[gestion/gen_confs/firewall6.py,gestion/ipt.py] Ménage dans les règles après que komaz soit devenue routeur pour le wifi et avoir permis les etensions de vie privée.
This commit is contained in:
Valentin Samir
parent
58b2dbe647
commit
ab5320bfd2
2 changed files with 44 additions and 93 deletions
|
|
@ -42,6 +42,22 @@ Usage:
|
||||||
%(script)s restart : Redémarrage du firewall
|
%(script)s restart : Redémarrage du firewall
|
||||||
""" % { 'script' : sys.argv[0].split('/')[-1] }
|
""" % { 'script' : sys.argv[0].split('/')[-1] }
|
||||||
|
|
||||||
|
def tracker_torrent(ip6tables):
|
||||||
|
for tracker in udp_torrent_tracker:
|
||||||
|
for dest in gethostbyname(tracker)[1]:
|
||||||
|
ip6tables.filter.tracker_torrent('-p udp -d %s -j LOG --log-level notice --log-prefix "TRACKER:%s "' % (dest,(tracker[:20]) if len(tracker) > 20 else tracker))
|
||||||
|
ip6tables.filter.tracker_torrent('-p udp -d %s -j REJECT --reject-with icmp6-adm-prohibited' % dest)
|
||||||
|
ip6tables.filter.tracker_torrent('-p udp -j RETURN')
|
||||||
|
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "info_hash=" -j ACCEPT')
|
||||||
|
ip6tables.filter.tracker_torrent('-m string --algo kmp --string "/scrape?" -j LOG --log-level notice --log-prefix "TRACKER_TORRENT: "')
|
||||||
|
ip6tables.filter.tracker_torrent('-m string --algo kmp --string "/scrape?" -j REJECT --reject-with icmp6-adm-prohibited')
|
||||||
|
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "peer_id=" -j ACCEPT')
|
||||||
|
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "port=" -j ACCEPT')
|
||||||
|
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "uploaded=" -j ACCEPT')
|
||||||
|
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "downloaded=" -j ACCEPT')
|
||||||
|
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "left=" -j ACCEPT')
|
||||||
|
ip6tables.filter.tracker_torrent('-j LOG --log-level notice --log-prefix "TRACKER_TORRENT: "')
|
||||||
|
ip6tables.filter.tracker_torrent('-j REJECT --reject-with icmp6-adm-prohibited')
|
||||||
|
|
||||||
def ports(dev_ip6, dev_list):
|
def ports(dev_ip6, dev_list):
|
||||||
''' Ouvre les ports '''
|
''' Ouvre les ports '''
|
||||||
|
|
@ -65,9 +81,6 @@ def ports(dev_ip6, dev_list):
|
||||||
# ip6tables.filter.forward('-i %s -p tcp --dport ssh -m state --state NEW \
|
# ip6tables.filter.forward('-i %s -p tcp --dport ssh -m state --state NEW \
|
||||||
#-j ACCEPT' % dev_ip6)
|
#-j ACCEPT' % dev_ip6)
|
||||||
|
|
||||||
# Ipv6 sur évènementiel, on ne laisse sortir que si ça vient de la mac d'ytrap-llatsni
|
|
||||||
ip6tables.filter.forward('-d 2a01:240:fe3d:d2::/64 -j ACCEPT')
|
|
||||||
ip6tables.filter.forward('-m mac --mac-source 00:00:6c:69:69:01 -s 2a01:240:fe3d:d2::/64 -j ACCEPT')
|
|
||||||
for proto in open_ports.keys():
|
for proto in open_ports.keys():
|
||||||
ip6tables.filter.forward('-i %s -p %s -m multiport --dports %s -j ACCEPT' % (dev_ip6, proto, open_ports[proto]))
|
ip6tables.filter.forward('-i %s -p %s -m multiport --dports %s -j ACCEPT' % (dev_ip6, proto, open_ports[proto]))
|
||||||
for type_machine in ['fil', 'fil-v6', 'wifi', 'wifi-v6']:
|
for type_machine in ['fil', 'fil-v6', 'wifi', 'wifi-v6']:
|
||||||
|
|
@ -96,25 +109,23 @@ def basic_fw():
|
||||||
# On rejete les ra.
|
# On rejete les ra.
|
||||||
ip6tables.filter.input('-p icmpv6 -m icmp6 --icmpv6-type router-advertisement -j REJECT')
|
ip6tables.filter.input('-p icmpv6 -m icmp6 --icmpv6-type router-advertisement -j REJECT')
|
||||||
|
|
||||||
# On accepte NDP sauf les RA, sinon, les REJECT ne fonctionnent pas
|
# On accepte NDP sauf les RA, sinon, les REJECT ne fonctionnent pas
|
||||||
for icmpv6 in ['neighbour-solicitation','neighbour-advertisement','redirect','router-solicitation']:
|
for icmpv6 in ['neighbour-solicitation','neighbour-advertisement','redirect','router-solicitation']:
|
||||||
ip6tables.filter.input('-p icmpv6 -m icmp6 --icmpv6-type %s -j ACCEPT' % icmpv6)
|
ip6tables.filter.input('-p icmpv6 -m icmp6 --icmpv6-type %s -j ACCEPT' % icmpv6)
|
||||||
ip6tables.filter.output('-p icmpv6 -m icmp6 --icmpv6-type %s -j ACCEPT' % icmpv6)
|
ip6tables.filter.output('-p icmpv6 -m icmp6 --icmpv6-type %s -j ACCEPT' % icmpv6)
|
||||||
|
|
||||||
|
# on accepte les ping
|
||||||
# On ne vérifie rien sur les ip qui ne sont pas dans notre prefix
|
for icmpv6 in authorized_icmpv6:
|
||||||
ip6tables.filter.ieui64('! -s %s -j RETURN' % prefix['subnet'][0])
|
ip6tables.filter.forward('-p icmpv6 -m icmp6 --icmpv6-type %s -j ACCEPT' % icmpv6)
|
||||||
|
ip6tables.filter.forward('-p icmpv6 -j REJECT')
|
||||||
|
|
||||||
# XXX Code spécifique pour le wifi, peut être pas la manière la plus
|
# On ne vérifie rien sur les ip qui ne sont pas dans notre prefix
|
||||||
# élégante, mais peut être la plus pratique
|
for net in prefix['subnet']:
|
||||||
#if hostname in role.keys() and ('wifi-router' not in role[hostname]):
|
ip6tables.filter.ieui64('! -s %s -j RETURN' % net)
|
||||||
# ip6tables.filter.ieui64('-i %s -s %s -m mac --mac-source %s -j RETURN'
|
|
||||||
# % (iface6('fil'), prefix['wifi'][0], mac_wifi))
|
|
||||||
|
|
||||||
# Correspondance MAC-IP
|
# Correspondance MAC-IP
|
||||||
mac_ip(ip6tables, machines, ['fil', 'fil-v6', 'adm', 'wifi', 'wifi-v6', 'serveurs'])
|
mac_ip(ip6tables, machines, ['fil', 'fil-v6', 'adm', 'wifi', 'wifi-v6', 'serveurs'])
|
||||||
|
|
||||||
#wifi ?
|
|
||||||
|
|
||||||
def main_router():
|
def main_router():
|
||||||
''' Firewall pour le router principal '''
|
''' Firewall pour le router principal '''
|
||||||
|
|
@ -126,13 +137,6 @@ def main_router():
|
||||||
# enlève les entrées dans la conntract lors de la mise en place de la
|
# enlève les entrées dans la conntract lors de la mise en place de la
|
||||||
# blackliste
|
# blackliste
|
||||||
|
|
||||||
# route pour le proxy transparent
|
|
||||||
# Pour plus tard
|
|
||||||
# custom_default_route('proxy', ip_attribut('main-proxy', cl, 6), 'fil', 6)
|
|
||||||
# custom_mark_rule('proxy', conf_fw.mark['proxy'], 6)
|
|
||||||
# ip6tables.mangle.prerouting("-p tcp -d ! %s --dport 80 -j MARK --set-mark\
|
|
||||||
# %s" % (prefix['fil'][0], conf_fw.mark['proxy']))
|
|
||||||
#
|
|
||||||
|
|
||||||
dev_crans = iface6('fil')
|
dev_crans = iface6('fil')
|
||||||
dev_wifi = iface6('wifi')
|
dev_wifi = iface6('wifi')
|
||||||
|
|
@ -148,7 +152,10 @@ def main_router():
|
||||||
ip6tables.mangle.prerouting('-i %s -m state --state NEW -j LOG --log-prefix "LOG_ALL "' % dev_wifi)
|
ip6tables.mangle.prerouting('-i %s -m state --state NEW -j LOG --log-prefix "LOG_ALL "' % dev_wifi)
|
||||||
ip6tables.mangle.prerouting('-i %s -m state --state NEW -j LOG --log-prefix "LOG_ALL "' % dev_ip6 )
|
ip6tables.mangle.prerouting('-i %s -m state --state NEW -j LOG --log-prefix "LOG_ALL "' % dev_ip6 )
|
||||||
|
|
||||||
|
# Ipv6 sur évènementiel, on ne laisse sortir que si ça vient de la mac d'ytrap-llatsni
|
||||||
|
ip6tables.filter.forward('-o %s -d 2a01:240:fe3d:d2::/64 -j ACCEPT' % dev_crans)
|
||||||
|
ip6tables.filter.forward('-o %s -m mac --mac-source 00:00:6c:69:69:01 -s 2a01:240:fe3d:d2::/64 -j ACCEPT' % dev_ip6)
|
||||||
|
|
||||||
# Les blacklistes
|
# Les blacklistes
|
||||||
# Si on les met après la règle conntrack, une connexion existante ne sera
|
# Si on les met après la règle conntrack, une connexion existante ne sera
|
||||||
# pas sevrée et dinc avec un tunnel ssh idoine, la blacklist aurait aucun
|
# pas sevrée et dinc avec un tunnel ssh idoine, la blacklist aurait aucun
|
||||||
|
|
@ -158,25 +165,13 @@ def main_router():
|
||||||
blacklist(ip6tables)
|
blacklist(ip6tables)
|
||||||
ip6tables.filter.forward('-i %s -j BLACKLIST_SRC' % dev_crans)
|
ip6tables.filter.forward('-i %s -j BLACKLIST_SRC' % dev_crans)
|
||||||
ip6tables.filter.forward('-i %s -j BLACKLIST_SRC' % dev_wifi)
|
ip6tables.filter.forward('-i %s -j BLACKLIST_SRC' % dev_wifi)
|
||||||
#~ ip6tables.filter.forward('-o %s -j BLACKLIST_SRC' % dev_ip6)
|
|
||||||
ip6tables.filter.forward('-i %s -j BLACKLIST_DST' % dev_ip6)
|
ip6tables.filter.forward('-i %s -j BLACKLIST_DST' % dev_ip6)
|
||||||
|
|
||||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "info_hash=" -j ACCEPT')
|
tracker_torrent(ip6tables)
|
||||||
ip6tables.filter.tracker_torrent('-m string --algo kmp --string "/scrape?" -j LOG --log-level notice --log-prefix "TRACKER_TORRENT: "')
|
ip6tables.filter.forward('-o %s -p udp -j TRACKER_TORRENT' % dev_ip6 )
|
||||||
ip6tables.filter.tracker_torrent('-m string --algo kmp --string "/scrape?" -j REJECT --reject-with icmp6-adm-prohibited')
|
ip6tables.filter.forward('-o %s -p tcp -m string --algo kmp --string "GET /" -j TRACKER_TORRENT' % dev_ip6)
|
||||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "peer_id=" -j ACCEPT')
|
ip6tables.filter.forward('-o %s -p tcp -m string --algo kmp --string "get /" -j TRACKER_TORRENT' % dev_ip6)
|
||||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "port=" -j ACCEPT')
|
|
||||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "uploaded=" -j ACCEPT')
|
|
||||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "downloaded=" -j ACCEPT')
|
|
||||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "left=" -j ACCEPT')
|
|
||||||
ip6tables.filter.tracker_torrent('-j LOG --log-level notice --log-prefix "TRACKER_TORRENT: "')
|
|
||||||
ip6tables.filter.tracker_torrent('-j REJECT --reject-with icmp6-adm-prohibited')
|
|
||||||
ip6tables.filter.forward('-p tcp -m string --algo kmp --string "GET /" -j TRACKER_TORRENT')
|
|
||||||
ip6tables.filter.forward('-p tcp -m string --algo kmp --string "get /" -j TRACKER_TORRENT')
|
|
||||||
for tracker in udp_torrent_tracker:
|
|
||||||
for dest in gethostbyname(tracker)[1]:
|
|
||||||
ip6tables.filter.forward('-p udp -d %s -j LOG --log-level notice --log-prefix "TRACKER:%s "' % (dest,(tracker[:20]) if len(tracker) > 20 else tracker))
|
|
||||||
ip6tables.filter.forward('-p udp -d %s -j REJECT --reject-with icmp6-adm-prohibited' % dest)
|
|
||||||
|
|
||||||
ip6tables.filter.forward('-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT')
|
ip6tables.filter.forward('-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT')
|
||||||
|
|
||||||
|
|
@ -192,21 +187,11 @@ def main_router():
|
||||||
type_m.upper()))
|
type_m.upper()))
|
||||||
ip6tables.filter.forward('-i %s -j MAC' % dev_crans)
|
ip6tables.filter.forward('-i %s -j MAC' % dev_crans)
|
||||||
ip6tables.filter.forward('-i %s -j MAC' % dev_wifi)
|
ip6tables.filter.forward('-i %s -j MAC' % dev_wifi)
|
||||||
#ip6tables.filter.forward('-i %s -j FEUI64' % dev_crans)
|
|
||||||
#ip6tables.filter.feui64('-s %s -m mac --mac-source %s -j RETURN' %
|
|
||||||
# (prefix['wifi'][0], mac_wifi))
|
|
||||||
#ip6tables.filter.feui64('-s %s -m eui64 -j RETURN' % prefix['fil'][0])
|
|
||||||
#ip6tables.filter.feui64('-j REJECT')
|
|
||||||
|
|
||||||
# Rien ne passe vers adm
|
# Rien ne passe vers adm
|
||||||
# est ce que du local est gêné par le règle ?
|
# est ce que du local est gêné par le règle ?
|
||||||
ip6tables.filter.forward('-d %s -j REJECT --reject-with icmp6-addr-unreachable' % (prefix['adm'][0]))
|
ip6tables.filter.forward('-d %s -j REJECT --reject-with icmp6-addr-unreachable' % (prefix['adm'][0]))
|
||||||
|
|
||||||
# on accepte les ping
|
|
||||||
for icmpv6 in authorized_icmpv6:
|
|
||||||
ip6tables.filter.forward('-p icmpv6 -m icmp6 --icmpv6-type %s -j ACCEPT' % icmpv6)
|
|
||||||
ip6tables.filter.forward('-p icmpv6 -j REJECT')
|
|
||||||
|
|
||||||
# cf https://www.sixxs.net/faq/connectivity/?faq=filters
|
# cf https://www.sixxs.net/faq/connectivity/?faq=filters
|
||||||
ip6tables.filter.forward('-m rt --rt-type 0 -j REJECT')
|
ip6tables.filter.forward('-m rt --rt-type 0 -j REJECT')
|
||||||
|
|
||||||
|
|
@ -218,42 +203,9 @@ def main_router():
|
||||||
|
|
||||||
def wifi_router():
|
def wifi_router():
|
||||||
''' Firewall pour le router du wifi '''
|
''' Firewall pour le router du wifi '''
|
||||||
# pour plus tard
|
# Le wifi est maintenant routé directement sur komaz.
|
||||||
# custom_default_route('proxy', ip_attribut('main-proxy', cl, 6), 'wifi', 6)
|
# On utilise donc directement main_router
|
||||||
# custom_mark_rule('proxy', conf_fw.mark['proxy'], 6)
|
pass
|
||||||
# ip6tables.mangle.prerouting("-p tcp -d ! %s --dport 80 -j MARK --set-mark \
|
|
||||||
#%s" % (prefix['fil'][0], conf_fw.mark['proxy']))
|
|
||||||
dev_crans = iface6('fil')
|
|
||||||
dev_wifi = iface6('wifi')
|
|
||||||
|
|
||||||
# Stop aux RA
|
|
||||||
ip6tables.filter.forward('-p icmpv6 -m icmp6 --icmpv6-type router-advertisement -j REJECT')
|
|
||||||
|
|
||||||
# Un peu moche, mais il faut supprimer les dernière règles dans IEUI64
|
|
||||||
# avant de rajouter la règle pour les machines wifi.
|
|
||||||
l = len(ip6tables.filter.ieui64.items)
|
|
||||||
del ip6tables.filter.ieui64.items[l-1]
|
|
||||||
del ip6tables.filter.ieui64.items[l-2]
|
|
||||||
mac_ip(ip6tables, machines, ['wifi', 'wifi-v6'])
|
|
||||||
|
|
||||||
liste_net = ['fil', 'fil-v6', 'wifi', 'wifi-v6']
|
|
||||||
for type_m in [i for i in liste_net if not 'v6' in i]:
|
|
||||||
ip6tables.filter.mac('-s %s -j %s' % (prefix[type_m][0], 'MAC' +
|
|
||||||
type_m.upper()))
|
|
||||||
ip6tables.filter.feui64('-s %s -m eui64 -j RETURN'
|
|
||||||
% prefix[type_m][0])
|
|
||||||
ip6tables.filter.feui64('-j REJECT')
|
|
||||||
|
|
||||||
ip6tables.filter.forward('-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT')
|
|
||||||
|
|
||||||
ip6tables.filter.forward('-j MAC')
|
|
||||||
ip6tables.filter.forward('-j FEUI64')
|
|
||||||
|
|
||||||
|
|
||||||
# On met en place le forwarding
|
|
||||||
enable_forwarding(6)
|
|
||||||
|
|
||||||
#def main_proxy():
|
|
||||||
|
|
||||||
def adherents_server():
|
def adherents_server():
|
||||||
''' Firewall pour le serveur des adhérents '''
|
''' Firewall pour le serveur des adhérents '''
|
||||||
|
|
@ -287,8 +239,10 @@ def adherents_server():
|
||||||
|
|
||||||
# On arrête tout
|
# On arrête tout
|
||||||
ip6tables.filter.srv_out_adm('-j REJECT --reject-with icmp6-adm-prohibited')
|
ip6tables.filter.srv_out_adm('-j REJECT --reject-with icmp6-adm-prohibited')
|
||||||
|
|
||||||
def appt_proxy():
|
def appt_proxy():
|
||||||
pass
|
pass
|
||||||
|
|
||||||
def start():
|
def start():
|
||||||
''' Démarre le firewall sur la machine considérée '''
|
''' Démarre le firewall sur la machine considérée '''
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -118,7 +118,7 @@ class Ip6tables(object):
|
||||||
def macip(self, mac, type_m):
|
def macip(self, mac, type_m):
|
||||||
'''Fait la correspondance MAC-IP'''
|
'''Fait la correspondance MAC-IP'''
|
||||||
tab = {'serveurs' : 'fil' }
|
tab = {'serveurs' : 'fil' }
|
||||||
if type_m in tab.keys(): type_m = tab[type_m]
|
if type_m in tab.keys(): type_m = tab[type_m]
|
||||||
type_mm = re.sub('-', '', type_m)
|
type_mm = re.sub('-', '', type_m)
|
||||||
getattr(self.filter,'mac' + type_mm)(" ".join(['-m mac --mac-source', mac,
|
getattr(self.filter,'mac' + type_mm)(" ".join(['-m mac --mac-source', mac,
|
||||||
'-j RETURN']))
|
'-j RETURN']))
|
||||||
|
|
@ -170,10 +170,7 @@ ACCEPT' % (dev, proto, ip, port))
|
||||||
|
|
||||||
if ip:
|
if ip:
|
||||||
self.filter.blacklist_src('-m mac --mac-source %s -j REJECT --reject-with icmp6-port-unreachable' % mac)
|
self.filter.blacklist_src('-m mac --mac-source %s -j REJECT --reject-with icmp6-port-unreachable' % mac)
|
||||||
#~ self.filter.blacklist_src('-s %s -j REJECT --reject-with \
|
self.filter.blacklist_dst('-d %s -j REJECT --reject-with icmp6-adm-prohibited' % ip)
|
||||||
#~ icmp6-adm-prohibited' % ip)
|
|
||||||
self.filter.blacklist_dst('-d %s -j REJECT --reject-with \
|
|
||||||
icmp6-adm-prohibited' % ip)
|
|
||||||
|
|
||||||
|
|
||||||
def version(self):
|
def version(self):
|
||||||
|
|
@ -751,19 +748,19 @@ def mac_ip(ipt, machines, types_machines):
|
||||||
adresses en eui64'''
|
adresses en eui64'''
|
||||||
|
|
||||||
macips(ipt, machines, types_machines)
|
macips(ipt, machines, types_machines)
|
||||||
# TODO Il faut raffiner avant de rajouter le wifi
|
|
||||||
for type_m in types_machines:
|
for type_m in types_machines:
|
||||||
if not '-v6' in type_m:
|
if not '-v6' in type_m:
|
||||||
dev = iface6(type_m)
|
dev = iface6(type_m)
|
||||||
ipt.filter.input('-i %s -s %s -j %s' % (dev, prefix[type_m][0],
|
ipt.filter.input('-i %s -s %s -j %s' % (dev, prefix[type_m][0],
|
||||||
'MAC' + type_m.upper()))
|
'MAC' + type_m.upper()))
|
||||||
ipt.filter.input('-i %s -j IEUI64' % dev)
|
ipt.filter.input('-i %s -j IEUI64' % dev)
|
||||||
ipt.filter.ieui64('-i %s -s %s -m eui64 -j RETURN' % (dev,
|
|
||||||
prefix[type_m][0]))
|
|
||||||
|
|
||||||
|
# On active les extensions de vie privée
|
||||||
|
for net in prefix['subnet']:
|
||||||
|
ipt.filter.ieui64('-s %s -j RETURN' % net)
|
||||||
|
# Pour le lien local, on n'accepte que les eui64
|
||||||
ipt.filter.ieui64('-s fe80::/64 -m eui64 -j RETURN')
|
ipt.filter.ieui64('-s fe80::/64 -m eui64 -j RETURN')
|
||||||
ipt.filter.ieui64('-j REJECT')
|
ipt.filter.ieui64('-j REJECT')
|
||||||
#ipt.filter.ieui64('-j REJECT')
|
|
||||||
|
|
||||||
def macips(ipt, machines, types_machines):
|
def macips(ipt, machines, types_machines):
|
||||||
''' Construit la chaîne MAC '''
|
''' Construit la chaîne MAC '''
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue