Pour viter toute confusion future, on stocke les dates de blacklist en
nombre de secondes coules depuis Epoch. darcs-hash:20060326040722-68412-25d9d48ded7ffc0279da4fbbeb74bdf610a33b2f.gz
This commit is contained in:
glondu
parent
9623054b9d
commit
230e01cc1b
3 changed files with 50 additions and 46 deletions
|
|
@ -133,7 +133,7 @@ class firewall_crans :
|
|||
|
||||
def filter_table(self) :
|
||||
""" Remplit la table filter """
|
||||
self.anim = anim(' Structure de la table filter')
|
||||
self.anim = anim('\tStructure de la table filter')
|
||||
print OK
|
||||
|
||||
def filter_table_tweaks(self) :
|
||||
|
|
@ -177,17 +177,17 @@ class firewall_crans :
|
|||
|
||||
# On peux router
|
||||
self.post_start_hook()
|
||||
cprint(" -> fin de la procédure de démarrage",'vert')
|
||||
cprint("\t -> fin de la procédure de démarrage",'vert')
|
||||
|
||||
def stop(self):
|
||||
""" Arrête le firewall """
|
||||
cprint("Arrêt du firewall",'gras')
|
||||
self.pre_stop_hook()
|
||||
self.exception_catcher(self.__stop)
|
||||
cprint(" -> fin de la procédure d'arrêt",'vert')
|
||||
cprint("\t -> fin de la procédure d'arrêt",'vert')
|
||||
|
||||
def __stop(self) :
|
||||
self.anim = anim(" Suppression regles")
|
||||
self.anim = anim("\tSuppression regles")
|
||||
iptables("-t nat -P PREROUTING ACCEPT")
|
||||
iptables("-F")
|
||||
iptables("-t nat -F")
|
||||
|
|
@ -198,7 +198,7 @@ class firewall_crans :
|
|||
|
||||
def test_mac_ip(self) :
|
||||
""" Reconstruit la correspondance MAC-IP des machines des adhérents """
|
||||
self.anim = anim(' Chaine TEST_MAC-IP',len(self.__machines())+1)
|
||||
self.anim = anim('\tChaine TEST_MAC-IP',len(self.__machines())+1)
|
||||
iptables("-t nat -P PREROUTING ACCEPT")
|
||||
iptables("-t nat -F TEST_MAC-IP")
|
||||
self.anim.cycle()
|
||||
|
|
@ -263,7 +263,7 @@ class firewall_crans :
|
|||
def mac_ip_maj(self,ip_list) :
|
||||
""" Mise à jour de la correspondance MAC-IP pour les ip fournies """
|
||||
## Que faut-il faire ?
|
||||
self.anim = anim(' Analyse travail à effectuer')
|
||||
self.anim = anim('\tAnalyse travail à effectuer')
|
||||
if ip_list == [''] :
|
||||
print OK + ' (rien à faire)'
|
||||
return
|
||||
|
|
@ -305,7 +305,7 @@ class firewall_crans :
|
|||
if mac_ip_maj or serveur_maj :
|
||||
def procedure() :
|
||||
warn = ''
|
||||
self.anim = anim(' Actualisation TEST_MAC-IP')
|
||||
self.anim = anim('\tActualisation TEST_MAC-IP')
|
||||
for regle in iptables("-t nat -L TEST_MAC-IP -n").split('\n')[2:] :
|
||||
regle = regle.split()
|
||||
ip = regle[3]
|
||||
|
|
@ -356,7 +356,7 @@ class firewall_crans :
|
|||
print OK
|
||||
|
||||
def build_chaine(self,chaine, methode) :
|
||||
self.anim = anim(' Chaîne %s' % chaine,len(self.__machines())+1)
|
||||
self.anim = anim('\tChaîne %s' % chaine,len(self.__machines())+1)
|
||||
iptables("-F %s" % chaine)
|
||||
self.anim.cycle()
|
||||
def procedure() :
|
||||
|
|
@ -437,7 +437,7 @@ class firewall_komaz(firewall_crans) :
|
|||
|
||||
def reseaux_non_routables(self) :
|
||||
""" Construction de RESEAUX_NON_ROUTABLES_{DST,SRC} """
|
||||
self.anim = anim(' Filtrage ip non routables',len(self.liste_reseaux_non_routables))
|
||||
self.anim = anim('\tFiltrage ip non routables',len(self.liste_reseaux_non_routables))
|
||||
for reseau in self.liste_reseaux_non_routables :
|
||||
iptables("-t nat -A RESEAUX_NON_ROUTABLES_DST -d %s -j DROP" % reseau)
|
||||
iptables("-t nat -A RESEAUX_NON_ROUTABLES_SRC -s %s -j DROP" % reseau)
|
||||
|
|
@ -446,7 +446,7 @@ class firewall_komaz(firewall_crans) :
|
|||
print OK
|
||||
|
||||
def nat_table(self) :
|
||||
self.anim = anim(' Structure de la table nat')
|
||||
self.anim = anim('\tStructure de la table nat')
|
||||
for chaine in [ 'TEST_MAC-IP', 'RESEAUX_NON_ROUTABLES_SRC', 'RESEAUX_NON_ROUTABLES_DST', 'TEST_VIRUS_FLOOD', 'LOG_VIRUS', 'LOG_FLOOD' ] :
|
||||
iptables('-t nat -N %s' % chaine)
|
||||
|
||||
|
|
@ -476,7 +476,7 @@ class firewall_komaz(firewall_crans) :
|
|||
print OK
|
||||
|
||||
def filter_table_tweaks(self) :
|
||||
self.anim = anim(' règles spécifiques à komaz')
|
||||
self.anim = anim('\trègles spécifiques à komaz')
|
||||
for chaine in [ 'ADMIN_VLAN', 'EXT_VERS_SERVEURS', 'SERVEURS_VERS_EXT' , 'EXT_VERS_CRANS', 'CRANS_VERS_EXT', 'BLACKLIST_SRC', 'BLACKLIST_DST' , 'FILTRE_P2P' ] :
|
||||
iptables('-N %s' % chaine)
|
||||
iptables("-A FORWARD -i lo -j ACCEPT")
|
||||
|
|
@ -497,7 +497,7 @@ class firewall_komaz(firewall_crans) :
|
|||
print OK
|
||||
|
||||
def post_start_hook(self) :
|
||||
self.anim = anim(" Mise en place routage")
|
||||
self.anim = anim("\tMise en place routage")
|
||||
warn = ''
|
||||
for cmd in [ 'echo 1 > /proc/sys/net/ipv4/ip_forward' ,
|
||||
'echo 65536 > /proc/sys/net/ipv4/ip_conntrack_max' ,
|
||||
|
|
@ -514,7 +514,7 @@ class firewall_komaz(firewall_crans) :
|
|||
print OK
|
||||
|
||||
def pre_stop_hook(self) :
|
||||
self.anim = anim(" Arret routage")
|
||||
self.anim = anim("\tArret routage")
|
||||
status,output=getstatusoutput('echo 0 > /proc/sys/net/ipv4/ip_forward')
|
||||
if status :
|
||||
print ERREUR
|
||||
|
|
@ -544,7 +544,7 @@ class firewall_komaz(firewall_crans) :
|
|||
|
||||
def log_chaines(self) :
|
||||
""" Construction des chaines de log (LOG_VIRUS et LOG_FLOOD) """
|
||||
self.anim = anim(' Création des chaines de log')
|
||||
self.anim = anim('\tCréation des chaines de log')
|
||||
for filtre in [ 'VIRUS', 'FLOOD' ] :
|
||||
# Vidage de la chaîne
|
||||
iptables('-t nat -F LOG_%s' % filtre)
|
||||
|
|
@ -557,7 +557,7 @@ class firewall_komaz(firewall_crans) :
|
|||
def test_virus_flood(self) :
|
||||
""" Construction de la chaîne TEST_VIRUS """
|
||||
iptables('-t nat -F TEST_VIRUS_FLOOD')
|
||||
self.anim = anim(' Filtrage virus et floods')
|
||||
self.anim = anim('\tFiltrage virus et floods')
|
||||
|
||||
for proto, ports in self.ports_virus.items() :
|
||||
for port in ports :
|
||||
|
|
@ -599,7 +599,7 @@ class firewall_komaz(firewall_crans) :
|
|||
nounou_machines.append(machine.ip())
|
||||
|
||||
iptables("-A ADMIN_VLAN -j REJECT")
|
||||
self.anim = anim(' Chaîne ADMIN_VLAN', len(nounou_machines))
|
||||
self.anim = anim('\tChaîne ADMIN_VLAN', len(nounou_machines))
|
||||
for machine in nounou_machines :
|
||||
self.anim.cycle()
|
||||
iptables("-I ADMIN_VLAN -p tcp -s %s --dport ssh -j ACCEPT" % machine)
|
||||
|
|
@ -672,7 +672,7 @@ class firewall_komaz(firewall_crans) :
|
|||
|
||||
def blacklist(self):
|
||||
""" Construit les chaines de blackliste (BLACKLIST_{DST,SRC}) """
|
||||
self.anim = anim(" Blackliste")
|
||||
self.anim = anim("\tBlackliste")
|
||||
iptables('-F BLACKLIST_DST')
|
||||
iptables('-F BLACKLIST_SRC')
|
||||
|
||||
|
|
@ -701,7 +701,7 @@ class firewall_komaz(firewall_crans) :
|
|||
|
||||
def filtre_p2p(self):
|
||||
""" Construit la chaines de filtrage du p2p (FILTRE_P2P) """
|
||||
self.anim = anim(" Filtrage p2p")
|
||||
self.anim = anim("\tFiltrage p2p")
|
||||
iptables('-F FILTRE_P2P')
|
||||
|
||||
# On ne filtre que ce qui passe sur l'interface externe
|
||||
|
|
@ -743,7 +743,7 @@ class firewall_zamok(firewall_crans) :
|
|||
eth_adm = "eth0.2"
|
||||
|
||||
def serv_out_adm(self) :
|
||||
self.anim = anim(' Output vers VLAN adm', len(self.adm_users))
|
||||
self.anim = anim('\tOutput vers VLAN adm', len(self.adm_users))
|
||||
# Supression des éventuelles règles
|
||||
iptables("-t filter -F SERV_OUT_ADM")
|
||||
|
||||
|
|
@ -770,7 +770,7 @@ class firewall_zamok(firewall_crans) :
|
|||
print OK
|
||||
|
||||
def nat_table(self) :
|
||||
self.anim = anim(' Structure de la table nat')
|
||||
self.anim = anim('\tStructure de la table nat')
|
||||
iptables('-t nat -N TEST_MAC-IP')
|
||||
iptables('-t filter -N SERV_OUT_ADM')
|
||||
|
||||
|
|
@ -799,7 +799,7 @@ class firewall_zamok(firewall_crans) :
|
|||
self.serv_out_adm()
|
||||
|
||||
def filter_table_tweaks(self) :
|
||||
self.anim = anim(' regles specifiques a zamok')
|
||||
self.anim = anim('\tRegles specifiques a zamok')
|
||||
iptables("-P INPUT ACCEPT")
|
||||
iptables("-P FORWARD DROP")
|
||||
print OK
|
||||
|
|
@ -826,7 +826,7 @@ class firewall_rouge(firewall_crans) :
|
|||
eth_adm = "eth0.2"
|
||||
|
||||
def nat_table(self) :
|
||||
self.anim = anim(' Structure de la table nat')
|
||||
self.anim = anim('\tStructure de la table nat')
|
||||
iptables('-t nat -N TEST_MAC-IP')
|
||||
|
||||
iptables("-t nat -P PREROUTING ACCEPT")
|
||||
|
|
@ -842,7 +842,7 @@ class firewall_rouge(firewall_crans) :
|
|||
print OK
|
||||
|
||||
def filter_table_tweaks(self) :
|
||||
self.anim = anim(' regles specifiques a rouge')
|
||||
self.anim = anim('\tRegles specifiques a rouge')
|
||||
iptables("-P INPUT ACCEPT")
|
||||
iptables("-P FORWARD DROP")
|
||||
print OK
|
||||
|
|
@ -868,7 +868,7 @@ class firewall_vert(firewall_crans) :
|
|||
eth_pub = "eth0"
|
||||
|
||||
def nat_table(self) :
|
||||
self.anim = anim(' Structure de la table nat')
|
||||
self.anim = anim('\tStructure de la table nat')
|
||||
iptables('-t nat -N TEST_MAC-IP')
|
||||
|
||||
iptables("-t nat -P PREROUTING ACCEPT")
|
||||
|
|
@ -884,7 +884,7 @@ class firewall_vert(firewall_crans) :
|
|||
print OK
|
||||
|
||||
def filter_table_tweaks(self) :
|
||||
self.anim = anim(' regles specifiques a vert')
|
||||
self.anim = anim('\tRegles specifiques a vert')
|
||||
iptables("-P INPUT ACCEPT")
|
||||
iptables("-P FORWARD DROP")
|
||||
print OK
|
||||
|
|
|
|||
|
|
@ -306,17 +306,17 @@ if __name__ == '__main__':
|
|||
elif opt == '--reconnect':
|
||||
# Personnes à reconnecter
|
||||
print 'Recherche des personnes en fin de sanction...'
|
||||
hier = strftime('%d/%m/%Y %H:%M'.split()[0], localtime(time() - 60*60*24))
|
||||
c = db.search('blacklist=*,%s*' % hier)
|
||||
c = db.search('blacklist=*')
|
||||
services = []
|
||||
hier = time() - 24*3600
|
||||
for a_reco in c['adherent'] + c['machine'] + c['club']:
|
||||
for bl in a_reco.blacklist():
|
||||
fin, sanction = bl.split(',')[1:3]
|
||||
if fin.split()[0] == hier and sanction not in services:
|
||||
fin, sanction = bl.split('$')[1:3]
|
||||
if fin > hier and sanction not in services:
|
||||
services.append(sanction)
|
||||
for s in services:
|
||||
print "Ajout de blacklist_%s pour reconfiguration" % s
|
||||
db.services_to_restart('blacklist_%s' % s.encode())
|
||||
db.services_to_restart('blacklist_%s' % s)
|
||||
sys.exit(0)
|
||||
|
||||
elif opt == '--add':
|
||||
|
|
|
|||
|
|
@ -61,10 +61,14 @@ def generate_ps(sanction, proprio):
|
|||
template = template.replace('~mail~', proprio.email().encode('iso8859-15'))
|
||||
template = template.replace('~debut~', strftime(format_date, localtime()))
|
||||
template = template.replace('~fin~', strftime(format_date, localtime(time()+14*86400)))
|
||||
historique = [ bl.encode('iso-8859-15').split(',') for bl in proprio.blacklist() if bl.split(',')[2] == 'autodisc_upload' ] # filtrage des autodisc
|
||||
historique = [ (strftime('%A %d %B %Y', strptime(bl[0], '%d/%m/%Y %H:%M')), bl[-1].split(' ')[-2]) for bl in historique ] # transfomation en tupple (date, upload)
|
||||
historique = [ '%s & %s & Mo'%(bl[0], bl[1]) for bl in historique ] # tranformation en ligne
|
||||
historique = '\\\\\n'.join(historique) # assemblage des lignes
|
||||
# filtrage des autodisc
|
||||
historique = [ bl.encode('iso-8859-15').split('$') for bl in proprio.blacklist() if bl.split('$')[2] == 'autodisc_upload' ]
|
||||
# transfomation en tuple (date, upload)
|
||||
historique = [ (strftime('%A %d %B %Y', localtime(int(bl[0]))), bl[-1].split(' ')[-2]) for bl in historique ]
|
||||
# tranformation en ligne
|
||||
historique = [ '%s & %s & Mo'%(bl[0], bl[1]) for bl in historique ]
|
||||
# assemblage des lignes
|
||||
historique = r'\\\n'.join(historique)
|
||||
template = template.replace('~historique~', historique)
|
||||
template = template.replace('~limitehard~', str(upload.hard))
|
||||
template = template.replace('~nbadher~', str(len(ldap.search('paiement=ok')['adherent'])))
|
||||
|
|
@ -219,9 +223,9 @@ for elupload, eltype, elid in uploadeurs:
|
|||
|
||||
# On sanctionne
|
||||
###############
|
||||
debut = localtime(time())
|
||||
fin = localtime(time()+60*60*24)
|
||||
proprio.blacklist(["%.2d/%.2d/%.4d %.2d:%.2d" % (debut[2], debut[1], debut[0], debut[3], debut[4]), "%.2d/%.2d/%.4d %.2d:%.2d" % (fin[2], fin[1], fin[0], fin[3], fin[4]), 'autodisc_upload', "Déconn auto. %s Mo" % elupload])
|
||||
debut = int(time())
|
||||
fin = debut + 24*3600
|
||||
proprio.blacklist([debut, fin, 'autodisc_upload', "Déconn auto. %s Mo" % elupload])
|
||||
proprio.save()
|
||||
|
||||
# On envoie un mail à l'adhérent
|
||||
|
|
@ -239,7 +243,7 @@ for elupload, eltype, elid in uploadeurs:
|
|||
|
||||
# Vérification du nombre de déconnexions
|
||||
#########################################
|
||||
nb_decos = len([ x for x in proprio.blacklist() if mktime(strptime(x.split(',')[0], '%d/%m/%Y %H:%M')) > mktime(localtime())-30*24*60*60 and x.split(',')[2] == 'autodisc_upload' ])
|
||||
nb_decos = len([ x for x in proprio.blacklist() if int(x.split('$')[0]) > time()-30*24*3600 and x.split('$')[2] == 'autodisc_upload' ])
|
||||
if nb_decos >= 3:
|
||||
|
||||
# Génération du fichier postscript
|
||||
|
|
@ -329,7 +333,7 @@ for ip, nombre in infectes:
|
|||
index = [blacklist.index(x) for x in blacklist if 'virus' in x ]
|
||||
if index:
|
||||
# L'adhérent est déjà blacklisté
|
||||
proprio.blacklist(( index[0] , ['now', '-', 'virus', hostname] ))
|
||||
proprio.blacklist((index[0], ['now', '-', 'virus', hostname]))
|
||||
proprio.save()
|
||||
else:
|
||||
# L'adhérent n'est pas encore blacklisté
|
||||
|
|
@ -367,10 +371,10 @@ for ip, nombre in infectes:
|
|||
curseur.execute(requete)
|
||||
|
||||
# On récupère les index des lignes de bl où il y a marqué virus
|
||||
index = [blacklist.index(x) for x in blacklist if 'virus' in x ]
|
||||
index = [ blacklist.index(x) for x in blacklist if 'virus' in x ]
|
||||
if index:
|
||||
# L'adhérent est déjà blacklisté
|
||||
proprio.blacklist(( index[0] , ['now', '-', 'virus', hostname] ))
|
||||
proprio.blacklist((index[0], ['now', '-', 'virus', hostname]))
|
||||
proprio.save()
|
||||
else:
|
||||
# L'adhérent n'est pas encore blacklisté
|
||||
|
|
@ -410,8 +414,8 @@ for IP in infectes:
|
|||
# En prenant en compte le fait que d'autres lignes de blackliste
|
||||
# ont pu s'ajouter.
|
||||
for ligne in bl:
|
||||
if ',-,virus,%s'%hostname in ligne:
|
||||
liste = ligne.split(',')
|
||||
if '$-$virus$%s' % hostname in ligne:
|
||||
liste = ligne.split('$')
|
||||
argument = [liste[0], 'now', liste[2], liste[3]]
|
||||
index = bl.index(ligne)
|
||||
proprio.blacklist((index, argument))
|
||||
|
|
@ -480,7 +484,7 @@ for ip, id_p2p, nombre in fraudeurs:
|
|||
|
||||
# Vérification du nombre de déconnexions
|
||||
#########################################
|
||||
nb_decos = len([ x for x in proprio.blacklist() if mktime(strptime(x.split(',')[0], '%d/%m/%Y %H:%M')) > mktime(localtime())-365*24*60*60 and x.split(',')[2] == 'autodisc_p2p' ])
|
||||
nb_decos = len([ x for x in proprio.blacklist() if int(x.split('$')[0]) > time()-365*24*3600 and x.split('$')[2] == 'autodisc_p2p' ])
|
||||
if nb_decos >= 3:
|
||||
|
||||
fichier_ps = generate_ps('p2p', proprio)
|
||||
|
|
@ -494,6 +498,6 @@ for ip, id_p2p, nombre in fraudeurs:
|
|||
mail.sendmail(p2p.expediteur, p2p.expediteur, corps)
|
||||
|
||||
# L'adhérent n'est pas encore blacklisté
|
||||
fin = localtime(time()+60*60*24)
|
||||
proprio.blacklist(['now', "%.2d/%.2d/%.4d %.2d:%.2d" % (fin[2], fin[1], fin[0], fin[3], fin[4]), 'autodisc_p2p', hostname])
|
||||
fin = int(time()) + 24*3600
|
||||
proprio.blacklist(['now', fin, 'autodisc_p2p', hostname])
|
||||
proprio.save()
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue