357 lines
13 KiB
Python
Executable file
357 lines
13 KiB
Python
Executable file
#!/usr/bin/env python
|
|
# -*- coding: iso-8859-1 -*-
|
|
# The author of this code is Manuel Sabban <manu@feyd-rautha.org>
|
|
#
|
|
# Copyright (c) 2004 Manuel Sabban.
|
|
#
|
|
# Permission to use, copy, and modify this software with or without fee
|
|
# is hereby granted, provided that this entire notice is included in
|
|
# all source code copies of any software which is or includes a copy or
|
|
# modification of this software.
|
|
#
|
|
# THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
|
|
# IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
|
|
# REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
|
|
# MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
|
|
# PURPOSE.
|
|
""" classe Firewall de Komaz """
|
|
import commands,time, syslog
|
|
import iptools,config
|
|
from ldap_crans import crans_ldap
|
|
from affich_tools import *
|
|
|
|
class ErrorArgument(Exception):
|
|
"""
|
|
User defined exception
|
|
Erreur sur les arguments d'appel du firewall
|
|
"""
|
|
pass
|
|
|
|
class ErrorIp(Exception):
|
|
"""
|
|
User defined exception
|
|
Erreur dans les fonctions Ips
|
|
"""
|
|
def __init__(self, ip):
|
|
self.ip=ip
|
|
|
|
class ErrorMoreThanOneIp(ErrorIp):
|
|
"""
|
|
User defined exception
|
|
Au moins deux utilisateurs ont la même ip
|
|
"""
|
|
pass
|
|
|
|
class ErrorIptables(Exception):
|
|
"""
|
|
User defined exception
|
|
Les erreurs d'iptables
|
|
"""
|
|
def __init__(self,cmd,err_code,output):
|
|
self.cmd=cmd
|
|
self.err_code=err_code
|
|
self.output=output
|
|
openlog(ident='syslog',logopt=0,facility=' LOG_USER')
|
|
syslog('LOG_ALERT',cmd,err,output)
|
|
|
|
def iptables(self,cmd):
|
|
status,output=getstatusoutput("/sbin/iptables "+cmd)
|
|
if status:
|
|
raise IptablesError(cmd,status,output)
|
|
self.file_log.write(time.time+": "+cmd)
|
|
return output
|
|
|
|
|
|
class ErrorNoSuchIp(ErrorIp):
|
|
"""
|
|
User defined exception
|
|
Personne n'a cette ip
|
|
"""
|
|
pass
|
|
|
|
class firewall:
|
|
"""
|
|
Structure du firewall :
|
|
table nat :
|
|
PREROUTING (policy par defaut : DROP)
|
|
1) passage par TEST_VIRUS
|
|
2) passage dans RESEAUX_NON_ROUTABLES_DST
|
|
3) passage est paquets venant de l'extérieur dans RESEAUX_NON_ROUTABLES_SRC
|
|
4) on laisse passer vers filter les paquets suivants :
|
|
source ou destination les serveurs de serveurs_crans
|
|
ce qui vient de l'extérieur
|
|
7) passage par TEST_MAC-IP_FLOOD
|
|
8) passage par TEST_FLOOD
|
|
|
|
TEST_VIRUS droppe les paquets contenant des virus
|
|
RESEAUX_NON_ROUTABLES_DST droppe les paquets dont la destination est non routable
|
|
RESEAUX_NON_ROUTABLES_SRC droppe les paquets dont la source est non routable
|
|
TEST_MAC-IP_FLOOD envoi les bon paquets vers CRANS_VERS_EXT
|
|
CRANS_VERS_EXT
|
|
ACCEPT pour les paquets venant des machines du crans (test port-ip)
|
|
REJECT pour le reste
|
|
TEST_FLOOD log puis drop des paquests avec bonne mac-ip (donc les floods)
|
|
|
|
table filter :
|
|
FORWARD (policy par defaut : ACCEPT)
|
|
1) passage par BLACKLIST
|
|
2) ce qui a pour source les serveurs de serveurs_crans est dirigé vers SERVEURS_VERS_EXT
|
|
3) ce qui a pour destination les serveurs de serveurs_crans est dirigé EXT_VERS_SERVEURS
|
|
4) tout ce qui vient de l'interface externe est dirigé vers EXT_VERS_CRANS
|
|
5) ce qui a pour source les serveurs de serveurs_crans est dirigé vers EXT_VERS_CRANS
|
|
|
|
BLACKLIST fitre des ip blacklistées (reject)
|
|
EXT_VERS_CRANS
|
|
ACCEPT pour les paquets vers les machines du crans (test port-ip)
|
|
REJECT pour le reste
|
|
EXT_VERS_SERVEURS et SERVEURS_VERS_EXT
|
|
ACCEPT pour bon mac-ip-port
|
|
REJECT pour le reste
|
|
"""
|
|
zone_serveur="138.231.136.0/28"
|
|
eth_ext = "eth2"
|
|
ports_default = { 'tcp_input' : ['22','1024:'],
|
|
'tcp_output': [':79','81:134','136','140:444','446:'],
|
|
'udp_input' : [''],
|
|
'udp_output': [':136','140:'] }
|
|
mac_wifi = '00:0c:f1:fa:f1:4b'
|
|
|
|
limit = " -m limit --limit 10/s --limit-burst 10 "
|
|
log_template = '-m limit --limit 1/s --limit-burst 1 -j LOG --log-level notice --log-prefix '
|
|
|
|
reseaux_non_routables = [ '1.0.0.0/8','2.0.0.0/8','5.0.0.0/8','7.0.0.0/8',\
|
|
'10.0.0.0/8','14.0.0.0/8','23.0.0.0/8','27.0.0.0/8','31.0.0.0/8','36.0.0.0/8',\
|
|
'37.0.0.0/8','39.0.0.0/8','41.0.0.0/8','42.0.0.0/8','71.0.0.0/8','72.0.0.0/8',\
|
|
'73.0.0.0/8','74.0.0.0/8','75.0.0.0/8','76.0.0.0/8','77.0.0.0/8','78.0.0.0/8',\
|
|
'79.0.0.0/8','89.0.0.0/8','90.0.0.0/8','91.0.0.0/8','92.0.0.0/8','93.0.0.0/8',\
|
|
'94.0.0.0/8','95.0.0.0/8','96.0.0.0/8','97.0.0.0/8','98.0.0.0/8','99.0.0.0/8',\
|
|
'100.0.0.0/8','101.0.0.0/8','102.0.0.0/8','103.0.0.0/8','104.0.0.0/8',\
|
|
'105.0.0.0/8','106.0.0.0/8','107.0.0.0/8','108.0.0.0/8','109.0.0.0/8',\
|
|
'110.0.0.0/8','111.0.0.0/8','112.0.0.0/8','113.0.0.0/8','114.0.0.0/8',\
|
|
'115.0.0.0/8','116.0.0.0/8','117.0.0.0/8','118.0.0.0/8','119.0.0.0/8',\
|
|
'120.0.0.0/8','121.0.0.0/8','122.0.0.0/8','123.0.0.0/8','124.0.0.0/8',\
|
|
'125.0.0.0/8','126.0.0.0/8','127.0.0.0/8','169.254.0.0/16','172.16.0.0/12',\
|
|
'173.0.0.0/8','174.0.0.0/8','175.0.0.0/8','176.0.0.0/8','177.0.0.0/8',\
|
|
'178.0.0.0/8','179.0.0.0/8','180.0.0.0/8','181.0.0.0/8','182.0.0.0/8',\
|
|
'183.0.0.0/8','184.0.0.0/8','185.0.0.0/8','186.0.0.0/8','187.0.0.0/8',\
|
|
'189.0.0.0/8','190.0.0.0/8','192.168.0.0/16','197.0.0.0/8','223.0.0.0/8',\
|
|
'224.0.0.0/4','240.0.0.0/4']
|
|
|
|
ports_virus = { 'tcp' : [ 135, 445 ] , 'udp' : [] }
|
|
|
|
def __init__(self):
|
|
self.db = crans_ldap()
|
|
self.file_log=open("/var/log/fw.log","a")
|
|
|
|
def __del__(self):
|
|
self.file_log.close()
|
|
|
|
def start(self) :
|
|
""" Construction du firewall """
|
|
# On commence sur de bonnes bases
|
|
self.stop()
|
|
|
|
cprint('Démarrage firewall','gras')
|
|
|
|
anim('\tConstruction structure de la table nat')
|
|
for chaine in [ 'TEST_VIRUS' , 'TESTS_MAC-IP_FLOOD' , 'RESEAUX_NON_ROUTABLES_SRC', 'RESEAUX_NON_ROUTABLES_DST', 'TEST_FLOOD'] :
|
|
iptables('-t nat -N %s' % chaine)
|
|
|
|
iptables("-t nat -P PREROUTING ACCEPT")
|
|
iptables("-t nat -i lo -j ACCEPT")
|
|
iptables("-t nat -A PREROUTING -j TEST_VIRUS")
|
|
iptables("-t nat -A PREROUTING -j RESEAUX_NON_ROUTABLES_DST")
|
|
iptables("-t nat -A PREROUTING -i %s -j RESEAUX_NON_ROUTABLES_SRC" % self.eth_ext )
|
|
iptables("-t nat -A PREROUTING -d %s -j ACCEPT" % self.zone_serveur )
|
|
iptables("-t nat -A PREROUTING -s %s -j ACCEPT" % self.zone_serveur )
|
|
iptables("-t nat -A PREROUTING -i %s -j ACCPET" % self.eth_ext )
|
|
iptables("-t nat -A PREROUTING -j TESTS_MAC-IP_FLOOD")
|
|
print OK
|
|
|
|
anim('\tConstruction structure de la table filter')
|
|
for chaine in [ 'EXT_VERS_SERVEURS', 'SERVEURS_VERS_EXT' , 'EXT_VERS_CRANS', 'CRANS_VERS_EXT', 'BLACKLIST_SRC', 'BLACKLIST_DST' ] :
|
|
iptables('-N %s' % chaine)
|
|
|
|
iptables("-A FORWARD -i %s -j BLACKLIST_DST" % self.eth_ext )
|
|
iptables("-A FORWARD -o %s -j BLACKLIST_SRC" % self.eth_ext )
|
|
iptables("-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT")
|
|
iptables("-A FORWARD -i %s -d %s -j EXT_VERS_SERVEURS" % (self.eth_ext, proto, self.zone_serveur) )
|
|
iptables("-A FORWARD -o %s -s %s -j SERVEURS_VERS_EXT" % (self.eth_ext, proto, self.zone_serveur) )
|
|
iptables("-A FORWARD -i %s -j EXT_VERS_CRANS" % self.eth_ext )
|
|
iptables("-A FORWARD -o %s -j CRANS_VERS_EXT" % self.eth_ext )
|
|
print OK
|
|
|
|
self.log_chaines()
|
|
self.test_virus()
|
|
self.reseaux_non_routables()
|
|
self.blacklist()
|
|
|
|
for machine in self.db.search('ip=*')['machine'] :
|
|
add_machine(machine)
|
|
|
|
# Opérations finales
|
|
anim('\tFinalisation')
|
|
for chaine in [ 'EXT_VERS_SERVEURS', 'SERVEURS_VERS_EXT' , 'EXT_VERS_CRANS' , 'CRANS_VERS_EXT'] :
|
|
iptables('-A %s -j REJECT' % chaine)
|
|
print OK
|
|
|
|
def log_chaines(self) :
|
|
""" Construction des chaines de log (LOG_VIRUS et LOG_FLOOD) """
|
|
self.anim = anim('\tCréation des chaines de log',len(self.reseaux_non_routables))
|
|
for filtre in [ 'VIRUS', 'FLOOD' ] :
|
|
# Vidage de la chaîne
|
|
iptables('-F LOG_%s' % filtre)
|
|
iptables('-t nat -A LOG_%s %s %s:' % (filtre, self.log_template, filtre.capitalize()) )
|
|
iptables('-t nat -A LOG_%s -j DROP' % filtre )
|
|
self.anim.cycle()
|
|
print OK
|
|
|
|
def reseaux_non_routables(self) :
|
|
""" Construction de RESEAUX_NON_ROUTABLES_{DST,SRC} """
|
|
self.anim = anim('\tFiltrage ip non routables',len(self.reseaux_non_routables))
|
|
for reseau in self.reseaux_non_routables :
|
|
iptables("-t nat -A RESEAUX_NON_ROUTABLES_DST -d %s -j DROP" % reseau)
|
|
iptables("-t nat -A RESEAUX_NON_ROUTABLES_SRC -s %s -j DROP" % reseau)
|
|
self.anim.cycle()
|
|
self.anim.reinit()
|
|
print OK
|
|
|
|
def test_virus(self) :
|
|
""" Construction de la chaîne TEST_VIRUS """
|
|
iptables('-t nat -F TEST_VIRUS')
|
|
self.anim = anim('\tFiltrage virus',len(self.ports_virus.keys()))
|
|
for proto, ports in self.ports_virus.items() :
|
|
iptables('-t nat -A TEST_VIRUS -p %s --dport %s -j LOG_VIRUS' % (proto, port) )
|
|
self.anim.cycle()
|
|
self.anim.reinit()
|
|
print OK
|
|
|
|
def stop(self):
|
|
"""
|
|
Arrête le firewall
|
|
Pas d'arguments
|
|
"""
|
|
print "Arrêt du firewall"
|
|
iptables("iptables -F")
|
|
iptables("iptables -t nat -F")
|
|
iptables("iptables -X")
|
|
|
|
def add_machine(self,machine):
|
|
self.__test_mac_ip_flood(machine)
|
|
self.__test_flood(machine)
|
|
self.__serveurs_vers_ext(machine)
|
|
self.__ext_vers_serveurs(machine)
|
|
self.__crans_vers_ext(machine)
|
|
self.__ext_vers_crans(machine)
|
|
|
|
def __serveurs_vers_ext(self,machine):
|
|
ip=machine.ip()
|
|
if AddrInNet(ip,self.zone_serveur):
|
|
for i in machine.portTCPout().split():
|
|
iptables("-t filter -A SERVEURS_VERS_EXT -d "+\
|
|
"%s -p tcp --dport %s -j ACCEPT"\
|
|
%(ip,i))
|
|
for i in machine.portUDPout().split():
|
|
iptables("-t filter -A SERVEURS_VERS_EXT-d "+\
|
|
"%s -p udp --dport %s -j ACCEPT"\
|
|
%(ip,i))
|
|
|
|
def __ext_vers_serveurs(self,machine):
|
|
ip=machine.ip()
|
|
if AddrInNet(ip,self.zone_serveur):
|
|
for i in machine.portTCPin().split():
|
|
iptables("-t filter -I EXT_VERS_SERVEURS "+\
|
|
"-s %s -p tcp --dport %s -j ACCEPT"\
|
|
%(ip,i))
|
|
for i in machine.portUDPin().split():
|
|
iptables("-t filter -I EXT_VERS_SERVEURS "+\
|
|
"-s %s -p udp --dport %s -j ACCEPT"\
|
|
%(ip,i))
|
|
|
|
def __crans_vers_ext(self,machine):
|
|
ip=machine.ip()
|
|
if AddrInNet(ip,self.zone_serveur):
|
|
return
|
|
|
|
ports = { 'tcp' : machine.portTCPin(),
|
|
'udp' : machine.portUDPin() }
|
|
|
|
for proto in [ 'tcp', 'udp' ] :
|
|
for port in ports[proto] + self.ports_default["%s_input" % proto ] :
|
|
iptables("-I CRANS_VERS_EXT -s %s -p %s --dport %s -j ACCEPT" \
|
|
%(ip,proto,port))
|
|
|
|
def __ext_vers_crans(self,machine):
|
|
ip=machine.ip()
|
|
if AddrInNet(ip,self.zone_serveur):
|
|
return
|
|
|
|
ports = { 'tcp' : machine.portTCPout(),
|
|
'udp' : machine.portUDPout() }
|
|
|
|
for proto in [ 'tcp', 'udp' ] :
|
|
for port in ports[proto] + self.ports_default["%s_output" % proto ] :
|
|
iptables("-I EXT_VERS_CRANS -d %s -p %s --dport %s -j ACCEPT" \
|
|
%(ip,proto,port))
|
|
|
|
def __test_mac_ip_flood(machine):
|
|
ip=machine.ip()
|
|
mac=machine.mac()
|
|
if machine.ipsec():
|
|
iptables("-t nat -A PREROUTING -s "+\
|
|
"%s -m mac --mac-source %s %s -j ACCEPT"%(ip,self.mac_wifi,self.limit))
|
|
else:
|
|
iptables("-t nat -A PREROUTING -s "+\
|
|
"%s -m mac --mac-source %s %s -j ACCEPT"%(ip,mac,self.limit))
|
|
|
|
|
|
def __test_flood(machine):
|
|
ip=machine.ip()
|
|
mac=machine.mac()
|
|
if machine.ipsec():
|
|
iptables("-t nat -A PREROUTING -s "+\
|
|
"%s -m mac --mac-source %s -j LOG_FLOOD"%(ip,self.mac_wifi))
|
|
else:
|
|
iptables("-t nat -A PREROUTING -s "+\
|
|
"%s -m mac --mac-source %s -j LOG_FLOOD"%(ip,mac))
|
|
|
|
def blacklist(self):
|
|
""" Construit les chaines de blackliste (BLACKLIST_{DST,SRC}) """
|
|
anim("\tContruction blacklist")
|
|
iptables('-F BLACKLIST_DST')
|
|
iptables('-F BLACKLIST_SRC')
|
|
|
|
blacklist=[]
|
|
search=self.db.search('blacklist=*&paiement=%s'%ann_scol)
|
|
for entite in search['adherent']+search['club']+search['machine']:
|
|
sanctions = entite.blacklist_actif()
|
|
if 'upload' in sanctions or 'warez' in sanctions :
|
|
if search.__class__==machine:
|
|
blacklist+=[entite]
|
|
else:
|
|
blacklist+=entite.machines()
|
|
|
|
for machine in blacklist:
|
|
iptables("-A BLACKLIST_DST -d %s -j REJECT" % machine.ip())
|
|
iptables("-A BLACKLIST_SRC -s %s -j REJECT" % machine.ip())
|
|
|
|
print OK
|
|
|
|
def del_entree(self,ip):
|
|
""" Détruit toutes les occurences à l'IP dans le firewall """
|
|
for table in [ 'filter' , 'nat' ] :
|
|
for chaine in iptables("-t %s -L -n --line-numbers" % table).split('Chain ') :
|
|
nom_chaine = chaine.split(' ',1)[0]
|
|
to_del=[]
|
|
for regle in chaine.split('\n')[1:] :
|
|
# On regarde les règles une à une
|
|
regle = regle.split()
|
|
if ip in regle :
|
|
# Règle à dértuire
|
|
to_del.append(int(regle[0]))
|
|
# Destruction des règles de cette chaîne
|
|
to_del.sort()
|
|
to_del.reverse()
|
|
for i in to_del :
|
|
iptables('-t %s -D %s %s' % (table, nom_chaine, i) )
|
|
|