[gestion/gen_confs/firewall6.py,gestion/ipt.py] Ménage dans les règles après que komaz soit devenue routeur pour le wifi et avoir permis les etensions de vie privée.
This commit is contained in:
Valentin Samir
parent
58b2dbe647
commit
ab5320bfd2
2 changed files with 44 additions and 93 deletions
|
|
@ -42,6 +42,22 @@ Usage:
|
|||
%(script)s restart : Redémarrage du firewall
|
||||
""" % { 'script' : sys.argv[0].split('/')[-1] }
|
||||
|
||||
def tracker_torrent(ip6tables):
|
||||
for tracker in udp_torrent_tracker:
|
||||
for dest in gethostbyname(tracker)[1]:
|
||||
ip6tables.filter.tracker_torrent('-p udp -d %s -j LOG --log-level notice --log-prefix "TRACKER:%s "' % (dest,(tracker[:20]) if len(tracker) > 20 else tracker))
|
||||
ip6tables.filter.tracker_torrent('-p udp -d %s -j REJECT --reject-with icmp6-adm-prohibited' % dest)
|
||||
ip6tables.filter.tracker_torrent('-p udp -j RETURN')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "info_hash=" -j ACCEPT')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp --string "/scrape?" -j LOG --log-level notice --log-prefix "TRACKER_TORRENT: "')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp --string "/scrape?" -j REJECT --reject-with icmp6-adm-prohibited')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "peer_id=" -j ACCEPT')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "port=" -j ACCEPT')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "uploaded=" -j ACCEPT')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "downloaded=" -j ACCEPT')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "left=" -j ACCEPT')
|
||||
ip6tables.filter.tracker_torrent('-j LOG --log-level notice --log-prefix "TRACKER_TORRENT: "')
|
||||
ip6tables.filter.tracker_torrent('-j REJECT --reject-with icmp6-adm-prohibited')
|
||||
|
||||
def ports(dev_ip6, dev_list):
|
||||
''' Ouvre les ports '''
|
||||
|
|
@ -65,9 +81,6 @@ def ports(dev_ip6, dev_list):
|
|||
# ip6tables.filter.forward('-i %s -p tcp --dport ssh -m state --state NEW \
|
||||
#-j ACCEPT' % dev_ip6)
|
||||
|
||||
# Ipv6 sur évènementiel, on ne laisse sortir que si ça vient de la mac d'ytrap-llatsni
|
||||
ip6tables.filter.forward('-d 2a01:240:fe3d:d2::/64 -j ACCEPT')
|
||||
ip6tables.filter.forward('-m mac --mac-source 00:00:6c:69:69:01 -s 2a01:240:fe3d:d2::/64 -j ACCEPT')
|
||||
for proto in open_ports.keys():
|
||||
ip6tables.filter.forward('-i %s -p %s -m multiport --dports %s -j ACCEPT' % (dev_ip6, proto, open_ports[proto]))
|
||||
for type_machine in ['fil', 'fil-v6', 'wifi', 'wifi-v6']:
|
||||
|
|
@ -101,20 +114,18 @@ def basic_fw():
|
|||
ip6tables.filter.input('-p icmpv6 -m icmp6 --icmpv6-type %s -j ACCEPT' % icmpv6)
|
||||
ip6tables.filter.output('-p icmpv6 -m icmp6 --icmpv6-type %s -j ACCEPT' % icmpv6)
|
||||
|
||||
# on accepte les ping
|
||||
for icmpv6 in authorized_icmpv6:
|
||||
ip6tables.filter.forward('-p icmpv6 -m icmp6 --icmpv6-type %s -j ACCEPT' % icmpv6)
|
||||
ip6tables.filter.forward('-p icmpv6 -j REJECT')
|
||||
|
||||
# On ne vérifie rien sur les ip qui ne sont pas dans notre prefix
|
||||
ip6tables.filter.ieui64('! -s %s -j RETURN' % prefix['subnet'][0])
|
||||
|
||||
# XXX Code spécifique pour le wifi, peut être pas la manière la plus
|
||||
# élégante, mais peut être la plus pratique
|
||||
#if hostname in role.keys() and ('wifi-router' not in role[hostname]):
|
||||
# ip6tables.filter.ieui64('-i %s -s %s -m mac --mac-source %s -j RETURN'
|
||||
# % (iface6('fil'), prefix['wifi'][0], mac_wifi))
|
||||
for net in prefix['subnet']:
|
||||
ip6tables.filter.ieui64('! -s %s -j RETURN' % net)
|
||||
|
||||
# Correspondance MAC-IP
|
||||
mac_ip(ip6tables, machines, ['fil', 'fil-v6', 'adm', 'wifi', 'wifi-v6', 'serveurs'])
|
||||
|
||||
#wifi ?
|
||||
|
||||
def main_router():
|
||||
''' Firewall pour le router principal '''
|
||||
|
|
@ -126,13 +137,6 @@ def main_router():
|
|||
# enlève les entrées dans la conntract lors de la mise en place de la
|
||||
# blackliste
|
||||
|
||||
# route pour le proxy transparent
|
||||
# Pour plus tard
|
||||
# custom_default_route('proxy', ip_attribut('main-proxy', cl, 6), 'fil', 6)
|
||||
# custom_mark_rule('proxy', conf_fw.mark['proxy'], 6)
|
||||
# ip6tables.mangle.prerouting("-p tcp -d ! %s --dport 80 -j MARK --set-mark\
|
||||
# %s" % (prefix['fil'][0], conf_fw.mark['proxy']))
|
||||
#
|
||||
|
||||
dev_crans = iface6('fil')
|
||||
dev_wifi = iface6('wifi')
|
||||
|
|
@ -148,6 +152,9 @@ def main_router():
|
|||
ip6tables.mangle.prerouting('-i %s -m state --state NEW -j LOG --log-prefix "LOG_ALL "' % dev_wifi)
|
||||
ip6tables.mangle.prerouting('-i %s -m state --state NEW -j LOG --log-prefix "LOG_ALL "' % dev_ip6 )
|
||||
|
||||
# Ipv6 sur évènementiel, on ne laisse sortir que si ça vient de la mac d'ytrap-llatsni
|
||||
ip6tables.filter.forward('-o %s -d 2a01:240:fe3d:d2::/64 -j ACCEPT' % dev_crans)
|
||||
ip6tables.filter.forward('-o %s -m mac --mac-source 00:00:6c:69:69:01 -s 2a01:240:fe3d:d2::/64 -j ACCEPT' % dev_ip6)
|
||||
|
||||
# Les blacklistes
|
||||
# Si on les met après la règle conntrack, une connexion existante ne sera
|
||||
|
|
@ -158,25 +165,13 @@ def main_router():
|
|||
blacklist(ip6tables)
|
||||
ip6tables.filter.forward('-i %s -j BLACKLIST_SRC' % dev_crans)
|
||||
ip6tables.filter.forward('-i %s -j BLACKLIST_SRC' % dev_wifi)
|
||||
#~ ip6tables.filter.forward('-o %s -j BLACKLIST_SRC' % dev_ip6)
|
||||
ip6tables.filter.forward('-i %s -j BLACKLIST_DST' % dev_ip6)
|
||||
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "info_hash=" -j ACCEPT')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp --string "/scrape?" -j LOG --log-level notice --log-prefix "TRACKER_TORRENT: "')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp --string "/scrape?" -j REJECT --reject-with icmp6-adm-prohibited')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "peer_id=" -j ACCEPT')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "port=" -j ACCEPT')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "uploaded=" -j ACCEPT')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "downloaded=" -j ACCEPT')
|
||||
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "left=" -j ACCEPT')
|
||||
ip6tables.filter.tracker_torrent('-j LOG --log-level notice --log-prefix "TRACKER_TORRENT: "')
|
||||
ip6tables.filter.tracker_torrent('-j REJECT --reject-with icmp6-adm-prohibited')
|
||||
ip6tables.filter.forward('-p tcp -m string --algo kmp --string "GET /" -j TRACKER_TORRENT')
|
||||
ip6tables.filter.forward('-p tcp -m string --algo kmp --string "get /" -j TRACKER_TORRENT')
|
||||
for tracker in udp_torrent_tracker:
|
||||
for dest in gethostbyname(tracker)[1]:
|
||||
ip6tables.filter.forward('-p udp -d %s -j LOG --log-level notice --log-prefix "TRACKER:%s "' % (dest,(tracker[:20]) if len(tracker) > 20 else tracker))
|
||||
ip6tables.filter.forward('-p udp -d %s -j REJECT --reject-with icmp6-adm-prohibited' % dest)
|
||||
tracker_torrent(ip6tables)
|
||||
ip6tables.filter.forward('-o %s -p udp -j TRACKER_TORRENT' % dev_ip6 )
|
||||
ip6tables.filter.forward('-o %s -p tcp -m string --algo kmp --string "GET /" -j TRACKER_TORRENT' % dev_ip6)
|
||||
ip6tables.filter.forward('-o %s -p tcp -m string --algo kmp --string "get /" -j TRACKER_TORRENT' % dev_ip6)
|
||||
|
||||
|
||||
ip6tables.filter.forward('-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT')
|
||||
|
||||
|
|
@ -192,21 +187,11 @@ def main_router():
|
|||
type_m.upper()))
|
||||
ip6tables.filter.forward('-i %s -j MAC' % dev_crans)
|
||||
ip6tables.filter.forward('-i %s -j MAC' % dev_wifi)
|
||||
#ip6tables.filter.forward('-i %s -j FEUI64' % dev_crans)
|
||||
#ip6tables.filter.feui64('-s %s -m mac --mac-source %s -j RETURN' %
|
||||
# (prefix['wifi'][0], mac_wifi))
|
||||
#ip6tables.filter.feui64('-s %s -m eui64 -j RETURN' % prefix['fil'][0])
|
||||
#ip6tables.filter.feui64('-j REJECT')
|
||||
|
||||
# Rien ne passe vers adm
|
||||
# est ce que du local est gêné par le règle ?
|
||||
ip6tables.filter.forward('-d %s -j REJECT --reject-with icmp6-addr-unreachable' % (prefix['adm'][0]))
|
||||
|
||||
# on accepte les ping
|
||||
for icmpv6 in authorized_icmpv6:
|
||||
ip6tables.filter.forward('-p icmpv6 -m icmp6 --icmpv6-type %s -j ACCEPT' % icmpv6)
|
||||
ip6tables.filter.forward('-p icmpv6 -j REJECT')
|
||||
|
||||
# cf https://www.sixxs.net/faq/connectivity/?faq=filters
|
||||
ip6tables.filter.forward('-m rt --rt-type 0 -j REJECT')
|
||||
|
||||
|
|
@ -218,42 +203,9 @@ def main_router():
|
|||
|
||||
def wifi_router():
|
||||
''' Firewall pour le router du wifi '''
|
||||
# pour plus tard
|
||||
# custom_default_route('proxy', ip_attribut('main-proxy', cl, 6), 'wifi', 6)
|
||||
# custom_mark_rule('proxy', conf_fw.mark['proxy'], 6)
|
||||
# ip6tables.mangle.prerouting("-p tcp -d ! %s --dport 80 -j MARK --set-mark \
|
||||
#%s" % (prefix['fil'][0], conf_fw.mark['proxy']))
|
||||
dev_crans = iface6('fil')
|
||||
dev_wifi = iface6('wifi')
|
||||
|
||||
# Stop aux RA
|
||||
ip6tables.filter.forward('-p icmpv6 -m icmp6 --icmpv6-type router-advertisement -j REJECT')
|
||||
|
||||
# Un peu moche, mais il faut supprimer les dernière règles dans IEUI64
|
||||
# avant de rajouter la règle pour les machines wifi.
|
||||
l = len(ip6tables.filter.ieui64.items)
|
||||
del ip6tables.filter.ieui64.items[l-1]
|
||||
del ip6tables.filter.ieui64.items[l-2]
|
||||
mac_ip(ip6tables, machines, ['wifi', 'wifi-v6'])
|
||||
|
||||
liste_net = ['fil', 'fil-v6', 'wifi', 'wifi-v6']
|
||||
for type_m in [i for i in liste_net if not 'v6' in i]:
|
||||
ip6tables.filter.mac('-s %s -j %s' % (prefix[type_m][0], 'MAC' +
|
||||
type_m.upper()))
|
||||
ip6tables.filter.feui64('-s %s -m eui64 -j RETURN'
|
||||
% prefix[type_m][0])
|
||||
ip6tables.filter.feui64('-j REJECT')
|
||||
|
||||
ip6tables.filter.forward('-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT')
|
||||
|
||||
ip6tables.filter.forward('-j MAC')
|
||||
ip6tables.filter.forward('-j FEUI64')
|
||||
|
||||
|
||||
# On met en place le forwarding
|
||||
enable_forwarding(6)
|
||||
|
||||
#def main_proxy():
|
||||
# Le wifi est maintenant routé directement sur komaz.
|
||||
# On utilise donc directement main_router
|
||||
pass
|
||||
|
||||
def adherents_server():
|
||||
''' Firewall pour le serveur des adhérents '''
|
||||
|
|
@ -287,8 +239,10 @@ def adherents_server():
|
|||
|
||||
# On arrête tout
|
||||
ip6tables.filter.srv_out_adm('-j REJECT --reject-with icmp6-adm-prohibited')
|
||||
|
||||
def appt_proxy():
|
||||
pass
|
||||
|
||||
def start():
|
||||
''' Démarre le firewall sur la machine considérée '''
|
||||
|
||||
|
|
|
|||
|
|
@ -170,10 +170,7 @@ ACCEPT' % (dev, proto, ip, port))
|
|||
|
||||
if ip:
|
||||
self.filter.blacklist_src('-m mac --mac-source %s -j REJECT --reject-with icmp6-port-unreachable' % mac)
|
||||
#~ self.filter.blacklist_src('-s %s -j REJECT --reject-with \
|
||||
#~ icmp6-adm-prohibited' % ip)
|
||||
self.filter.blacklist_dst('-d %s -j REJECT --reject-with \
|
||||
icmp6-adm-prohibited' % ip)
|
||||
self.filter.blacklist_dst('-d %s -j REJECT --reject-with icmp6-adm-prohibited' % ip)
|
||||
|
||||
|
||||
def version(self):
|
||||
|
|
@ -751,19 +748,19 @@ def mac_ip(ipt, machines, types_machines):
|
|||
adresses en eui64'''
|
||||
|
||||
macips(ipt, machines, types_machines)
|
||||
# TODO Il faut raffiner avant de rajouter le wifi
|
||||
for type_m in types_machines:
|
||||
if not '-v6' in type_m:
|
||||
dev = iface6(type_m)
|
||||
ipt.filter.input('-i %s -s %s -j %s' % (dev, prefix[type_m][0],
|
||||
'MAC' + type_m.upper()))
|
||||
ipt.filter.input('-i %s -j IEUI64' % dev)
|
||||
ipt.filter.ieui64('-i %s -s %s -m eui64 -j RETURN' % (dev,
|
||||
prefix[type_m][0]))
|
||||
|
||||
# On active les extensions de vie privée
|
||||
for net in prefix['subnet']:
|
||||
ipt.filter.ieui64('-s %s -j RETURN' % net)
|
||||
# Pour le lien local, on n'accepte que les eui64
|
||||
ipt.filter.ieui64('-s fe80::/64 -m eui64 -j RETURN')
|
||||
ipt.filter.ieui64('-j REJECT')
|
||||
#ipt.filter.ieui64('-j REJECT')
|
||||
|
||||
def macips(ipt, machines, types_machines):
|
||||
''' Construit la chaîne MAC '''
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue