crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

qqs bogues

Browse source 
darcs-hash:20041027205259-1d643-55dc5294ff20076f2f6decf8c96f7234cfc9f6fa.gz
This commit is contained in:
sabban 2004-10-27 22:52:59 +02:00
parent 76bf5f8ab8
commit e7d67dca37
1 changed files with 33 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

59
gestion/classe_firewall.py
View file

@ -87,11 +87,11 @@ class firewall:
""" """
for proto in ["tcp","udp"]: for proto in ["tcp","udp"]:
for i in range(len(config.port_default["%s_input" % proto])): for i in range(len(config.port_default["%s_input" % proto])):
test("iptables -A DEFAULT_INPUT -p %s --dport "%proto+\ os.system("iptables -A DEFAULT_INPUT -p %s --dport "%proto+\
config.port_default["%s_input" % proto][i]+\ config.port_default["%s_input" % proto][i]+\
" -j ACCEPT") " -j ACCEPT")
for i in range(len(config.port_default["%s_output" % proto])): for i in range(len(config.port_default["%s_output" % proto])):
test("iptables -A DEFAULT_OUTPUT -p %s --sport "%proto+\ os.system("iptables -A DEFAULT_OUTPUT -p %s --sport "%proto+\
config.port_default["%s_output" % proto][i]+\ config.port_default["%s_output" % proto][i]+\
" -j ACCEPT") " -j ACCEPT")
@ -99,7 +99,7 @@ class firewall:
def del_entree(self,ip): def del_entree(self,ip):
""" """
Détruit une entrée dans le firewall Détruit une entrée dans le firewall
Note: Il faut *tester lourdement* cette fonction. Note: Il faut *os.systemer lourdement* cette fonction.
""" """
try: try:
os.system("iptables -L -n > /tmp/firewall") os.system("iptables -L -n > /tmp/firewall")
@ -115,7 +115,8 @@ class firewall:
chaine=tmp[1] chaine=tmp[1]
count=0 count=0
if ip in line: if ip in line:
test("iptables -D %i %s"%(count,chaine)) os.system("iptables -D %s %i"%(chaine,count))
count=count-1
os.system("rm -f /tmp/firewall") os.system("rm -f /tmp/firewall")
def paire_macip(self,ip,mac): def paire_macip(self,ip,mac):
@ -135,18 +136,22 @@ class firewall:
for i in range(0,len(search)): for i in range(0,len(search)):
self.paire_macip(search[i].ip(),search[i].mac()) self.paire_macip(search[i].ip(),search[i].mac())
barre.cycle() barre.cycle()
barre.reinit()
print OK
search=db.search('host=*.wifi.crans.org')['machine'] search=db.search('host=*.wifi.crans.org')['machine']
barre=anim("Filtrage mac-ip des machines wifi.",len(search)) barre=anim("Filtrage mac-ip des machines wifi.",len(search))
for i in range(0,len(search)): for i in range(0,len(search)):
self.paire_macip(search[i].ip(),'00:0c:f1:fa:f1:4b') self.paire_macip(search[i].ip(),'00:0c:f1:fa:f1:4b')
barre.cycle() barre.cycle()
barre.reinit()
print OK
os.system("iptables -t nat -A PREROUTING -i %s -s \\!"%int_crans+\ os.system("iptables -t nat -A PREROUTING -i %s -s \\!"%int_crans+\
" 138.231.136.0/21 -j ACCEPT") " 138.231.136.0/21 -j ACCEPT")
os.system("iptables -t nat -A PREROUTING -i %s -s \\!"%int_crans+\ os.system("iptables -t nat -A PREROUTING -i %s -s \\!"%int_crans+\
" 138.231.148.0/22 -j ACCEPT") " 138.231.148.0/22 -j ACCEPT")
for i in reseaux_non_routables: for i in reseaux_non_routables:
os.system("iptables -t nat -A PREROUTING -i %s -s %s"%(int_crans,i)+\ os.system("iptables -t nat -A PREROUTING -i %s -s %s"%(int_crans,i)+\
" -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\ " -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\
" -j LOG --log-level %s --log-prefix %s"%\ " -j LOG --log-level %s --log-prefix %s"%\
@ -159,18 +164,18 @@ class firewall:
(loglevel,logprefix_macip)) (loglevel,logprefix_macip))
os.system("iptables -t nat -A PREROUTING -i %s -d %s -j DROP"%\ os.system("iptables -t nat -A PREROUTING -i %s -d %s -j DROP"%\
(int_crans,i)) (int_crans,i))
test("iptables -t nat -A PREROUTING -i %s -p tcp "%int_crans+\ os.system("iptables -t nat -A PREROUTING -i %s -p tcp "%int_crans+\
" -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\ " -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\
" -j LOG --log-level %s --log-prefix %s"%\ " -j LOG --log-level %s --log-prefix %s"%\
(loglevel,logprefix_macip)) (loglevel,logprefix_macip))
test("iptables -t nat -A PREROUTING -i %s -p tcp"%int_crans+\ os.system("iptables -t nat -A PREROUTING -i %s -p tcp"%int_crans+\
" -j REJECT --reject-with tcp-reset") " -j DROP")
test("iptables -t nat -A PREROUTING -i %s -p udp"%int_crans+\ os.system("iptables -t nat -A PREROUTING -i %s -p udp"%int_crans+\
" -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\ " -m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\
" -j LOG --log-level %s --log-prefix %s"%\ " -j LOG --log-level %s --log-prefix %s"%\
(loglevel,logprefix_macip)) (loglevel,logprefix_macip))
test("iptables -t nat -A PREROUTING -i %s -p udp"%int_crans+\ os.system("iptables -t nat -A PREROUTING -i %s -p udp"%int_crans+\
" -j REJECT --reject-with icmp-port-unreachable") " -j DROP")
def komaz(self): def komaz(self):
""" """
@ -244,19 +249,19 @@ class firewall:
else: else:
blacklist+=entite.machines() blacklist+=entite.machines()
for instance_machine in blacklist: for instance_machine in blacklist:
test("iptables -A BLACKLIST_INPUT -d %s"%\ os.system("iptables -A BLACKLIST_INPUT -d %s"%\
instance_machine.ip().encode("iso-8859-15")+\ instance_machine.ip().encode("iso-8859-15")+\
"-m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\ "-m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\
"-j LOG --log-level %s --log-prefix_macip %s"%\ " -j LOG --log-level %s --log-prefix_macip %s"%\
(loglevel,logprefix_blacklist)) (loglevel,logprefix_blacklist))
test("iptables -A BLACKLIST_INPUT -d %s -j REJECT"%\ os.system("iptables -A BLACKLIST_INPUT -d %s -j REJECT"%\
instance_machine.ip()) instance_machine.ip())
test("iptables -A BLACKLIST_OUTPUT -s %s"%\ os.system("iptables -A BLACKLIST_OUTPUT -s %s"%\
instance_machine.ip().encode("iso-8859-15")+\ instance_machine.ip().encode("iso-8859-15")+\
"-m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\ "-m limit --limit %s --limit-burst %s"%(loglimit,logburst)+\
"-j LOG --log-level %s --log-prefix_macip %s"%\ " -j LOG --log-level %s --log-prefix_macip %s"%\
(loglevel,logprefix_blacklist)) (loglevel,logprefix_blacklist))
test("iptables -A BLACKLIST_OUTPUT -s %s -j REJECT"%\ os.system("iptables -A BLACKLIST_OUTPUT -s %s -j REJECT"%\
instance_machine.ip()) instance_machine.ip())
os.system("iptables -A BLACKLIST_INPUT -j DEFAULT_INPUT") os.system("iptables -A BLACKLIST_INPUT -j DEFAULT_INPUT")
os.system("iptables -A BLACKLIST_OUTPUT -j DEFAULT_OUTPUT") os.system("iptables -A BLACKLIST_OUTPUT -j DEFAULT_OUTPUT")
@ -289,9 +294,9 @@ class firewall:
"%s -j ACCEPT"%limite_connexion) "%s -j ACCEPT"%limite_connexion)
os.system("iptables -A ADHERENTS_OUTPUT -m state --state "+\ os.system("iptables -A ADHERENTS_OUTPUT -m state --state "+\
"ESTABLISHED -m limit --limit-burst "+\ "ESTABLISHED -m limit --limit-burst "+\
"%s-j ACCEPT"%limite_connexion) "%s -j ACCEPT"%limite_connexion)
test("iptables -A DEFAULT_INPUT -j ADHERENTS_INPUT") os.system("iptables -A DEFAULT_INPUT -j ADHERENTS_INPUT")
test("iptables -A DEFAULT_OUTPUT -j ADHERENTS_OUTPUT") os.system("iptables -A DEFAULT_OUTPUT -j ADHERENTS_OUTPUT")
db=crans_ldap() db=crans_ldap()
search=db.search('host=*.crans.org & portTCPin=*')['machine'] search=db.search('host=*.crans.org & portTCPin=*')['machine']
@ -332,7 +337,7 @@ class firewall:
def adherent(self,ip): def adherent(self,ip):
""" """
Gère complètement l'ajout d'un adhérent dans le firewall Gère complètement l'ajout d'un adhérent dans le firewall
Tester la blacklist os.systemer la blacklist
""" """
db=crans_ldap() db=crans_ldap()
search=db.search('ip='+ip)['machine'] search=db.search('ip='+ip)['machine']
@ -344,31 +349,31 @@ class firewall:
wifi=False wifi=False
while (i<len(config.NETs['wifi'])): while (i<len(config.NETs['wifi'])):
if (iptools.AddrInNet(ip,config.NETs['all'][i])): if (iptools.AddrInNet(ip,config.NETs['all'][i])):
test("iptables -I PREROUTING 1 -s %s --mac-source "%ip+\ os.system("iptables -I PREROUTING -s %s -m mac --mac-source "%ip+\
"%s -j ACCEPT"%config.mac_wifi) "%s -j ACCEPT"%config.mac_wifi)
wifi=True wifi=True
i=i+1 i=i+1
if (not wifi): if (not wifi):
test("iptables -I PREROUTING 1 -s %s --mac-source %s -j ACCEPT"%\ os.system("iptables -I PREROUTING -s %s -m mac --mac-source %s -j ACCEPT"%\
(ip,search[0].mac())) (ip,search[0].mac()))
if search[0].portTCPin()!='': if search[0].portTCPin()!='':
ports=search[0].portTCPin() ports=search[0].portTCPin()
for j in ports.split(' '): for j in ports.split(' '):
test("iptables -I ADHERENTS_INPUT 1 -d %s"%ip+\ os.system("iptables -I ADHERENTS_INPUT -d %s"%ip+\
" -p tcp --dport %s -j ACCEPT"%j) " -p tcp --dport %s -j ACCEPT"%j)
if search[0].portTCPout()!='': if search[0].portTCPout()!='':
ports=search[0].portTCPout() ports=search[0].portTCPout()
for j in ports.split(' '): for j in ports.split(' '):
test("iptables -I ADHERENTS_OUTPUT 1 -d %s"%ip+\ os.system("iptables -I ADHERENTS_OUTPUT -d %s"%ip+\
" -p tcp --dport %s -j ACCEPT"%j) " -p tcp --dport %s -j ACCEPT"%j)
if search[0].portUDPin()!='': if search[0].portUDPin()!='':
ports=search[0].portUDPin() ports=search[0].portUDPin()
for j in ports.split(' '): for j in ports.split(' '):
test("iptables -I ADHERENTS_INPUT 1 -d %s"%ip+\ os.system("iptables -I ADHERENTS_INPUT -d %s"%ip+\
" -p udp --dport %s -j ACCEPT"%j) " -p udp --dport %s -j ACCEPT"%j)
if search[0].portUDPout()!='': if search[0].portUDPout()!='':
ports=search[0].portUDPout() ports=search[0].portUDPout()
for j in ports.split(' '): for j in ports.split(' '):
test("iptables -I ADHERENTS_OUTPUT 1 -d %s"%ip+\ os.system("iptables -I ADHERENTS_OUTPUT -d %s"%ip+\
" -p udp --dport %s -j ACCEPT"%j) " -p udp --dport %s -j ACCEPT"%j)