crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[firewall6] on rajoute l'ingress filtering

Browse source 
Ignore-this: 70bb869f58f85e481e7a8329fcf80e06

darcs-hash:20110308203846-8fbb1-a2688cf00d420dc48de79c6cb5e22415d43e17f1.gz
This commit is contained in:
Olivier Huber 2011-03-08 21:38:46 +01:00
parent acef69c7da
commit 7a6a840c0f
2 changed files with 27 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

21
gestion/ipt.py
View file

@ -103,6 +103,7 @@ class Table(object):
self.blacklist_src = Chain()
self.blacklist_dst = Chain()
self.srv_out_adm = Chain()
self.ingress_filtering = Chain()
class Ip6tables(object):
''' Classe pour '''
@ -727,3 +728,23 @@ def macips(ipt, machines, types_machines):
type_mm = re.sub('-', '', type_m)
eval('ipt.filter.mac' + type_mm)('-j DROP')
return 0
def ingress_filtering(ipt):
''' Réalise un filtre sur les plages d'IP susceptibles d'être routées '''
ip_proto = ipt.version()
if ip_proto == 6:
dev_ext = iface6('sixxs2')
# d'abord sur l'interface sur le réseau Cr@ns, on ne route que les
# paquet dans le bon subnet.
ipt.filter.ingress_filtering('-o %s -s %s -j RETURN' % (dev_ext,
prefix['subnet'][0]))
ipt.filter.ingress_filtering('-o %s -j LOG --log-prefix "BAD ROUTE "' %
dev_ext)
ipt.filter.ingress_filtering('-o %s -j DROP' % dev_ext)
# de l'extérieur, on ne veut que des paquet ne provenant pas de notre
# réseau à destination de notre réseau
ipt.filter.ingress_filtering('-i %s ! -s %s -d %s -j RETURN' %
(dev_ext, prefix['subnet'][0], prefix['subnet'][0]))
ipt.filter.ingress_filtering('-i %s -j LOG --log-prefix "BAD SRC "' %
dev_ext)
ipt.filter.ingress_filtering('-i %s -j DROP' % dev_ext)