crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[global/rid] J'ai essayé de mettre en place une bijection realm <-> NETs <-> rid

Browse source 
* Les rid sont maintenant des listes de tuples.
 * Il faut utiliser crans_utils.find_rid_plage, et crans_utils.find_ipv4_plage
 qui renvoient le realm d'un rid/d'une ipv4, et la plage associée (un tuple ou
 un slash ipv4).
 * Pour les anciens scripts, j'ai mis find_rid_plage dans ridtools, il faut l'utiliser
 également à la place des boucles for tp, (begin, end) in config.rid.iteritems()...
 * J'ai essayé de faire attention à tout ce que ça aurait pu casser, mais ce n'est
 pas garanti
This commit is contained in:
Pierre-Elliott Bécue 2013-05-30 01:11:36 +02:00
parent e2a4cfe72a
commit a442fd6b22
7 changed files with 108 additions and 71 deletions
Download patch file Download diff file Expand all files Collapse all files

31
gestion/ipt.py
View file

@ -24,10 +24,10 @@ import os, re, syslog, cPickle, socket
from ldap_crans import crans_ldap, hostname
from commands import getstatusoutput
from config import NETs, role, prefix, rid, output_file, filter_policy
from config import NETs, role, prefix, rid, output_file, filter_policy, rid_primaires
from config import blacklist_sanctions, blacklist_sanctions_soft, blacklist_bridage_upload, file_pickle, ann_scol, periode_transitoire
from iptools import AddrInNet
from ridtools import Rid
from ridtools import Rid, find_rid_plage
import subprocess
import netaddr
@ -57,7 +57,8 @@ Filter_policy_template = """
"""
dprefix = { 'adherents': 'adherents', 'fil' : 'fil', 'fil-v6' : 'fil', 'adm' : 'adm', 'wifi' : 'wifi',
'wifi-v6' : 'wifi','personnel-ens':'personnel-ens', 'serveurs':'serveurs' }
'wifi-v6' : 'wifi','personnel-ens':'personnel-ens', 'serveurs':'serveurs', 'wifi-adh':'wifi',
'bornes' : 'wifi', 'adm-v6':'adm', 'serveurs-v6':'serveurs'}
default_chains = [ 'PREROUTING', 'INPUT', 'FORWARD', 'OUTPUT', 'POSTROUTING' ]
@ -163,11 +164,12 @@ ACCEPT' % (dev, proto, ip, port))
vers et à partir de la machine considérée '''
ident = int(machine.id())
ip = ""
for type_m in rid.keys():
if ident in range(rid[type_m][0], rid[type_m][1]):
ip = ipv6_addr(machine.mac(), type_m)
mac=machine.mac()
break
for type_m, plages in rid_primaires.iteritems():
for plage in plages:
if ident in range(plage[0], plage[1]):
ip = ipv6_addr(machine.mac(), type_m)
mac=machine.mac()
break
if ip:
self.filter.blacklist_src('-m mac --mac-source %s -j REJECT --reject-with icmp6-port-unreachable' % mac)
@ -194,10 +196,8 @@ class Update(object):
dev_ext = iface6('sixxs2')
net = ""
for r in rids:
for type_m in rid.keys():
if int(r) in range(rid[type_m][0], rid[type_m][1]):
net = type_m
if net == "":
net, _ = find_rid_plage(r)
if net == "Inconnu":
raise RidError("Il n'y a pas de réseau associé au rid %i" % m)
if '-v6' in net and ip_proto == 4:
raise MismatchRidIpProto(r, ip_proto, net)
@ -810,9 +810,10 @@ def macips(ipt, machines, types_machines):
for machine in machines:
for type_m in types_machines:
if int(machine.rid()) in range(rid[type_m][0], rid[type_m][1]):
ipt.macip(machine.mac(), type_m)
break
for plage in rid[type_m]:
if int(machine.rid()) in range(plage[0], plage[1]):
ipt.macip(machine.mac(), type_m)
break
for type_m in types_machines:
if not type_m in tab.keys():