
||||
os.system("iptables -A INPUT -i lo -j ACCEPT")
|
||||
os.system("iptables -A INPUT -p icmp -j ACCEPT")
|
||||
os.system("iptables -P INPUT DROP")
|
||||
|
||||
if(os.path.exists("/proc/net/if_inet6")):
|
||||
os.system("ip6tables -A INPUT -i lo -j ACCEPT")
|
||||
os.system("ip6tables -A INPUT -p icmp -j ACCEPT")
|
||||
os.system("ip6tables -P INPUT DROP")
|
||||
|
||||
os.system("service fail2ban restart")
|
||||
win_msg(_("Firewall successfully reloaded"))
|
||||
|
|
@ -159,10 +159,12 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None):
|
|||
Return
|
||||
None
|
||||
"""
|
||||
if ipv6: ip = 'ipv6'
|
||||
else: ip = 'ipv4'
|
||||
if ipv6:
|
||||
ip = 'ipv6'
|
||||
else:
|
||||
ip = 'ipv4'
|
||||
|
||||
with open('firewall.yml', 'r') as f:
|
||||
with open('/etc/yunohost/firewall.yml', 'r') as f:
|
||||
firewall = yaml.load(f)
|
||||
|
||||
if mode == 'a':
|
||||
|
|
@ -170,24 +172,24 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None):
|
|||
firewall[ip][protocol].append(port)
|
||||
|
||||
else:
|
||||
raise YunoHostError(22,_("Port already openned :")+ str(port))
|
||||
raise YunoHostError(22, _("Port already openned :") + str(port))
|
||||
|
||||
else:
|
||||
if port in firewall[ip][protocol]:
|
||||
firewall[ip][protocol].remove(port)
|
||||
|
||||
else:
|
||||
raise YunoHostError(22,_("Port already closed :")+ str(port))
|
||||
raise YunoHostError(22, _("Port already closed :") + str(port))
|
||||
|
||||
firewall[ip][protocol].sort()
|
||||
|
||||
os.system("mv firewall.yml firewall.yml.old")
|
||||
os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
|
||||
|
||||
with open('firewall.yml', 'w') as f:
|
||||
with open('/etc/yunohost/firewall.yml', 'w') as f:
|
||||
yaml.dump(firewall, f)
|
||||
|
||||
|
||||
def add_portmapping(protocol=None, upnp=False, ipv6=None,mode=None,):
|
||||
def add_portmapping(protocol=None, upnp=False, ipv6=None, mode=None,):
|
||||
"""
|
||||
Send a port mapping rules to igd device
|
||||
Keyword arguments:
|
||||
|
|
@ -200,23 +202,25 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None,mode=None,):
|
|||
None
|
||||
"""
|
||||
if ipv6:
|
||||
os.system ("ip6tables -P INPUT ACCEPT")
|
||||
os.system _("ip6tables -P INPUT ACCEPT")
|
||||
else:
|
||||
os.system ("iptables -P INPUT ACCEPT")
|
||||
os.system _("iptables -P INPUT ACCEPT")
|
||||
|
||||
if upnp and mode=='a':
|
||||
if upnp and mode == 'a':
|
||||
remove_portmapping()
|
||||
|
||||
if ipv6: ip = 'ipv6'
|
||||
else: ip = 'ipv4'
|
||||
with open('firewall.yml', 'r') as f:
|
||||
|
||||
if ipv6:
|
||||
ip = 'ipv6'
|
||||
else:
|
||||
ip = 'ipv4'
|
||||
with open('/etc/yunohost/firewall.yml', 'r') as f:
|
||||
firewall = yaml.load(f)
|
||||
|
||||
for i,port in enumerate (firewall[ip][protocol]):
|
||||
for i, port in enumerate(firewall[ip][protocol]):
|
||||
if ipv6:
|
||||
os.system ("ip6tables -A INPUT -p "+ protocol +" -i eth0 --dport "+ str(port) +" -j ACCEPT")
|
||||
os.system("ip6tables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT")
|
||||
else:
|
||||
os.system ("iptables -A INPUT -p "+ protocol +" -i eth0 --dport "+ str(port) +" -j ACCEPT")
|
||||
os.system("iptables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT")
|
||||
if upnp:
|
||||
upnpc = miniupnpc.UPnP()
|
||||
upnpc.discoverdelay = 200
|
||||
|
|
@ -225,7 +229,8 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None,mode=None,):
|
|||
upnpc.selectigd()
|
||||
upnpc.addportmapping(port, protocol, upnpc.lanaddr, port, 'yunohost firewall : port %u' % port, '')
|
||||
|
||||
os.system ("iptables -P INPUT DROP")
|
||||
os.system("iptables -P INPUT DROP")
|
||||
|
||||
|
||||
def remove_portmapping():
|
||||
"""
|
||||
|
|
@ -243,18 +248,19 @@ def remove_portmapping():
|
|||
upnp.selectigd()
|
||||
except:
|
||||
firewall_reload(False)
|
||||
raise YunoHostError(167,_("No upnp devices found"))
|
||||
raise YunoHostError(167, _("No upnp devices found"))
|
||||
else:
|
||||
firewall_reload(False)
|
||||
raise YunoHostError(22,_("Can't connect to the igd device"))
|
||||
raise YunoHostError(22, _("Can't connect to the igd device"))
|
||||
|
||||
# list the redirections :
|
||||
for i in xrange(100):
|
||||
p = upnp.getgenericportmapping(i)
|
||||
if p is None: break
|
||||
if p is None:
|
||||
break
|
||||
upnp.deleteportmapping(p[0], p[1])
|
||||
|
||||
|
||||
|
||||
|
||||
def firewall_installupnp():
|
||||
"""
|
||||
Add upnp cron
|
||||
|
|
@ -263,19 +269,19 @@ def firewall_installupnp():
|
|||
Return
|
||||
None
|
||||
"""
|
||||
|
||||
with open('firewall.yml', 'r') as f:
|
||||
|
||||
with open('/etc/yunohost/firewall.yml', 'r') as f:
|
||||
firewall = yaml.load(f)
|
||||
|
||||
firewall['UPNP']=True;
|
||||
firewall['UPNP'] = True
|
||||
|
||||
os.system("touch /etc/cron.d/yunohost-firewall")
|
||||
os.system("echo '*/50 * * * * root yunohost firewall reload -u>>/dev/null'>/etc/cron.d/yunohost-firewall")
|
||||
win_msg(_("UPNP cron installed"))
|
||||
|
||||
os.system("mv firewall.yml firewall.yml.old")
|
||||
os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
|
||||
|
||||
with open('firewall.yml', 'w') as f:
|
||||
with open('/etc/yunohost/firewall.yml', 'w') as f:
|
||||
yaml.dump(firewall, f)
|
||||
|
||||
|
||||
|
|
@ -287,23 +293,24 @@ def firewall_removeupnp():
|
|||
Return
|
||||
None
|
||||
"""
|
||||
with open('firewall.yml', 'r') as f:
|
||||
with open('/etc/yunohost/firewall.yml', 'r') as f:
|
||||
firewall = yaml.load(f)
|
||||
|
||||
firewall['UPNP']=False;
|
||||
firewall['UPNP'] = False
|
||||
|
||||
try:
|
||||
os.remove("/etc/cron.d/yunohost-firewall")
|
||||
except:
|
||||
raise YunoHostError(167,_("UPNP cron was not installed!"))
|
||||
raise YunoHostError(167, _("UPNP cron was not installed!"))
|
||||
|
||||
win_msg(_("UPNP cron removed"))
|
||||
|
||||
os.system("mv firewall.yml firewall.yml.old")
|
||||
os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
|
||||
|
||||
with open('firewall.yml', 'w') as f:
|
||||
with open('/etc/yunohost/firewall.yml', 'w') as f:
|
||||
yaml.dump(firewall, f)
|
||||
|
||||
|
||||
def firewall_checkupnp():
|
||||
"""
|
||||
Check if UPNP is installed
|
||||
|
|
@ -313,13 +320,14 @@ def firewall_checkupnp():
|
|||
0 if installed
|
||||
1 if not
|
||||
"""
|
||||
with open('firewall.yml', 'r') as f:
|
||||
with open('/etc/yunohost/firewall.yml', 'r') as f:
|
||||
firewall = yaml.load(f)
|
||||
|
||||
|
||||
if firewall['UPNP']:
|
||||
win_msg(_("UPNP is activated"))
|
||||
else:
|
||||
raise YunoHostError(167,_("UPNP not activated!"))
|
||||
raise YunoHostError(167, _("UPNP not activated!"))
|
||||
|
||||
|
||||
def firewall_stop():
|
||||
"""
|
||||
|
|
@ -330,13 +338,12 @@ def firewall_stop():
|
|||
None
|
||||
"""
|
||||
|
||||
os.system ("iptables -P INPUT ACCEPT")
|
||||
os.system ("iptables -F")
|
||||
os.system ("iptables -X")
|
||||
|
||||
os.system ("ip6tables -P INPUT ACCEPT")
|
||||
os.system ("ip6tables -F")
|
||||
os.system ("ip6tables -X")
|
||||
os.system("iptables -P INPUT ACCEPT")
|
||||
os.system("iptables -F")
|
||||
os.system("iptables -X")
|
||||
|
||||
os.system("ip6tables -P INPUT ACCEPT")
|
||||
os.system("ip6tables -F")
|
||||
os.system("ip6tables -X")
|
||||
if(os.path.exists("/etc/cron.d/yunohost-firewall")):
|
||||
firewall_removeupnp()
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue