firewall_crans.py: cosmetics
firewall_komaz.py: firewall de komaz rcrit comme classe fille de la classe
firewall_crans; le firewall est _identique_.
darcs-hash:20050518101537-f163d-a59a23be1299897f7da90f0d9abba017a96abcca.gz
This commit is contained in:
segaud
parent
302a10e109
commit
e5f7fd4ba0
2 changed files with 95 additions and 373 deletions
|
|
@ -383,7 +383,7 @@ class firewall_crans :
|
||||||
def build_chaine_adherent(self,chaine,methode) :
|
def build_chaine_adherent(self,chaine,methode) :
|
||||||
# On construit d'abord les autorisations particuli\uffffres
|
# On construit d'abord les autorisations particuli\uffffres
|
||||||
if not self.build_chaine(chaine, methode) :
|
if not self.build_chaine(chaine, methode) :
|
||||||
# Puis si pas de probl\uffffmes les autorisation par d\ufffffaut
|
# Puis si pas de problèmes les autorisationq par défaut
|
||||||
self.anim.reinit()
|
self.anim.reinit()
|
||||||
for proto in [ 'tcp' , 'udp' ] :
|
for proto in [ 'tcp' , 'udp' ] :
|
||||||
for port in self.ports_default["%s_%s" % ( proto, chaine) ] :
|
for port in self.ports_default["%s_%s" % ( proto, chaine) ] :
|
||||||
|
|
@ -393,7 +393,7 @@ class firewall_crans :
|
||||||
print OK
|
print OK
|
||||||
|
|
||||||
def build_chaine(self,chaine, methode) :
|
def build_chaine(self,chaine, methode) :
|
||||||
self.anim = anim(' Cha\uffffne %s' % chaine,len(self.__machines())+1)
|
self.anim = anim(' Chaîne %s' % chaine,len(self.__machines())+1)
|
||||||
iptables("-F %s" % chaine)
|
iptables("-F %s" % chaine)
|
||||||
self.anim.cycle()
|
self.anim.cycle()
|
||||||
def procedure() :
|
def procedure() :
|
||||||
|
|
@ -406,4 +406,4 @@ class firewall_crans :
|
||||||
|
|
||||||
if __name__ == '__main__' :
|
if __name__ == '__main__' :
|
||||||
print "Cette classe n'est pas utilisable telle quelle"
|
print "Cette classe n'est pas utilisable telle quelle"
|
||||||
print " utilisee pour deriver les firewalls du Cr@ns"
|
print " utilisée pour deriver les firewalls du Cr@ns"
|
||||||
|
|
|
||||||
|
|
@ -4,7 +4,11 @@
|
||||||
# Manuel Sabban <manu@feyd-rautha.org>
|
# Manuel Sabban <manu@feyd-rautha.org>
|
||||||
# Frédéric Pauget <pauget@crans.ens-cachan.fr>
|
# Frédéric Pauget <pauget@crans.ens-cachan.fr>
|
||||||
#
|
#
|
||||||
|
# Rewritten as an inherited class from firewallÃ_crans
|
||||||
|
# by Mathieu Segaud <matt@minas-morgul.org>
|
||||||
|
#
|
||||||
# Copyright (c) 2004 Manuel Sabban, Frédéric Pauget
|
# Copyright (c) 2004 Manuel Sabban, Frédéric Pauget
|
||||||
|
# Copyright (c) 2005 Mathieu Segaud
|
||||||
#
|
#
|
||||||
# Permission to use, copy, and modify this software with or without fee
|
# Permission to use, copy, and modify this software with or without fee
|
||||||
# is hereby granted, provided that this entire notice is included in
|
# is hereby granted, provided that this entire notice is included in
|
||||||
|
|
@ -21,32 +25,15 @@ import sys
|
||||||
sys.path.append('/usr/scripts/gestion')
|
sys.path.append('/usr/scripts/gestion')
|
||||||
|
|
||||||
import syslog
|
import syslog
|
||||||
|
from firewall_crans import firewall_crans, IptablesError, iptables
|
||||||
from lock import *
|
from lock import *
|
||||||
from ldap_crans import crans_ldap, ann_scol, machine, crans, invite
|
from ldap_crans import crans_ldap, ann_scol, machine, crans, invite
|
||||||
from affich_tools import *
|
from affich_tools import *
|
||||||
from commands import getstatusoutput
|
from commands import getstatusoutput
|
||||||
from iptools import AddrInNet
|
from iptools import AddrInNet
|
||||||
syslog.openlog('firewall')
|
syslog.openlog('firewall')
|
||||||
|
|
||||||
class IptablesError(Exception):
|
|
||||||
""" Gestion des erreurs d'iptables """
|
|
||||||
def __init__(self,cmd,err_code,output):
|
|
||||||
self.cmd=cmd
|
|
||||||
self.err_code=err_code
|
|
||||||
self.output=output
|
|
||||||
syslog.syslog(syslog.LOG_ERR,"%s : status %s,%s" % (cmd,err_code,output))
|
|
||||||
def __str__(self):
|
|
||||||
return "%s\n status : %s\n %s" % (self.cmd,self.err_code,self.output)
|
|
||||||
|
|
||||||
def iptables(cmd):
|
|
||||||
""" Interface à iptables """
|
|
||||||
syslog.syslog(syslog.LOG_INFO,cmd)
|
|
||||||
status,output=getstatusoutput("/sbin/iptables "+cmd)
|
|
||||||
if status:
|
|
||||||
raise IptablesError(cmd,status,output)
|
|
||||||
return output
|
|
||||||
|
|
||||||
class firewall_komaz :
|
class firewall_komaz(firewall_crans) :
|
||||||
"""
|
"""
|
||||||
Structure du firewall :
|
Structure du firewall :
|
||||||
table nat :
|
table nat :
|
||||||
|
|
@ -82,40 +69,17 @@ class firewall_komaz :
|
||||||
ACCEPT pour bon mac-ip-port
|
ACCEPT pour bon mac-ip-port
|
||||||
REJECT pour le reste
|
REJECT pour le reste
|
||||||
"""
|
"""
|
||||||
zone_serveur="138.231.136.0/28"
|
|
||||||
vlan_adm="138.231.144.0/28"
|
# interfaces physiques
|
||||||
eth_ext = "eth2"
|
eth_ext = "eth2"
|
||||||
eth_int = "eth0"
|
eth_int = "eth0"
|
||||||
|
|
||||||
# Ports ouverts
|
# Ports ouverts
|
||||||
ports_default = { 'tcp_EXT_VERS_CRANS' : [ '22' ],
|
ports_default = { 'tcp_EXT_VERS_CRANS' : [ '22' ],
|
||||||
'tcp_CRANS_VERS_EXT': [ ':79', '81:134', '136', '140:444', '446:'],
|
'tcp_CRANS_VERS_EXT': [ ':79', '81:134', '136', '140:444', '446:'],
|
||||||
'udp_EXT_VERS_CRANS' : [ ],
|
'udp_EXT_VERS_CRANS' : [ ],
|
||||||
'udp_CRANS_VERS_EXT': [ ':136','140:'] }
|
'udp_CRANS_VERS_EXT': [ ':136','140:'] }
|
||||||
|
|
||||||
mac_wifi = '00:0c:f1:fa:f1:4b'
|
|
||||||
|
|
||||||
limit = " -m limit --limit 10/s --limit-burst 10 "
|
|
||||||
log_template = '-m limit --limit 1/s --limit-burst 1 -j LOG --log-level notice --log-prefix '
|
|
||||||
filtre_flood = '-m hashlimit --hashlimit 20 --hashlimit-mode srcip,dstip --hashlimit-name flood'
|
|
||||||
#filtre_flood = '-m dstlimit --dstlimit 20 --dstlimit-mode srcip-dstip --dstlimit-name flood'
|
|
||||||
|
|
||||||
liste_reseaux_non_routables = [ '1.0.0.0/8','2.0.0.0/8','5.0.0.0/8','7.0.0.0/8',\
|
|
||||||
'10.0.0.0/8','14.0.0.0/8','23.0.0.0/8','27.0.0.0/8','31.0.0.0/8','36.0.0.0/8',\
|
|
||||||
'37.0.0.0/8','39.0.0.0/8','41.0.0.0/8','42.0.0.0/8','71.0.0.0/8','72.0.0.0/8',\
|
|
||||||
'73.0.0.0/8','74.0.0.0/8','75.0.0.0/8','76.0.0.0/8','77.0.0.0/8','78.0.0.0/8',\
|
|
||||||
'79.0.0.0/8','89.0.0.0/8','90.0.0.0/8','91.0.0.0/8','92.0.0.0/8','93.0.0.0/8',\
|
|
||||||
'94.0.0.0/8','95.0.0.0/8','96.0.0.0/8','97.0.0.0/8','98.0.0.0/8','99.0.0.0/8',\
|
|
||||||
'100.0.0.0/8','101.0.0.0/8','102.0.0.0/8','103.0.0.0/8','104.0.0.0/8',\
|
|
||||||
'105.0.0.0/8','106.0.0.0/8','107.0.0.0/8','108.0.0.0/8','109.0.0.0/8',\
|
|
||||||
'110.0.0.0/8','111.0.0.0/8','112.0.0.0/8','113.0.0.0/8','114.0.0.0/8',\
|
|
||||||
'115.0.0.0/8','116.0.0.0/8','117.0.0.0/8','118.0.0.0/8','119.0.0.0/8',\
|
|
||||||
'120.0.0.0/8','121.0.0.0/8','122.0.0.0/8','123.0.0.0/8','124.0.0.0/8',\
|
|
||||||
'125.0.0.0/8','126.0.0.0/8','127.0.0.0/8','169.254.0.0/16','172.16.0.0/12',\
|
|
||||||
'173.0.0.0/8','174.0.0.0/8','175.0.0.0/8','176.0.0.0/8','177.0.0.0/8',\
|
|
||||||
'178.0.0.0/8','179.0.0.0/8','180.0.0.0/8','181.0.0.0/8','182.0.0.0/8',\
|
|
||||||
'183.0.0.0/8','184.0.0.0/8','185.0.0.0/8','186.0.0.0/8','187.0.0.0/8',\
|
|
||||||
'189.0.0.0/8','190.0.0.0/8','192.168.0.0/16','197.0.0.0/8','223.0.0.0/8',\
|
|
||||||
'224.0.0.0/4','240.0.0.0/4']
|
|
||||||
|
|
||||||
ports_virus = { 'tcp' : [ 135, 445 ] , 'udp' : [] }
|
ports_virus = { 'tcp' : [ 135, 445 ] , 'udp' : [] }
|
||||||
|
|
||||||
|
|
@ -131,113 +95,28 @@ class firewall_komaz :
|
||||||
('gnu', 'GNUtella') ]
|
('gnu', 'GNUtella') ]
|
||||||
ports_p2p = [ '412', '1214', '4662:4665' , '6346:6347', '6699', '6881:6889' ]
|
ports_p2p = [ '412', '1214', '4662:4665' , '6346:6347', '6699', '6881:6889' ]
|
||||||
|
|
||||||
machines = []
|
|
||||||
debug = 1
|
debug = 1
|
||||||
|
|
||||||
def __exception_catcher(self,tache) :
|
def nat_table_tweaks(self) :
|
||||||
""" Excétute la tache founie en gérant les diverses exceptions
|
self.anim = anim(' règles spécifiques à komaz')
|
||||||
pouvant survenir
|
for chaine in [ 'LOG_VIRUS', 'LOG_FLOOD', 'TEST_VIRUS_FLOOD' ] :
|
||||||
Retoune 1 en cas d'erreur et 0 sinon """
|
iptables('-t nat -N %s' % chaine)
|
||||||
try :
|
|
||||||
tache()
|
iptables("-t nat -I PREROUTING 4 -s ! %s -j TEST_VIRUS_FLOOD" % self.zone_serveur)
|
||||||
return 0
|
iptables("-t nat -R PREROUTING 6 -i %s -j RESEAUX_NON_ROUTABLES_SRC" % self.eth_ext )
|
||||||
except IptablesError, c :
|
iptables("-t nat -I PREROUTING 7 -d %s -j ACCEPT" % self.zone_serveur )
|
||||||
self.anim.reinit()
|
iptables("-t nat -I PREROUTING 8 -s %s -j ACCEPT" % self.zone_serveur )
|
||||||
print ERREUR
|
iptables("-t nat -I PREROUTING 9 -i %s -j ACCEPT" % self.eth_ext )
|
||||||
if self.debug : print c
|
print OK
|
||||||
except :
|
|
||||||
self.anim.reinit()
|
def filter_table_tweaks(self) :
|
||||||
print ERREUR
|
self.anim = anim(' règles spécifiques à komaz')
|
||||||
import traceback
|
|
||||||
if self.debug : traceback.print_exc()
|
|
||||||
return 1
|
|
||||||
|
|
||||||
def __machines(self) :
|
|
||||||
""" Liste des machines du crans """
|
|
||||||
if not self.machines :
|
|
||||||
self.anim = anim(" Interrogation de la base LDAP")
|
|
||||||
self.machines = crans_ldap().search('ip=*')['machine']
|
|
||||||
print OK
|
|
||||||
return self.machines
|
|
||||||
|
|
||||||
def __init__(self) :
|
|
||||||
""" Pose un lock """
|
|
||||||
make_lock('firewall')
|
|
||||||
|
|
||||||
def __del__(self) :
|
|
||||||
""" Destruction du lock """
|
|
||||||
remove_lock('firewall')
|
|
||||||
|
|
||||||
def restart(self):
|
|
||||||
""" Rédémarrage du firewall """
|
|
||||||
cprint('Redémarrage firewall','gras')
|
|
||||||
self.__exception_catcher(self.__stop)
|
|
||||||
self.start(False)
|
|
||||||
|
|
||||||
def start(self,aff_txt_intro=True) :
|
|
||||||
""" Construction du firewall
|
|
||||||
aff_txt_intro s'occupe uniquement de l'esthétisme
|
|
||||||
"""
|
|
||||||
if aff_txt_intro : cprint('Démarrage firewall','gras')
|
|
||||||
# Préliminaires
|
|
||||||
if not self.__machines() or self.__exception_catcher(self.__stop) :
|
|
||||||
cprint("Abandon",'rouge')
|
|
||||||
return
|
|
||||||
|
|
||||||
# Initialisation
|
|
||||||
self.__exception_catcher(self.__start)
|
|
||||||
|
|
||||||
# Remplisage
|
|
||||||
for tache in [ self.log_chaines, self.test_virus_flood, self.reseaux_non_routables,
|
|
||||||
self.blacklist , self.serveurs_vers_ext, self.ext_vers_serveurs,
|
|
||||||
self.crans_vers_ext, self.ext_vers_crans, self.test_mac_ip, self.filtre_p2p ] :
|
|
||||||
self.__exception_catcher(tache)
|
|
||||||
|
|
||||||
# On peux router
|
|
||||||
self.anim = anim(" Mise en place routage")
|
|
||||||
warn = ''
|
|
||||||
for cmd in [ 'echo 1 > /proc/sys/net/ipv4/ip_forward' ,
|
|
||||||
'echo 65536 > /proc/sys/net/ipv4/ip_conntrack_max' ,
|
|
||||||
'modprobe ip_conntrack_ftp' ,
|
|
||||||
'modprobe ip_conntrack_h323',
|
|
||||||
'modprobe ip_conntrack_irc' ] :
|
|
||||||
status,output=getstatusoutput(cmd)
|
|
||||||
if status :
|
|
||||||
warn += output +'\n'
|
|
||||||
if warn :
|
|
||||||
print WARNING
|
|
||||||
if self.debug :
|
|
||||||
print warn
|
|
||||||
else :
|
|
||||||
print OK
|
|
||||||
|
|
||||||
cprint(" -> fin de la procédure de démarrage",'vert')
|
|
||||||
|
|
||||||
def __start(self) :
|
|
||||||
self.anim = anim(' Structure de la table nat')
|
|
||||||
for chaine in [ 'LOG_VIRUS', 'LOG_FLOOD', 'TEST_VIRUS_FLOOD' , 'TEST_MAC-IP' , 'RESEAUX_NON_ROUTABLES_SRC', 'RESEAUX_NON_ROUTABLES_DST' ] :
|
|
||||||
iptables('-t nat -N %s' % chaine)
|
|
||||||
|
|
||||||
iptables("-t nat -P PREROUTING ACCEPT")
|
|
||||||
iptables("-t nat -A PREROUTING -i lo -j ACCEPT")
|
|
||||||
iptables("-t nat -A PREROUTING -d 224.0.0.0/4 -j DROP")
|
|
||||||
iptables("-t nat -A PREROUTING -s ! %s -j TEST_VIRUS_FLOOD" % self.zone_serveur)
|
|
||||||
iptables("-t nat -A PREROUTING -j RESEAUX_NON_ROUTABLES_DST")
|
|
||||||
iptables("-t nat -A PREROUTING -i %s -j RESEAUX_NON_ROUTABLES_SRC" % self.eth_ext )
|
|
||||||
iptables("-t nat -A PREROUTING -d %s -j ACCEPT" % self.zone_serveur )
|
|
||||||
iptables("-t nat -A PREROUTING -s %s -j ACCEPT" % self.zone_serveur )
|
|
||||||
iptables("-t nat -A PREROUTING -i %s -j ACCEPT" % self.eth_ext )
|
|
||||||
iptables("-t nat -A PREROUTING -j TEST_MAC-IP")
|
|
||||||
iptables("-t nat -P PREROUTING DROP")
|
|
||||||
print OK
|
|
||||||
|
|
||||||
self.anim = anim(' Structure de la table filter')
|
|
||||||
for chaine in [ 'EXT_VERS_SERVEURS', 'SERVEURS_VERS_EXT' , 'EXT_VERS_CRANS', 'CRANS_VERS_EXT', 'BLACKLIST_SRC', 'BLACKLIST_DST' , 'FILTRE_P2P' ] :
|
for chaine in [ 'EXT_VERS_SERVEURS', 'SERVEURS_VERS_EXT' , 'EXT_VERS_CRANS', 'CRANS_VERS_EXT', 'BLACKLIST_SRC', 'BLACKLIST_DST' , 'FILTRE_P2P' ] :
|
||||||
iptables('-N %s' % chaine)
|
iptables('-N %s' % chaine)
|
||||||
|
|
||||||
iptables("-A FORWARD -i lo -j ACCEPT")
|
iptables("-A FORWARD -i lo -j ACCEPT")
|
||||||
iptables("-A FORWARD -p icmp -j ACCEPT")
|
iptables("-A FORWARD -p icmp -j ACCEPT")
|
||||||
iptables("-A FORWARD -i %s -d %s -j REJECT" % (self.eth_ext, self.vlan_adm))
|
iptables("-A FORWARD -i %s -d %s -j REJECT" % (self.eth_ext, self.vlan_adm) )
|
||||||
|
iptables("-A FORWARD -o %s -d %s -j REJECT" % (self.eth_int, self.vlan_adm) )
|
||||||
iptables("-A FORWARD -i %s -j BLACKLIST_DST" % self.eth_ext )
|
iptables("-A FORWARD -i %s -j BLACKLIST_DST" % self.eth_ext )
|
||||||
iptables("-A FORWARD -o %s -j BLACKLIST_SRC" % self.eth_ext )
|
iptables("-A FORWARD -o %s -j BLACKLIST_SRC" % self.eth_ext )
|
||||||
iptables("-A FORWARD -s ! %s -d ! %s -j FILTRE_P2P" % (self.zone_serveur, self.zone_serveur) )
|
iptables("-A FORWARD -s ! %s -d ! %s -j FILTRE_P2P" % (self.zone_serveur, self.zone_serveur) )
|
||||||
|
|
@ -247,7 +126,53 @@ class firewall_komaz :
|
||||||
iptables("-A FORWARD -i %s -j EXT_VERS_CRANS" % self.eth_ext )
|
iptables("-A FORWARD -i %s -j EXT_VERS_CRANS" % self.eth_ext )
|
||||||
iptables("-A FORWARD -o %s -j CRANS_VERS_EXT" % self.eth_ext )
|
iptables("-A FORWARD -o %s -j CRANS_VERS_EXT" % self.eth_ext )
|
||||||
print OK
|
print OK
|
||||||
|
|
||||||
|
def enable_route(self) :
|
||||||
|
self.anim = anim(" Mise en place routage")
|
||||||
|
warn = ''
|
||||||
|
for cmd in [ 'echo 1 > /proc/sys/net/ipv4/ip_forward' ,
|
||||||
|
'echo 65536 > /proc/sys/net/ipv4/ip_conntrack_max' ,
|
||||||
|
'modprobe ip_conntrack_ftp' ,
|
||||||
|
'modprobe ip_conntrack_h323',
|
||||||
|
'modprobe ip_conntrack_irc' ] :
|
||||||
|
status,output=getstatusoutput(cmd)
|
||||||
|
if status :
|
||||||
|
warn += output + '\n'
|
||||||
|
if warn :
|
||||||
|
print WARNING
|
||||||
|
if self.debug :
|
||||||
|
print warn
|
||||||
|
else :
|
||||||
|
print OK
|
||||||
|
|
||||||
|
def disable_route(self) :
|
||||||
|
self.anim = anim(" Arret routage")
|
||||||
|
status,output=getstatusoutput('echo 0 > /proc/sys/net/ipv4/ip_forward')
|
||||||
|
if status :
|
||||||
|
print ERREUR
|
||||||
|
else :
|
||||||
|
print OK
|
||||||
|
|
||||||
|
def start_fw_funcs(self) :
|
||||||
|
self.exception_catcher(self.log_chaines)
|
||||||
|
self.exception_catcher(self.test_virus_flood)
|
||||||
|
self.exception_catcher(self.reseaux_non_routables)
|
||||||
|
self.exception_catcher(self.blacklist)
|
||||||
|
self.exception_catcher(self.serveurs_vers_ext)
|
||||||
|
self.exception_catcher(self.ext_vers_serveurs)
|
||||||
|
self.exception_catcher(self.crans_vers_ext)
|
||||||
|
self.exception_catcher(self.ext_vers_crans)
|
||||||
|
self.exception_catcher(self.test_mac_ip)
|
||||||
|
self.exception_catcher(self.filtre_p2p)
|
||||||
|
|
||||||
|
def serveurs_maj_list_to_do(self) :
|
||||||
|
self.exception_catcher(self.serveurs_vers_ext)
|
||||||
|
self.exception_catcher(self.ext_vers_serveurs)
|
||||||
|
|
||||||
|
def adh_maj_list_to_do(self) :
|
||||||
|
self.exception_catcher(self.crans_vers_ext)
|
||||||
|
self.exception_catcher(self.ext_vers_crans)
|
||||||
|
|
||||||
def log_chaines(self) :
|
def log_chaines(self) :
|
||||||
""" Construction des chaines de log (LOG_VIRUS et LOG_FLOOD) """
|
""" Construction des chaines de log (LOG_VIRUS et LOG_FLOOD) """
|
||||||
self.anim = anim(' Création des chaines de log')
|
self.anim = anim(' Création des chaines de log')
|
||||||
|
|
@ -260,16 +185,6 @@ class firewall_komaz :
|
||||||
self.anim.reinit()
|
self.anim.reinit()
|
||||||
print OK
|
print OK
|
||||||
|
|
||||||
def reseaux_non_routables(self) :
|
|
||||||
""" Construction de RESEAUX_NON_ROUTABLES_{DST,SRC} """
|
|
||||||
self.anim = anim(' Filtrage ip non routables',len(self.liste_reseaux_non_routables))
|
|
||||||
for reseau in self.liste_reseaux_non_routables :
|
|
||||||
iptables("-t nat -A RESEAUX_NON_ROUTABLES_DST -d %s -j DROP" % reseau)
|
|
||||||
iptables("-t nat -A RESEAUX_NON_ROUTABLES_SRC -s %s -j DROP" % reseau)
|
|
||||||
self.anim.cycle()
|
|
||||||
self.anim.reinit()
|
|
||||||
print OK
|
|
||||||
|
|
||||||
def test_virus_flood(self) :
|
def test_virus_flood(self) :
|
||||||
""" Construction de la chaîne TEST_VIRUS """
|
""" Construction de la chaîne TEST_VIRUS """
|
||||||
iptables('-t nat -F TEST_VIRUS_FLOOD')
|
iptables('-t nat -F TEST_VIRUS_FLOOD')
|
||||||
|
|
@ -286,87 +201,25 @@ class firewall_komaz :
|
||||||
self.anim.reinit()
|
self.anim.reinit()
|
||||||
print OK
|
print OK
|
||||||
|
|
||||||
def stop(self):
|
|
||||||
""" Arrête le firewall """
|
|
||||||
cprint("Arrêt du firewall",'gras')
|
|
||||||
self.anim = anim(" Arrêt routage")
|
|
||||||
status,output=getstatusoutput('echo 0 > /proc/sys/net/ipv4/ip_forward')
|
|
||||||
if status :
|
|
||||||
print ERREUR
|
|
||||||
else :
|
|
||||||
print OK
|
|
||||||
self.__exception_catcher(self.__stop)
|
|
||||||
cprint(" -> fin de la procédure d'arrêt",'vert')
|
|
||||||
|
|
||||||
def __stop(self) :
|
|
||||||
self.anim = anim(" Supression règles")
|
|
||||||
iptables("-t nat -P PREROUTING ACCEPT")
|
|
||||||
iptables("-F")
|
|
||||||
iptables("-t nat -F")
|
|
||||||
iptables("-X")
|
|
||||||
iptables("-t nat -X")
|
|
||||||
print OK
|
|
||||||
|
|
||||||
def test_mac_ip(self) :
|
|
||||||
""" Reconstruit la correspondance MAC-IP des machines des adhérents """
|
|
||||||
self.anim = anim(' Chaîne TEST_MAC-IP',len(self.__machines())+1)
|
|
||||||
iptables("-t nat -P PREROUTING ACCEPT")
|
|
||||||
iptables("-t nat -F TEST_MAC-IP")
|
|
||||||
self.anim.cycle()
|
|
||||||
|
|
||||||
def procedure() :
|
|
||||||
for machine in self.__machines() :
|
|
||||||
self.__test_mac_ip(machine)
|
|
||||||
self.anim.cycle()
|
|
||||||
iptables("-t nat -P PREROUTING DROP")
|
|
||||||
self.anim.reinit()
|
|
||||||
print OK
|
|
||||||
|
|
||||||
self.__exception_catcher(procedure)
|
|
||||||
|
|
||||||
def serveurs_vers_ext(self) :
|
def serveurs_vers_ext(self) :
|
||||||
""" Reconstruit la chaine SERVEURS_VERS_EXT """
|
""" Reconstruit la chaine SERVEURS_VERS_EXT """
|
||||||
if not self.__build_chaine('SERVEURS_VERS_EXT', self.__serveurs_vers_ext) :
|
if not self.build_chaine('SERVEURS_VERS_EXT', self.__serveurs_vers_ext) :
|
||||||
self.anim.reinit()
|
self.anim.reinit()
|
||||||
print OK
|
print OK
|
||||||
|
|
||||||
def ext_vers_serveurs(self) :
|
def ext_vers_serveurs(self) :
|
||||||
""" Reconstruit la chaine EXT_VERS_SERVEURS """
|
""" Reconstruit la chaine EXT_VERS_SERVEURS """
|
||||||
if not self.__build_chaine('EXT_VERS_SERVEURS', self.__ext_vers_serveurs) :
|
if not self.build_chaine('EXT_VERS_SERVEURS', self.__ext_vers_serveurs) :
|
||||||
self.anim.reinit()
|
self.anim.reinit()
|
||||||
print OK
|
print OK
|
||||||
|
|
||||||
def crans_vers_ext(self) :
|
def crans_vers_ext(self) :
|
||||||
""" Reconstruit la chaine CRANS_VERS_EXT """
|
""" Reconstruit la chaine CRANS_VERS_EXT """
|
||||||
self.__build_chaine_adherent('CRANS_VERS_EXT',self.__crans_vers_ext)
|
self.build_chaine_adherent('CRANS_VERS_EXT',self.__crans_vers_ext)
|
||||||
|
|
||||||
def ext_vers_crans(self) :
|
def ext_vers_crans(self) :
|
||||||
""" Reconstruit la chaine EXT_VERS_CRANS """
|
""" Reconstruit la chaine EXT_VERS_CRANS """
|
||||||
self.__build_chaine_adherent('EXT_VERS_CRANS',self.__ext_vers_crans)
|
self.build_chaine_adherent('EXT_VERS_CRANS',self.__ext_vers_crans)
|
||||||
|
|
||||||
def __build_chaine_adherent(self,chaine,methode):
|
|
||||||
# On construit d'abord les autorisations particulières
|
|
||||||
if not self.__build_chaine(chaine, methode) :
|
|
||||||
# Puis si pas de problèmes les autorisation par défaut
|
|
||||||
self.anim.reinit()
|
|
||||||
for proto in [ 'tcp' , 'udp' ] :
|
|
||||||
for port in self.ports_default["%s_%s" % ( proto, chaine) ] :
|
|
||||||
self.anim.cycle()
|
|
||||||
iptables("-I %s -p %s --dport %s -j ACCEPT" % (chaine, proto,port) )
|
|
||||||
self.anim.reinit()
|
|
||||||
print OK
|
|
||||||
|
|
||||||
def __build_chaine(self,chaine, methode) :
|
|
||||||
self.anim = anim(' Chaîne %s' % chaine,len(self.__machines())+1)
|
|
||||||
iptables("-F %s" % chaine)
|
|
||||||
self.anim.cycle()
|
|
||||||
def procedure() :
|
|
||||||
for machine in self.__machines() :
|
|
||||||
methode(machine)
|
|
||||||
self.anim.cycle()
|
|
||||||
iptables("-A %s -j REJECT" % chaine)
|
|
||||||
|
|
||||||
return self.__exception_catcher(procedure)
|
|
||||||
|
|
||||||
def __serveurs_vers_ext(self,machine):
|
def __serveurs_vers_ext(self,machine):
|
||||||
ip=machine.ip()
|
ip=machine.ip()
|
||||||
|
|
@ -396,72 +249,60 @@ class firewall_komaz :
|
||||||
for port in ports[proto].split() :
|
for port in ports[proto].split() :
|
||||||
iptables("-I EXT_VERS_SERVEURS -d %s -p %s --dport %s -j ACCEPT"\
|
iptables("-I EXT_VERS_SERVEURS -d %s -p %s --dport %s -j ACCEPT"\
|
||||||
%(ip,proto,port))
|
%(ip,proto,port))
|
||||||
|
|
||||||
def __crans_vers_ext(self,machine):
|
def __crans_vers_ext(self,machine):
|
||||||
ip=machine.ip()
|
ip=machine.ip()
|
||||||
if AddrInNet(ip,self.zone_serveur):
|
if AddrInNet(ip,self.zone_serveur):
|
||||||
# C'est un serveur, rien à faire ici
|
# C'est un serveur, rien à faire ici
|
||||||
return
|
return
|
||||||
|
|
||||||
ports = { 'tcp' : machine.portTCPout(),
|
ports = { 'tcp' : machine.portTCPout(),
|
||||||
'udp' : machine.portUDPout() }
|
'udp' : machine.portUDPout() }
|
||||||
|
|
||||||
for proto in [ 'tcp', 'udp' ] :
|
for proto in [ 'tcp', 'udp' ] :
|
||||||
for port in ports[proto].split() :
|
for port in ports[proto].split() :
|
||||||
iptables("-I CRANS_VERS_EXT -s %s -p %s --dport %s -j ACCEPT" \
|
iptables("-I CRANS_VERS_EXT -s %s -p %s --dport %s -j ACCEPT" \
|
||||||
%(ip,proto,port))
|
%(ip,proto,port))
|
||||||
|
|
||||||
def __ext_vers_crans(self,machine):
|
def __ext_vers_crans(self,machine):
|
||||||
ip=machine.ip()
|
ip=machine.ip()
|
||||||
if AddrInNet(ip,self.zone_serveur):
|
if AddrInNet(ip,self.zone_serveur):
|
||||||
# C'est un serveur, rien à faire ici
|
# C'est un serveur, rien à faire ici
|
||||||
return
|
return
|
||||||
|
|
||||||
ports = { 'tcp' : machine.portTCPin(),
|
ports = { 'tcp' : machine.portTCPin(),
|
||||||
'udp' : machine.portUDPin() }
|
'udp' : machine.portUDPin() }
|
||||||
|
|
||||||
for proto in [ 'tcp', 'udp' ] :
|
for proto in [ 'tcp', 'udp' ] :
|
||||||
for port in ports[proto].split() :
|
for port in ports[proto].split() :
|
||||||
iptables("-I EXT_VERS_CRANS -d %s -p %s --dport %s -j ACCEPT" \
|
iptables("-I EXT_VERS_CRANS -d %s -p %s --dport %s -j ACCEPT" \
|
||||||
%(ip,proto,port))
|
%(ip,proto,port))
|
||||||
|
|
||||||
def __test_mac_ip(self,machine):
|
|
||||||
ip=machine.ip()
|
|
||||||
mac=machine.mac()
|
|
||||||
if machine.ipsec():
|
|
||||||
# Machine wifi, c'est la mac de Nectaris
|
|
||||||
iptables("-t nat -A TEST_MAC-IP -s "+\
|
|
||||||
"%s -m mac --mac-source %s -j ACCEPT"%(ip,self.mac_wifi))
|
|
||||||
else:
|
|
||||||
# Machine fixe
|
|
||||||
iptables("-t nat -A TEST_MAC-IP -s "+\
|
|
||||||
"%s -m mac --mac-source %s -j ACCEPT"%(ip,mac))
|
|
||||||
|
|
||||||
def blacklist(self):
|
def blacklist(self):
|
||||||
""" Construit les chaines de blackliste (BLACKLIST_{DST,SRC}) """
|
""" Construit les chaines de blackliste (BLACKLIST_{DST,SRC}) """
|
||||||
self.anim = anim(" Blackliste")
|
self.anim = anim(" Blackliste")
|
||||||
iptables('-F BLACKLIST_DST')
|
iptables('-F BLACKLIST_DST')
|
||||||
iptables('-F BLACKLIST_SRC')
|
iptables('-F BLACKLIST_SRC')
|
||||||
|
|
||||||
blacklist=[]
|
blacklist=[]
|
||||||
search = crans_ldap().search('blacklist=*&paiement=%s'% ann_scol)
|
search = crans_ldap().search('blacklist=*&paiement=%s'% ann_scol)
|
||||||
for entite in search['adherent']+search['club']+search['machine']:
|
for entite in search['adherent']+search['club']+search['machine']:
|
||||||
self.anim.cycle()
|
self.anim.cycle()
|
||||||
sanctions = entite.blacklist_actif()
|
sanctions = entite.blacklist_actif()
|
||||||
if 'upload' in sanctions or 'warez' in sanctions :
|
if 'upload' in sanctions or 'warez' in sanctions :
|
||||||
from ldap_crans import machine
|
from ldap_crans import machine
|
||||||
if entite.__class__ == machine:
|
if entite.__class__ == machine:
|
||||||
blacklist+=[entite]
|
blacklist+=[entite]
|
||||||
else:
|
else:
|
||||||
blacklist+=entite.machines()
|
blacklist+=entite.machines()
|
||||||
|
|
||||||
for machine in blacklist:
|
for machine in blacklist:
|
||||||
iptables("-A BLACKLIST_DST -d %s -j REJECT --reject-with icmp-host-prohibited" % machine.ip())
|
iptables("-A BLACKLIST_DST -d %s -j REJECT --reject-with icmp-host-prohibited" % machine.ip())
|
||||||
iptables("-A BLACKLIST_SRC -s %s -j REJECT --reject-with icmp-host-prohibited" % machine.ip())
|
iptables("-A BLACKLIST_SRC -s %s -j REJECT --reject-with icmp-host-prohibited" % machine.ip())
|
||||||
|
|
||||||
self.anim.reinit()
|
self.anim.reinit()
|
||||||
print OK
|
print OK
|
||||||
|
|
||||||
def filtre_p2p(self):
|
def filtre_p2p(self):
|
||||||
""" Construit la chaines de filtrage du p2p (FILTRE_P2P) """
|
""" Construit la chaines de filtrage du p2p (FILTRE_P2P) """
|
||||||
self.anim = anim(" Filtrage p2p")
|
self.anim = anim(" Filtrage p2p")
|
||||||
|
|
@ -483,132 +324,13 @@ class firewall_komaz :
|
||||||
|
|
||||||
self.anim.reinit()
|
self.anim.reinit()
|
||||||
print OK
|
print OK
|
||||||
|
|
||||||
def port_maj(self,ip_list) :
|
def serveurs_maj(self) :
|
||||||
""" Mise à jour des ports pour les ip fournies """
|
self.exception_catcher(self.serveurs_vers_ext)
|
||||||
# Note : système bourrin (on efface les chaines et on refait)
|
|
||||||
# mais rapide et efficace (si qqn veut se casser le cul à
|
|
||||||
# un système aussi délicat que pour la correspondance MAC-IP...)
|
|
||||||
# -- Fred
|
|
||||||
serveur_maj = False
|
|
||||||
adh_maj = False
|
|
||||||
for ip in ip_list :
|
|
||||||
if AddrInNet(ip,self.zone_serveur) :
|
|
||||||
serveur_maj = True
|
|
||||||
else :
|
|
||||||
adh_maj = True
|
|
||||||
if serveur_maj and adh_maj :
|
|
||||||
break
|
|
||||||
to_do=[]
|
|
||||||
if serveur_maj :
|
|
||||||
to_do += [ self.serveurs_vers_ext, self.ext_vers_serveurs ]
|
|
||||||
|
|
||||||
if adh_maj :
|
|
||||||
to_do += [ self.crans_vers_ext, self.ext_vers_crans ]
|
|
||||||
|
|
||||||
for tache in to_do :
|
|
||||||
self.__exception_catcher(tache)
|
|
||||||
|
|
||||||
# envoi d'un mail à roots
|
|
||||||
try :
|
|
||||||
from mail import mail_details
|
|
||||||
machines = []
|
|
||||||
db = crans_ldap()
|
|
||||||
for ip in ip_list :
|
|
||||||
machines += db.search('ipHostNumber=%s' % ip)['machine']
|
|
||||||
mail_details(machines, Subject = 'Modification du firewall de komaz concernant une machine')
|
|
||||||
#mail_details(machines, To = ['quenelle'], Subject = 'Modification du firewall du CR@NS', no_ascii = True)
|
|
||||||
except :
|
|
||||||
pass
|
|
||||||
|
|
||||||
def mac_ip_maj(self,ip_list) :
|
|
||||||
""" Mise à jour de la correspondance MAC-IP pour les ip fournies """
|
|
||||||
## Que faut-il faire ?
|
|
||||||
self.anim = anim(' Analyse travail à effectuer')
|
|
||||||
if ip_list == [''] :
|
|
||||||
print OK + ' (rien à faire)'
|
|
||||||
return
|
|
||||||
|
|
||||||
mac_ip_maj = {}
|
|
||||||
serveur_maj = False
|
|
||||||
for ip in ip_list :
|
|
||||||
machine = crans_ldap().search('ip=%s'% ip)['machine']
|
|
||||||
if not machine :
|
|
||||||
# Destruction des occurences
|
|
||||||
if AddrInNet(ip,self.zone_serveur) :
|
|
||||||
serveur_maj = True
|
|
||||||
else :
|
|
||||||
mac_ip_maj[ip] = None
|
|
||||||
|
|
||||||
elif len(machine) == 1 :
|
|
||||||
# Mise à jour de la machine
|
|
||||||
if AddrInNet(ip,self.zone_serveur) :
|
|
||||||
serveur_maj = True
|
|
||||||
else :
|
|
||||||
# Il faut avoir payé ou être une machine du crans ou un invite
|
|
||||||
if crans_ldap().search('paiement=ok&ip=%s'% ip)['machine'] or \
|
|
||||||
machine[0].proprietaire().__class__ == crans or \
|
|
||||||
machine[0].proprietaire().__class__ == invite :
|
|
||||||
mac_ip_maj[ip] = machine[0]
|
|
||||||
else :
|
|
||||||
mac_ip_maj[ip] = None
|
|
||||||
else :
|
|
||||||
print WARNING
|
|
||||||
if debug :
|
|
||||||
sys.stderr.write("Plusieurs machines avec l'IP %s" % ip)
|
|
||||||
|
|
||||||
print OK
|
|
||||||
|
|
||||||
## Traitement
|
|
||||||
# Seveurs
|
|
||||||
if serveur_maj :
|
|
||||||
# Bourrin mais vu la rapidité...
|
|
||||||
self.__exception_catcher(self.serveurs_vers_ext)
|
|
||||||
|
|
||||||
# Correspondance MAC-IP
|
|
||||||
if mac_ip_maj :
|
|
||||||
def procedure() :
|
|
||||||
warn = ''
|
|
||||||
self.anim = anim(' Actualisation TEST_MAC-IP')
|
|
||||||
for regle in iptables("-t nat -L TEST_MAC-IP -n").split('\n')[2:] :
|
|
||||||
regle = regle.split()
|
|
||||||
ip = regle[3]
|
|
||||||
mac = regle[6].lower()
|
|
||||||
if ip in mac_ip_maj.keys() :
|
|
||||||
# La règle correspond à une ip à mettre à jour
|
|
||||||
machine = mac_ip_maj[ip]
|
|
||||||
try :
|
|
||||||
if not machine :
|
|
||||||
# Il faut détruire cette entrée
|
|
||||||
iptables("-t nat -D TEST_MAC-IP -s %s -m mac --mac-source %s -j ACCEPT" % (ip, mac))
|
|
||||||
else :
|
|
||||||
if ( machine.ipsec() and mac!=self.mac_wifi ) \
|
|
||||||
or ( not machine.ipsec() and mac != machine.mac() ) :
|
|
||||||
# La correspondance MAC-IP est fausse => on ajoute la bonne règle
|
|
||||||
self.__test_mac_ip(machine)
|
|
||||||
# Supression de l'ancienne ligne
|
|
||||||
iptables("-t nat -D TEST_MAC-IP -s %s -m mac --mac-source %s -j ACCEPT" % (ip, mac))
|
|
||||||
|
|
||||||
# Toutes les autres occurences devront être détruites
|
|
||||||
mac_ip_maj[ip]=None
|
|
||||||
|
|
||||||
|
|
||||||
except IptablesError, c :
|
|
||||||
warn += c
|
|
||||||
|
|
||||||
# Ajout des machines qui n'étaient pas dans le firewall
|
|
||||||
for machine in mac_ip_maj.values() :
|
|
||||||
if machine :
|
|
||||||
self.__test_mac_ip(machine)
|
|
||||||
|
|
||||||
if warn :
|
|
||||||
print WARNING
|
|
||||||
sys.stdout.write(warn)
|
|
||||||
else :
|
|
||||||
print OK
|
|
||||||
|
|
||||||
self.__exception_catcher(procedure)
|
|
||||||
|
|
||||||
if __name__ == '__main__' :
|
if __name__ == '__main__' :
|
||||||
# Chaines pouvant être recontruites
|
# Chaines pouvant être recontruites
|
||||||
global chaines
|
global chaines
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue