crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[ipt,firewall6,firewall_new] Mise à jour du blocage des tracker torrent udp, les port 445 et 135 sont retirer du trigger VIRUS (mais toujours bloqués)

Browse source 
Ignore-this: ea68ea4670ec109a2575a243c2e89ca6

darcs-hash:20121209172425-3a55a-3fb45d35a11fc552e0c1e786d181334272913123.gz
This commit is contained in:
Valentin Samir 2012-12-09 18:24:25 +01:00
parent 8661234205
commit f8332851b4
3 changed files with 37 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

21
gestion/gen_confs/firewall_new.py
View file

@ -40,6 +40,7 @@ from iptools import AddrInNet, NetSubnets, IpSubnet
from config import NETs, mac_komaz, mac_wifi, mac_titanic, mac_g, conf_fw, p2p, vlans, debit_max_radin, adm_users, accueil_route, blacklist_sanctions, blacklist_sanctions_soft, periode_transitoire
from ipset import IpsetError, Ipset
from lc_ldap import lc_ldap
from ipt import gethostbyname
syslog.openlog('firewall')
debug = 1
@ -455,7 +456,8 @@ class firewall_komaz(firewall_crans) :
'udp_CRANS_VERS_EXT': [ ':136','140:'] }
ports_virus = { 'tcp' : [ 135, 445 ] , 'udp' : [] }
# on retire 445 et 135 en tcp car plein de mac se font deconnecter
ports_virus = { 'tcp' : [ ] , 'udp' : [] }
# Filtrage du peer to peer
# Apple et WinMX desactives car possibilite de fausse detection par ipp2p
@ -473,10 +475,12 @@ class firewall_komaz(firewall_crans) :
]
udp_torrent_tracker={
'tracker.openbittorrent.com':[['95.215.62.26',80],['95.215.62.5',80]],
'tracker.ccc.de':[['195.54.164.83',80]],
'tracker.istole.it':[['192.121.121.30',80]],
'tracker.publicbt.com':[['95.211.88.54',80],['95.211.88.49',80],['95.211.88.51',80]],
'tracker.openbittorrent.com':gethostbyname('tracker.openbittorrent.com')[0],
'tracker.ccc.de':gethostbyname('tracker.ccc.de')[0],
'tracker.istole.it':gethostbyname('tracker.istole.it')[0],
'tracker.publicbt.com':gethostbyname('tracker.publicbt.com')[0],
'tracker.1337x.org':gethostbyname('tracker.1337x.org')[0],
'fr33domtracker.h33t.com':gethostbyname('fr33domtracker.h33t.com')[0],
}
@ -1188,9 +1192,10 @@ class firewall_komaz(firewall_crans) :
iptables('-A FILTRE_P2P -m ipp2p --%s -j REJECT --reject-with icmp-admin-prohibited' % filtre[0])
self.anim.cycle()
#on rejetes les trackeur udp les plus connus
for tracker in self.udp_torrent_tracker.values():
for dest in tracker:
iptables('-A FILTRE_P2P -p udp -d %s --dport %s -j REJECT --reject-with icmp-admin-prohibited' % (dest[0],dest[1]))
for tracker in self.udp_torrent_tracker.keys():
for dest in self.udp_torrent_tracker[tracker]:
iptables('-A FILTRE_P2P -p udp -d %s -j LOG --log-level notice --log-prefix "TRACKER:%s "' % (dest,(tracker[:20]) if len(tracker) > 20 else tracker))
iptables('-A FILTRE_P2P -p udp -d %s -j REJECT --reject-with icmp-admin-prohibited' % dest)
#On log les requetes a des trackers torrents puis on les rejetes
iptables("-A TRACKER_FILTER -m string --algo kmp ! --string \"info_hash=\" -j ACCEPT")