crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Le firewall peut grer un arbre plusieurs niveaux pour les classes

Browse source 
darcs-hash:20060425155200-72cb0-30e7c62610a5a911b8fa5080f32d99e8c9b0897f.gz
This commit is contained in:
salles 2006-04-25 17:52:00 +02:00
parent 3375c87a19
commit 4b56233ad7
1 changed files with 32 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

50
gestion/gen_confs/firewall.py
View file

@ -32,7 +32,7 @@ from ldap_crans import crans_ldap, ann_scol, hostname
from ldap_crans import AssociationCrans, Machine, MachineWifi
from affich_tools import *
from commands import getstatusoutput
from iptools import AddrInNet, subnets, IpSubnet
from iptools import AddrInNet, NetSubnets, IpSubnet
from config import NETs, mac_komaz, mac_wifi, conf_fw, p2p
syslog.openlog('firewall')
@ -76,6 +76,15 @@ def tc(cmd):
raise TcError(cmd,status,output)
return output
def redirect_chain(table, chain_in, chain_out, ip) :
try :
iptables("-t %s -N %s" % (table, chain_out))
except IptablesError :
iptables("-t %s -F %s" % (table, chain_out))
# On redirige les paquets de la chaîne in dans la chaîne out
iptables("-t %s -A %s -o ens -s %s -j %s" % (table, chain_in, ip, chain_out))
iptables("-t %s -A %s -o crans -d %s -j %s" % (table, chain_in, ip, chain_out))
class firewall_crans :
"""
@ -391,6 +400,7 @@ class firewall_crans :
iptables("-A %s -j REJECT" % chaine)
return self.exception_catcher(procedure)
"""
Komaz
"""
@ -482,25 +492,29 @@ class firewall_komaz(firewall_crans) :
def mangle_table(self) :
from affich_tools import anim, cprint, OK
self.anim = anim('\tStructure de la table mangle')
iptables("-t mangle -F POSTROUTING")
iptables("-t mangle -F PREROUTING")
# On vide complètement la table
iptables("-t mangle -F")
iptables("-t mangle -X")
# Proxy transparent
iptables("-t mangle -A PREROUTING -s %s -j RETURN" % self.zone_serveur)
iptables("-t mangle -A PREROUTING -p tcp --destination-port 80 " +
"-s %s -d \! %s -j MARK " % (NETs['fil'][0], NETs['wifi'][0]) +
"--set-mark %s" % conf_fw.mark['proxy'])
iptables("-t mangle -A PREROUTING -m mark --mark %s -j ACCEPT" % conf_fw.mark['proxy'])
# On crée les chaînes de sous-réseaux
# On crée les chaînes de sous-réseaux
for net in NETs['all'] :
for subnet in subnets(net, conf_fw.mask) :
try :
iptables("-t mangle -N SUBNET-%s" % subnet)
except IptablesError :
iptables("-t mangle -F SUBNET-%s" % subnet)
# On redirige les paquets dans la chaîne appropriée
iptables("-t mangle -A POSTROUTING -o ens -s %s -j SUBNET-%s" % (subnet, subnet))
iptables("-t mangle -A POSTROUTING -o crans -d %s -j SUBNET-%s" % (subnet, subnet))
for mask in conf_fw.mask :
for subnet in NetSubnets(net, mask) :
index = conf_fw.mask.index(mask)
if index == 0 :
prev_chain = "POSTROUTING"
else :
ip = subnet.split('/')[0]
prev_subnet = IpSubnet(ip, conf_fw.mask[index-1])
prev_chain = "SUBNET-%s" % prev_subnet
next_chain = "SUBNET-%s" % subnet
redirect_chain('mangle', prev_chain, next_chain, subnet)
print OK
# On marque les paquets bittorrent uniquement
@ -543,7 +557,7 @@ class firewall_komaz(firewall_crans) :
# Classification des adhérents dans leur classe respective
for machine in adherent.machines() :
ip = machine.ip()
subnet = IpSubnet(machine.ip(), conf_fw.mask)
subnet = IpSubnet(machine.ip(), conf_fw.mask[len(conf_fw.mask)-1])
iptables("-t mangle -A SUBNET-%s -o crans -d %s -m mark " % (subnet, ip) +
"--mark %s -j CLASSIFY --set-class 1:%s" % (conf_fw.mark['bittorrent'], class_id))
iptables("-t mangle -A SUBNET-%s -o ens -s %s -m mark " % (subnet, ip) +
@ -626,7 +640,7 @@ class firewall_komaz(firewall_crans) :
if not recherche :
# Il faut supprimer cette entrée
option = '-D'
subnet = IpSubnet(ip.split, conf_fw.mask)
subnet = IpSubnet(ip.split, conf_fw.mask[len(conf_fw.mask)-1])
regles = iptables("-t mangle -L SUBNET-%s -n | grep %s" % (subnet, ip)).split('\n')
# On sélectionne la première qui doit contenir ce que l'on veut
regle = regles[0].split()
@ -638,13 +652,13 @@ class firewall_komaz(firewall_crans) :
machine = recherche[0]
adherent = machine.proprietaire()
ip = machine.ip()
subnet = IpSubnet(ip, conf_fw.mask)
subnet = IpSubnet(ip, conf_fw.mask[len(conf_fw.mask)-1])
class_id = int(adherent.id())+1 # On ne peut pas reprendre le numéro 1
else :
warn += "Plusieurs machines avec l'IP %s\n" % ip
iptables("-t mangle %s SUBNET-%s -o ens -s %s -m mark " % (option, subnet, ip) +
"--mark %s -j CLASSIFY --set-class 1:%s" % (conf_fw.mark['bittorrent'], class_id))
iptables("-t mangle %s SUBNET-%s -o crans -d %s -m mark " % (option, subnet, ip) +
"--mark %s -j CLASSIFY --set-class 1:%s" % (conf_fw.mark['bittorrent'], class_id))
iptables("-t mangle %s SUBNET-%s -o ens -s %s -m mark " % (option, subnet, ip) +
"--mark %s -j CLASSIFY --set-class 1:%s" % (conf_fw.mark['bittorrent'], class_id))
except IptablesError, c:
warn += str(c) + '\n'