crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

On place les rgles iptables par dfaut du p2p ds le dbut pour pas rester

Browse source 
trop longtemps sans ce comportement par dfaut.
On prcise davantage les rgles par dfaut en indiquant la source ou la
destination selon le cas

darcs-hash:20060425211700-72cb0-7fd0a85a105376121bfb50a607d0df5051902306.gz
This commit is contained in:
salles 2006-04-25 23:17:00 +02:00
parent 851d39384e
commit 7101842139
1 changed files with 8 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

14
gestion/gen_confs/firewall.py
View file

@ -4,12 +4,14 @@
# Manuel Sabban <manu@feyd-rautha.org> # Manuel Sabban <manu@feyd-rautha.org>
# Frédéric Pauget <pauget@crans.ens-cachan.fr> # Frédéric Pauget <pauget@crans.ens-cachan.fr>
# Mathieu Segaud <matt@minas-morgul.org> # Mathieu Segaud <matt@minas-morgul.org>
# Nicolas Salles <salles@crans.org>
# #
# Rewritten as inherited classes from firewall_crans # Rewritten as inherited classes from firewall_crans
# by Mathieu Segaud <matt@minas-morgul.org> # by Mathieu Segaud <matt@minas-morgul.org>
# #
# Copyright (c) 2004 Manuel Sabban, Frédéric Pauget # Copyright (c) 2004 Manuel Sabban, Frédéric Pauget
# Copyright (c) 2005 Mathieu Segaud # Copyright (c) 2005 Mathieu Segaud
# Copyright (c) 2006 Nicolas Salles
# #
# Permission to use, copy, and modify this software with or without fee # Permission to use, copy, and modify this software with or without fee
# is hereby granted, provided that this entire notice is included in # is hereby granted, provided that this entire notice is included in
@ -71,7 +73,6 @@ def tc(cmd):
""" Interface de tc """ """ Interface de tc """
syslog.syslog(syslog.LOG_INFO,cmd) syslog.syslog(syslog.LOG_INFO,cmd)
status,output=getstatusoutput("/sbin/tc "+cmd) status,output=getstatusoutput("/sbin/tc "+cmd)
#print cmd
if status: if status:
raise TcError(cmd,status,output) raise TcError(cmd,status,output)
return output return output
@ -544,6 +545,12 @@ class firewall_komaz(firewall_crans) :
tc("class add dev %s parent 1: classid 1:1 htb rate %s ceil %s" % (interface, p2p.debit_max, p2p.debit_max)) tc("class add dev %s parent 1: classid 1:1 htb rate %s ceil %s" % (interface, p2p.debit_max, p2p.debit_max))
tc("class add dev %s parent 1:1 classid 1:9998 htb rate %s ceil %s" % (interface, debit_adh, p2p.debit_max)) tc("class add dev %s parent 1:1 classid 1:9998 htb rate %s ceil %s" % (interface, debit_adh, p2p.debit_max))
tc("qdisc add dev %s parent 1:9998 handle 9999: sfq perturb 10" % interface) tc("qdisc add dev %s parent 1:9998 handle 9999: sfq perturb 10" % interface)
# Par défaut on envoit les paquets dans la classe 9998
for net in NETs['all'] :
iptables("-t mangle -A POSTROUTING -o crans -d %s -m mark " % net +
"--mark %s -j CLASSIFY --set-class 1:9998" % conf_fw.mark['bittorrent'])
iptables("-t mangle -A POSTROUTING -o ens -s %s -m mark " % net +
"--mark %s -j CLASSIFY --set-class 1:9998" % conf_fw.mark['bittorrent'])
# On construit ensuite les classes et qdisc pour chaque adhérent # On construit ensuite les classes et qdisc pour chaque adhérent
for adherent in adherents : for adherent in adherents :
self.anim.cycle() self.anim.cycle()
@ -561,11 +568,6 @@ class firewall_komaz(firewall_crans) :
"--mark %s -j CLASSIFY --set-class 1:%s" % (conf_fw.mark['bittorrent'], class_id)) "--mark %s -j CLASSIFY --set-class 1:%s" % (conf_fw.mark['bittorrent'], class_id))
iptables("-t mangle -A SUBNET-%s -o ens -s %s -m mark " % (subnet, ip) + iptables("-t mangle -A SUBNET-%s -o ens -s %s -m mark " % (subnet, ip) +
"--mark %s -j CLASSIFY --set-class 1:%s" % (conf_fw.mark['bittorrent'], class_id)) "--mark %s -j CLASSIFY --set-class 1:%s" % (conf_fw.mark['bittorrent'], class_id))
# Par défaut on envoit les paquets dans la classe 9998
iptables("-t mangle -A POSTROUTING -o crans -m mark " +
"--mark %s -j CLASSIFY --set-class 1:9998" % conf_fw.mark['bittorrent'])
iptables("-t mangle -A POSTROUTING -o ens -m mark " +
"--mark %s -j CLASSIFY --set-class 1:9998" % conf_fw.mark['bittorrent'])
self.anim.reinit() self.anim.reinit()
print OK print OK