crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Ajout des fonctionnalits de log.

Browse source 
darcs-hash:20041107122008-1d643-119d7e4f35204ba480cb89e5f138524c26967847.gz
This commit is contained in:
sabban 2004-11-07 13:20:08 +01:00
parent a2ed774515
commit 5f91dc3a0b
1 changed files with 82 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

144
gestion/classe_firewall.py
View file

@ -15,6 +15,7 @@
# MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR # MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
# PURPOSE. # PURPOSE.
""" classe Firewall de Komaz """ """ classe Firewall de Komaz """
import commands,time
import sys,os import sys,os
import iptools,config,fileinput import iptools,config,fileinput
from ldap_crans import * from ldap_crans import *
@ -44,11 +45,16 @@ class ErrorMoreThanOneIp(ErrorIp):
""" """
pass pass
class ErrorIptables(Exception): class ErrorIptables(Exception):
pass
""" """
User defined exception User defined exception
Les erreurs d'iptables Les erreurs d'iptables
""" """
def __init__(self,cmd,err_code,output):
self.cmd=cmd
self.err_code=err_code
self.output=output
openlog(ident='syslog',logopt=0,facility=' LOG_USER')
syslog('LOG_ALERT',cmd,err,output)
class ErrorNoSuchIp(ErrorIp): class ErrorNoSuchIp(ErrorIp):
""" """
@ -58,6 +64,18 @@ class ErrorNoSuchIp(ErrorIp):
pass pass
class firewall: class firewall:
def __init__(self):
self.file_log=open("/var/log/fw.log","a")
def __init__(self):
self.file_log.close()
def iptables(self,cmd):
status,output=getstatusoutput(cmd)
if status:
raise IptablesError(cmd,status,output)
self.file_log.write(cmd)
def start(self): def start(self):
""" """
Construit le firewall Construit le firewall
@ -76,9 +94,9 @@ class firewall:
Pas d'arguments Pas d'arguments
""" """
print "Arrêt du firewall" print "Arrêt du firewall"
os.system("iptables -F") iptables("iptables -F")
os.system("iptables -t nat -F") iptables("iptables -t nat -F")
os.system("iptables -X") iptables("iptables -X")
def create_defaults(self): def create_defaults(self):
""" """
@ -87,11 +105,11 @@ class firewall:
""" """
for proto in ["tcp","udp"]: for proto in ["tcp","udp"]:
for i in range(len(config.port_default["%s_input" % proto])): for i in range(len(config.port_default["%s_input" % proto])):
os.system("iptables -A DEFAULT_INPUT -p %s --dport "%proto+\ iptables("iptables -A DEFAULT_INPUT -p %s --dport "%proto+\
config.port_default["%s_input" % proto][i]+\ config.port_default["%s_input" % proto][i]+\
" -j ACCEPT") " -j ACCEPT")
for i in range(len(config.port_default["%s_output" % proto])): for i in range(len(config.port_default["%s_output" % proto])):
os.system("iptables -A DEFAULT_OUTPUT -p %s --sport "%proto+\ iptables("iptables -A DEFAULT_OUTPUT -p %s --sport "%proto+\
config.port_default["%s_output" % proto][i]+\ config.port_default["%s_output" % proto][i]+\
" -j ACCEPT") " -j ACCEPT")
@ -118,7 +136,7 @@ class firewall:
count=0 count=0
if ip in line: if ip in line:
count=count-1 count=count-1
test("iptables -D %s %i"%(chaine,count)) iptables("iptables -D %s %i"%(chaine,count))
os.system("rm -f /tmp/firewall") os.system("rm -f /tmp/firewall")
try: try:
os.system("iptables -t nat -L -n > /tmp/firewall") os.system("iptables -t nat -L -n > /tmp/firewall")
@ -135,14 +153,14 @@ class firewall:
count=0 count=0
if ip in line: if ip in line:
count=count-1 count=count-1
test("iptables -t nat -D %s %i"%(chaine,count)) iptables("iptables -t nat -D %s %i"%(chaine,count))
os.system("rm -f /tmp/firewall") os.system("rm -f /tmp/firewall")
def paire_macip(self,ip,mac): def paire_macip(self,ip,mac):
""" """
Crée le filtrage pour une paire mac-ip Crée le filtrage pour une paire mac-ip
""" """
os.system("iptables -t nat -A PREROUTING -s %s -m mac --mac-source %s -j ACCEPT"\ iptables("iptables -t nat -A PREROUTING -s %s -m mac --mac-source %s -j ACCEPT"\
%(ip,mac)) %(ip,mac))
def filtrage_mac(self): def filtrage_mac(self):
@ -166,34 +184,34 @@ class firewall:
barre.reinit() barre.reinit()
print OK print OK
os.system("iptables -t nat -A PREROUTING -i %s -s \\!"%int_crans+\ iptables("iptables -t nat -A PREROUTING -i %s -s \\!"%int_crans+\
" 138.231.136.0/21 -j ACCEPT") " 138.231.136.0/21 -j ACCEPT")
os.system("iptables -t nat -A PREROUTING -i %s -s \\!"%int_crans+\ iptables("iptables -t nat -A PREROUTING -i %s -s \\!"%int_crans+\
" 138.231.148.0/22 -j ACCEPT") " 138.231.148.0/22 -j ACCEPT")
for i in reseaux_non_routables: for i in reseaux_non_routables:
os.system("iptables -t nat -A PREROUTING -i %s -s %s"%(int_crans,i)+\ iptables("iptables -t nat -A PREROUTING -i %s -s %s"%(int_crans,i)+\
" -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\ " -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\
" -j LOG --log-level %s --log-prefix %s"%\ " -j LOG --log-level %s --log-prefix %s"%\
(loglevel,logprefix_macip)) (loglevel,logprefix_macip))
os.system("iptables -t nat -A PREROUTING -i %s -s %s -j DROP"%\ iptables("iptables -t nat -A PREROUTING -i %s -s %s -j DROP"%\
(int_crans,i)) (int_crans,i))
os.system("iptables -t nat -A PREROUTING -i %s -d %s"%(int_crans,i)+\ iptables("iptables -t nat -A PREROUTING -i %s -d %s"%(int_crans,i)+\
" -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\ " -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\
" -j LOG --log-level %s --log-prefix %s"%\ " -j LOG --log-level %s --log-prefix %s"%\
(loglevel,logprefix_macip)) (loglevel,logprefix_macip))
os.system("iptables -t nat -A PREROUTING -i %s -d %s -j DROP"%\ iptables("iptables -t nat -A PREROUTING -i %s -d %s -j DROP"%\
(int_crans,i)) (int_crans,i))
os.system("iptables -t nat -A PREROUTING -i %s -p tcp "%int_crans+\ iptables("iptables -t nat -A PREROUTING -i %s -p tcp "%int_crans+\
" -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\ " -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\
" -j LOG --log-level %s --log-prefix %s"%\ " -j LOG --log-level %s --log-prefix %s"%\
(loglevel,logprefix_macip)) (loglevel,logprefix_macip))
os.system("iptables -t nat -A PREROUTING -i %s -p tcp"%int_crans+\ iptables("iptables -t nat -A PREROUTING -i %s -p tcp"%int_crans+\
" -j DROP") " -j DROP")
os.system("iptables -t nat -A PREROUTING -i %s -p udp"%int_crans+\ iptables("iptables -t nat -A PREROUTING -i %s -p udp"%int_crans+\
" -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\ " -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\
" -j LOG --log-level %s --log-prefix %s"%\ " -j LOG --log-level %s --log-prefix %s"%\
(loglevel,logprefix_macip)) (loglevel,logprefix_macip))
os.system("iptables -t nat -A PREROUTING -i %s -p udp"%int_crans+\ iptables("iptables -t nat -A PREROUTING -i %s -p udp"%int_crans+\
" -j DROP") " -j DROP")
def komaz(self): def komaz(self):
@ -202,19 +220,19 @@ class firewall:
""" """
ports=komaz_ports['portTCPin'] ports=komaz_ports['portTCPin']
for i in ports.split(' '): for i in ports.split(' '):
os.system("iptables -A INPUT -d 138.231.136.4 -p tcp --dport %s"%i+\ iptables("iptables -A INPUT -d 138.231.136.4 -p tcp --dport %s"%i+\
" -j ACCEPT") " -j ACCEPT")
ports=komaz_ports['portTCPout'] ports=komaz_ports['portTCPout']
for i in ports.split(' '): for i in ports.split(' '):
os.system("iptables -A OUTPUT -s 138.231.136.4 -p tcp --dport %s"%i+\ iptables("iptables -A OUTPUT -s 138.231.136.4 -p tcp --dport %s"%i+\
" -j ACCEPT") " -j ACCEPT")
ports=komaz_ports['portUDPin'] ports=komaz_ports['portUDPin']
for i in ports.split(' '): for i in ports.split(' '):
os.system("iptables -A INPUT -d 138.231.136.4 -p udp --dport %s"%i+\ iptables("iptables -A INPUT -d 138.231.136.4 -p udp --dport %s"%i+\
" -j ACCEPT") " -j ACCEPT")
ports=komaz_ports['portUDPout'] ports=komaz_ports['portUDPout']
for i in ports.split(' '): for i in ports.split(' '):
os.system("iptables -A OUTPUT -s 138.231.136.4 -p udp --dport %s"%i+\ iptables("iptables -A OUTPUT -s 138.231.136.4 -p udp --dport %s"%i+\
" -j ACCEPT") " -j ACCEPT")
def serveurs(self): def serveurs(self):
@ -228,22 +246,22 @@ class firewall:
for serveur in serveurs_list: for serveur in serveurs_list:
ports=serveurs_ports[serveur]['portTCPin'] ports=serveurs_ports[serveur]['portTCPin']
for i in ports.split(' '): for i in ports.split(' '):
os.system("iptables -A FORWARD -d %s"%\ iptables("iptables -A FORWARD -d %s"%\
eval(fonction_utile(serveur))['ip']+\ eval(fonction_utile(serveur))['ip']+\
" -p tcp --dport %s -j ACCEPT"%i) " -p tcp --dport %s -j ACCEPT"%i)
ports=serveurs_ports[serveur]['portTCPout'] ports=serveurs_ports[serveur]['portTCPout']
for i in ports.split(' '): for i in ports.split(' '):
os.system("iptables -A FORWARD -s %s"%\ iptables("iptables -A FORWARD -s %s"%\
eval(fonction_utile(serveur))['ip']+\ eval(fonction_utile(serveur))['ip']+\
" -p tcp --dport %s -j ACCEPT"%i) " -p tcp --dport %s -j ACCEPT"%i)
ports=serveurs_ports[serveur]['portUDPin'] ports=serveurs_ports[serveur]['portUDPin']
for i in ports.split(' '): for i in ports.split(' '):
os.system("iptables -A FORWARD -d %s"%\ iptables("iptables -A FORWARD -d %s"%\
eval(fonction_utile(serveur))['ip']+\ eval(fonction_utile(serveur))['ip']+\
" -p udp --dport %s -j ACCEPT"%i) " -p udp --dport %s -j ACCEPT"%i)
ports=serveurs_ports[serveur]['portUDPout'] ports=serveurs_ports[serveur]['portUDPout']
for i in ports.split(' '): for i in ports.split(' '):
os.system("iptables -A FORWARD -s %s"%\ iptables("iptables -A FORWARD -s %s"%\
eval(fonction_utile(serveur))['ip']+\ eval(fonction_utile(serveur))['ip']+\
" -p udp --dport %s -j ACCEPT"%i) " -p udp --dport %s -j ACCEPT"%i)
for serveur in serveurs_list: for serveur in serveurs_list:
@ -254,8 +272,8 @@ class firewall:
""" """
Bloque les adhérents blacklistés Bloque les adhérents blacklistés
""" """
os.system("iptables -N DEFAULT_INPUT") iptables("iptables -N DEFAULT_INPUT")
os.system("iptables -N DEFAULT_OUTPUT") iptables("iptables -N DEFAULT_OUTPUT")
db=crans_ldap() db=crans_ldap()
blacklist=[] blacklist=[]
@ -268,90 +286,90 @@ class firewall:
else: else:
blacklist+=entite.machines() blacklist+=entite.machines()
for instance_machine in blacklist: for instance_machine in blacklist:
os.system("iptables -A BLACKLIST_INPUT -d %s"%\ iptables("iptables -A BLACKLIST_INPUT -d %s"%\
instance_machine.ip().encode("iso-8859-15")+\ instance_machine.ip().encode("iso-8859-15")+\
"-m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\ "-m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\
" -j LOG --log-level %s --log-prefix_macip %s"%\ " -j LOG --log-level %s --log-prefix_macip %s"%\
(loglevel,logprefix_blacklist)) (loglevel,logprefix_blacklist))
os.system("iptables -A BLACKLIST_INPUT -d %s -j REJECT"%\ iptables("iptables -A BLACKLIST_INPUT -d %s -j REJECT"%\
instance_machine.ip()) instance_machine.ip())
os.system("iptables -A BLACKLIST_OUTPUT -s %s"%\ iptables("iptables -A BLACKLIST_OUTPUT -s %s"%\
instance_machine.ip().encode("iso-8859-15")+\ instance_machine.ip().encode("iso-8859-15")+\
"-m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\ "-m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\
" -j LOG --log-level %s --log-prefix_macip %s"%\ " -j LOG --log-level %s --log-prefix_macip %s"%\
(loglevel,logprefix_blacklist)) (loglevel,logprefix_blacklist))
os.system("iptables -A BLACKLIST_OUTPUT -s %s -j REJECT"%\ iptables("iptables -A BLACKLIST_OUTPUT -s %s -j REJECT"%\
instance_machine.ip()) instance_machine.ip())
os.system("iptables -A BLACKLIST_INPUT -j DEFAULT_INPUT") iptables("iptables -A BLACKLIST_INPUT -j DEFAULT_INPUT")
os.system("iptables -A BLACKLIST_OUTPUT -j DEFAULT_OUTPUT") iptables("iptables -A BLACKLIST_OUTPUT -j DEFAULT_OUTPUT")
def create_forward(self): def create_forward(self):
""" """
Différencie ce qui arrive et ce qui part dans la chaîne FORWARD Différencie ce qui arrive et ce qui part dans la chaîne FORWARD
""" """
os.system("iptables -N BLACKLIST_INPUT") iptables("iptables -N BLACKLIST_INPUT")
os.system("iptables -N BLACKLIST_OUTPUT") iptables("iptables -N BLACKLIST_OUTPUT")
os.system("iptables -A FORWARD -s 138.231.136.0/21 -j BLACKLIST_OUTPUT") iptables("iptables -A FORWARD -s 138.231.136.0/21 -j BLACKLIST_OUTPUT")
os.system("iptables -A FORWARD -s 138.231.136.0/22 -j BLACKLIST_OUTPUT") iptables("iptables -A FORWARD -s 138.231.136.0/22 -j BLACKLIST_OUTPUT")
os.system("iptables -A FORWARD -d 138.231.148.0/21 -j BLACKLIST_INPUT") iptables("iptables -A FORWARD -d 138.231.148.0/21 -j BLACKLIST_INPUT")
os.system("iptables -A FORWARD -d 138.231.148.0/22 -j BLACKLIST_INPUT") iptables("iptables -A FORWARD -d 138.231.148.0/22 -j BLACKLIST_INPUT")
def create_adherents(self): def create_adherents(self):
""" """
Crée toutes les règles relatives aux adhérents ayant des règles Crée toutes les règles relatives aux adhérents ayant des règles
spéciales spéciales
""" """
os.system("iptables -N ADHERENTS_OUTPUT") iptables("iptables -N ADHERENTS_OUTPUT")
os.system("iptables -N ADHERENTS_INPUT") iptables("iptables -N ADHERENTS_INPUT")
os.system("iptables -A ADHERENTS_INPUT -m state --state "+\ iptables("iptables -A ADHERENTS_INPUT -m state --state "+\
"RELATED -j ACCEPT") "RELATED -j ACCEPT")
os.system("iptables -A ADHERENTS_OUTPUT -m state --state "+\ iptables("iptables -A ADHERENTS_OUTPUT -m state --state "+\
"RELATED -j ACCEPT") "RELATED -j ACCEPT")
os.system("iptables -A ADHERENTS_INPUT -m state --state "+\ iptables("iptables -A ADHERENTS_INPUT -m state --state "+\
"ESTABLISHED -m limit --limit-burst "+\ "ESTABLISHED -m limit --limit-burst "+\
"%s -j ACCEPT"%limite_connexion) "%s -j ACCEPT"%limite_connexion)
os.system("iptables -A ADHERENTS_OUTPUT -m state --state "+\ iptables("iptables -A ADHERENTS_OUTPUT -m state --state "+\
"ESTABLISHED -m limit --limit-burst "+\ "ESTABLISHED -m limit --limit-burst "+\
"%s -j ACCEPT"%limite_connexion) "%s -j ACCEPT"%limite_connexion)
os.system("iptables -A DEFAULT_INPUT -j ADHERENTS_INPUT") iptables("iptables -A DEFAULT_INPUT -j ADHERENTS_INPUT")
os.system("iptables -A DEFAULT_OUTPUT -j ADHERENTS_OUTPUT") iptables("iptables -A DEFAULT_OUTPUT -j ADHERENTS_OUTPUT")
db=crans_ldap() db=crans_ldap()
search=db.search('host=*.crans.org & portTCPin=*')['machine'] search=db.search('host=*.crans.org & portTCPin=*')['machine']
for champ in search: for champ in search:
ports=champ.portTCPin() ports=champ.portTCPin()
for j in ports.split(' '): for j in ports.split(' '):
os.system("iptables -A ADHERENTS_INPUT -d %s"%champ.ip()+\ iptables("iptables -A ADHERENTS_INPUT -d %s"%champ.ip()+\
" -p tcp --dport %s -j ACCEPT"%j) " -p tcp --dport %s -j ACCEPT"%j)
search=db.search('host=*.crans.org & portTCPout=*')['machine'] search=db.search('host=*.crans.org & portTCPout=*')['machine']
for champ in search: for champ in search:
ports=champ.portTCPout() ports=champ.portTCPout()
for j in ports.split(' '): for j in ports.split(' '):
os.system("iptables -A ADHERENTS_OUTPUT -d %s"%champ.ip()+\ iptables("iptables -A ADHERENTS_OUTPUT -d %s"%champ.ip()+\
" -p tcp --dport %s -j ACCEPT"%j) " -p tcp --dport %s -j ACCEPT"%j)
search=db.search('host=*.crans.org & portUDPin=*')['machine'] search=db.search('host=*.crans.org & portUDPin=*')['machine']
for champ in search: for champ in search:
ports=champ.portUDPin() ports=champ.portUDPin()
for j in ports.split(' '): for j in ports.split(' '):
os.system("iptables -A ADHERENTS_INPUT -d %s"%champ.ip()+\ iptables("iptables -A ADHERENTS_INPUT -d %s"%champ.ip()+\
" -p udp --dport %s -j ACCEPT"%j) " -p udp --dport %s -j ACCEPT"%j)
search=db.search('host=*.crans.org & portUDPin=*')['machine'] search=db.search('host=*.crans.org & portUDPin=*')['machine']
for champ in search: for champ in search:
ports=champ.portUDPout() ports=champ.portUDPout()
for j in ports.split(' '): for j in ports.split(' '):
os.system("iptables -A ADHERENTS_OUTPUT -d %s"%champ.ip()+\ iptables("iptables -A ADHERENTS_OUTPUT -d %s"%champ.ip()+\
" -p udp --dport %s -j ACCEPT"%j) " -p udp --dport %s -j ACCEPT"%j)
os.system("iptables -A ADHERENTS_INPUT"+\ iptables("iptables -A ADHERENTS_INPUT"+\
" -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\ " -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\
" -j LOG --log-level %s --log-prefix %s"%\ " -j LOG --log-level %s --log-prefix %s"%\
(loglevel,logprefix_adherents)) (loglevel,logprefix_adherents))
os.system("iptables -A ADHERENTS_INPUT -j REJECT") iptables("iptables -A ADHERENTS_INPUT -j REJECT")
os.system("iptables -A ADHERENTS_OUTPUT"+\ iptables("iptables -A ADHERENTS_OUTPUT"+\
" -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\ " -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\
" -j LOG --log-level %s --log-prefix %s"%\ " -j LOG --log-level %s --log-prefix %s"%\
(loglevel,logprefix_adherents)) (loglevel,logprefix_adherents))
os.system("iptables -A ADHERENTS_OUTPUT -j REJECT") iptables("iptables -A ADHERENTS_OUTPUT -j REJECT")
def adherent(self,ip): def adherent(self,ip):
""" """
@ -368,31 +386,31 @@ class firewall:
wifi=False wifi=False
while (i<len(config.NETs['wifi'])): while (i<len(config.NETs['wifi'])):
if (iptools.AddrInNet(ip,config.NETs['all'][i])): if (iptools.AddrInNet(ip,config.NETs['all'][i])):
test("iptables -t nat -I PREROUTING -s %s -m mac --mac-source "%ip+\ iptables("iptables -t nat -I PREROUTING -s %s -m mac --mac-source "%ip+\
"%s -j ACCEPT"%config.mac_wifi) "%s -j ACCEPT"%config.mac_wifi)
wifi=True wifi=True
i=i+1 i=i+1
if (not wifi): if (not wifi):
test("iptables -t nat -I PREROUTING -s %s -m mac --mac-source %s -j ACCEPT"%\ iptables("iptables -t nat -I PREROUTING -s %s -m mac --mac-source %s -j ACCEPT"%\
(ip,search[0].mac())) (ip,search[0].mac()))
if search[0].portTCPin()!='': if search[0].portTCPin()!='':
ports=search[0].portTCPin() ports=search[0].portTCPin()
for j in ports.split(' '): for j in ports.split(' '):
test("iptables -I ADHERENTS_INPUT -d %s"%ip+\ iptables("iptables -I ADHERENTS_INPUT -d %s"%ip+\
" -p tcp --dport %s -j ACCEPT"%j) " -p tcp --dport %s -j ACCEPT"%j)
if search[0].portTCPout()!='': if search[0].portTCPout()!='':
ports=search[0].portTCPout() ports=search[0].portTCPout()
for j in ports.split(' '): for j in ports.split(' '):
test("iptables -I ADHERENTS_OUTPUT -d %s"%ip+\ iptables("iptables -I ADHERENTS_OUTPUT -d %s"%ip+\
" -p tcp --dport %s -j ACCEPT"%j) " -p tcp --dport %s -j ACCEPT"%j)
if search[0].portUDPin()!='': if search[0].portUDPin()!='':
ports=search[0].portUDPin() ports=search[0].portUDPin()
for j in ports.split(' '): for j in ports.split(' '):
test("iptables -I ADHERENTS_INPUT -d %s"%ip+\ iptables("iptables -I ADHERENTS_INPUT -d %s"%ip+\
" -p udp --dport %s -j ACCEPT"%j) " -p udp --dport %s -j ACCEPT"%j)
if search[0].portUDPout()!='': if search[0].portUDPout()!='':
ports=search[0].portUDPout() ports=search[0].portUDPout()
for j in ports.split(' '): for j in ports.split(' '):
test("iptables -I ADHERENTS_OUTPUT -d %s"%ip+\ iptables("iptables -I ADHERENTS_OUTPUT -d %s"%ip+\
" -p udp --dport %s -j ACCEPT"%j) " -p udp --dport %s -j ACCEPT"%j)