diff --git a/.gitmodules b/.gitmodules index 94389b4..361b0a1 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,3 +1,3 @@ [submodule "re2oapi"] path = re2oapi - url = https://gitlab.crans.org/nounous/re2o-re2oapi.git + url = https://gitlab.federez.net/re2o/re2oapi.git diff --git a/main.py b/main.py index fc004be..0d145a6 100755 --- a/main.py +++ b/main.py @@ -15,23 +15,19 @@ import argparse import firewall_config -import sys -import os - -path =(os.path.dirname(os.path.abspath(__file__))) - config = ConfigParser() -config.read(path+'/config.ini') +config.read('config.ini') api_hostname = config.get('Re2o', 'hostname') api_password = config.get('Re2o', 'password') api_username = config.get('Re2o', 'username') -api_client = Re2oAPIClient(api_hostname, api_username, api_password, use_tls=False) +api_client = Re2oAPIClient(api_hostname, api_username, api_password) client_hostname = socket.gethostname().split('.', 1)[0] + class iptables: def __init__(self): self.nat4 = "\n*nat" @@ -48,7 +44,6 @@ class iptables: self.role = getattr(firewall_config, 'role', None) self.interfaces_settings = getattr(firewall_config, 'interfaces_type', None) self.nat_settings = getattr(firewall_config, 'nat', None) - self.portail_settings = getattr(firewall_config, 'portail', None) def commit(self, chain): self.add(chain, "COMMIT\n") @@ -334,25 +329,29 @@ class iptables: self.init_filter(subtable, decision="-") self.jump_all_trafic("filter", "FORWARD", subtable, mode='4') - for protocol in self.portail_settings['autorized_hosts']: - for ip, ports in self.portail_settings['autorized_hosts'][protocol].items(): - self.add_in_subtable("filter4", subtable, """-p %s -d %s -m multiport --dports %s -j ACCEPT""" % (protocol, ip, ','.join(ports))) + for ip in self.config.accueil_route.keys(): + if 'tcp' in self.config.accueil_route[ip]: + self.add_in_subtable("filter4", subtable, """-p tcp -d %s -m multiport --dports %s -j ACCEPT""" % (ip, ','.join(self.config.accueil_route[ip]['tcp']))) + if 'udp' in self.config.accueil_route[ip]: + self.add_in_subtable("filter4", subtable, """-p udp -d %s -m multiport --dports %s -j ACCEPT""" % (ip, ','.join(self.config.accueil_route[ip]['udp']))) self.add_in_subtable("filter4", subtable, """-j REJECT""") def capture_connexion_portail(self, subtable="PORTAIL-CAPTIF-REDIRECT"): - """Redirige les connexion 80 et 443 vers l'ip cible""" + """Nat les connexions derrière l'ip de la machine du portail""" self.init_nat(subtable, decision="-") for interface in self.interfaces_settings['routable']: self.jump_traficfrom("nat", interface, "PREROUTING", subtable, mode='4') - for protocol in self.portail_settings['autorized_hosts']: - for ip, ports in self.portail_settings['autorized_hosts'][protocol].items(): - self.add_in_subtable("nat4", subtable, """-p %s -d %s -m multiport --dports %s -j RETURN""" % (protocol, ip, ','.join(ports))) - for ip_range, destination in self.portail_settings['ip_redirect'].items(): - for protocol, ip in destination.items(): - for ip_dest, ports in ip.items(): - self.add_in_subtable("nat4", subtable, """-p %s -s %s -m multiport --dports %s -j DNAT --to %s""" % (protocol, ip_range, ','.join(ports), ip_dest)) + for ip in self.config.accueil_route.keys(): + if 'tcp' in self.config.accueil_route[ip]: + self.add_in_subtable("nat4", subtable, """-p tcp -d %s -m multiport --dports %s -j RETURN""" % (ip, ','.join(self.config.accueil_route[ip]['tcp']))) + if 'udp' in self.config.accueil_route[ip]: + self.add_in_subtable("nat4", subtable, """-p udp -d %s -m multiport --dports %s -j RETURN""" % (ip, ','.join(self.config.accueil_route[ip]['udp']))) + self.add_in_subtable("nat4", subtable, """-p udp -s %(ip)s/16 --dport 53 -j DNAT --to %(ip)s""" % {'ip' :self.config_firewall.portail['accueil']}) + self.add_in_subtable("nat4", subtable, """-p tcp -s %(ip)s/16 --dport 53 -j DNAT --to %(ip)s""" % {'ip' : self.config_firewall.portail['accueil']}) + self.add_in_subtable("nat4", subtable, """-p tcp -s %(ip)s/16 --dport 80 -j DNAT --to %(ip)s""" % {'ip' : self.config_firewall.portail['accueil']}) + self.add_in_subtable("nat4", subtable, """-p tcp -s %(ip)s/16 --dport 80 -j DNAT --to %(ip)s""" % {'ip' : self.config_firewall.portail['isolement']}) def nat_connexion_portail(self, subtable="PORTAIL-CAPTIF-NAT"): """Nat les connexions derrière l'ip de la machine du portail""" @@ -360,9 +359,11 @@ class iptables: for interface in self.interfaces_settings['sortie']: self.jump_traficto("nat", interface, "POSTROUTING", subtable, mode='4') - for protocol in self.portail_settings['autorized_hosts']: - for ip, ports in self.portail_settings['autorized_hosts'][protocol].items(): - self.add_in_subtable("nat4", subtable, """-p %s -d %s -m multiport --dports %s -j MASQUERADE""" % (protocol, ip, ','.join(ports))) + for ip in self.config.accueil_route.keys(): + if 'tcp' in self.config.accueil_route[ip]: + self.add_in_subtable("nat4", subtable, """-p tcp -d %s -m multiport --dports %s -j MASQUERADE""" % (ip, ','.join(self.config.accueil_route[ip]['tcp']))) + if 'udp' in self.config.accueil_route[ip]: + self.add_in_subtable("nat4", subtable, """-p udp -d %s -m multiport --dports %s -j MASQUERADE""" % (ip, ','.join(self.config.accueil_route[ip]['udp']))) def accept_established(self, subtable='ESTABLISHED-CONN'): """Accepte les connexions déjà établies""" @@ -618,7 +619,13 @@ class iptables: """Retire la mac de la blacklist""" self.atomic_del("filter", subtable, """-m mac --mac-source %s -j REJECT""" % mac, mode=mode) -def run(args): + +if __name__ == '__main__': + parser = argparse.ArgumentParser() + parser.add_argument("-v", "--verbose", help="increase output verbosity", action="store_true") + parser.add_argument("-e", "--export", help="export le contenu du parefeu", action="store_true") + parser.add_argument("action", help="Mode reconnus : start, stop ou restart") + args = parser.parse_args() table = iptables() if args.verbose: table.verbose = True @@ -627,21 +634,4 @@ def run(args): table.do_action() -if __name__ == '__main__': - parser = argparse.ArgumentParser() - parser.add_argument("-v", "--verbose", help="increase output verbosity", action="store_true") - parser.add_argument("-e", "--export", help="export le contenu du parefeu", action="store_true") - parser.add_argument("action", help="Mode reconnus : start, stop ou restart", default="restart", nargs="?") - parser.add_argument("--force", help="Force l'action", action="store_true") - args = parser.parse_args() - - if args.force: - run(args) - - for service in api_client.list("services/regen/"): - if service['hostname'] == client_hostname and \ - service['service_name'] == 'firewall' and \ - service['need_regen']: - run(args) - api_client.patch(service['api_url'], data={'need_regen': False})