models.py 38 KB
Newer Older
1
# -*- coding: utf-8 -*-
2

3
from itertools import islice, ifilter
4
import logging
5
from netaddr import IPSet, EUI
6

7 8
from django.contrib.auth.models import User
from django.db import models
9
from django.forms import ValidationError
10
from django.utils.translation import ugettext_lazy as _
11
from firewall.fields import (MACAddressField, val_alfanum, val_reverse_domain,
12 13 14
                             val_ipv6_template, val_domain, val_ipv4,
                             val_ipv6, val_mx, convert_ipv4_to_ipv6,
                             IPNetworkField, IPAddressField)
15 16
from django.core.validators import MinValueValidator, MaxValueValidator
import django.conf
17
from django.db.models.signals import post_save, post_delete
18 19
import random

Bach Dániel committed
20
from firewall.tasks.local_tasks import reloadtask
21
from acl.models import AclBase
22
logger = logging.getLogger(__name__)
23
settings = django.conf.settings.FIREWALL_SETTINGS
24 25


26 27
class Rule(models.Model):

28 29 30
    """
    A rule of a packet filter, changing the behavior of a host, vlan or
    firewall.
31

32 33
    Some rules accept or deny packets matching some criteria.
    Others set address translation or other free-form iptables parameters.
34 35
    """
    CHOICES_type = (('host', 'host'), ('firewall', 'firewall'),
36
                   ('vlan', 'vlan'))
37 38 39 40
    CHOICES_proto = (('tcp', 'tcp'), ('udp', 'udp'), ('icmp', 'icmp'))
    CHOICES_dir = (('0', 'out'), ('1', 'in'))

    direction = models.CharField(max_length=1, choices=CHOICES_dir,
41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59
                                 blank=False, verbose_name=_("direction"),
                                 help_text=_("If the rule matches egress "
                                             "or ingress packets."))
    description = models.TextField(blank=True, verbose_name=_('description'),
                                   help_text=_("Why is the rule needed, "
                                               "or how does it work."))
    foreign_network = models.ForeignKey(
        'VlanGroup', verbose_name=_("foreign network"),
        help_text=_("The group of vlans the matching packet goes to "
                    "(direction out) or from (in)."),
        related_name="ForeignRules")
    dport = models.IntegerField(
        blank=True, null=True, verbose_name=_("dest. port"),
        validators=[MinValueValidator(1), MaxValueValidator(65535)],
        help_text=_("Destination port number of packets that match."))
    sport = models.IntegerField(
        blank=True, null=True, verbose_name=_("source port"),
        validators=[MinValueValidator(1), MaxValueValidator(65535)],
        help_text=_("Source port number of packets that match."))
60
    proto = models.CharField(max_length=10, choices=CHOICES_proto,
61 62 63 64 65 66 67 68 69 70 71 72 73 74
                             blank=True, null=True, verbose_name=_("protocol"),
                             help_text=_("Protocol of packets that match."))
    extra = models.TextField(blank=True, verbose_name=_("extra arguments"),
                             help_text=_("Additional arguments passed "
                                         "literally to the iptables-rule."))
    accept = models.BooleanField(default=False, verbose_name=_("accept"),
                                 help_text=_("Accept the matching packets "
                                             "(or deny if not checked)."))
    owner = models.ForeignKey(User, blank=True, null=True,
                              verbose_name=_("owner"),
                              help_text=_("The user responsible for "
                                          "this rule."))
    nat = models.BooleanField(default=False, verbose_name=_("NAT"),
                              help_text=_("If network address translation "
75
                                          "should be done."))
76
    nat_dport = models.IntegerField(blank=True, null=True,
77 78 79
                                    help_text=_("Rewrite destination port "
                                                "number to this if NAT is "
                                                "needed."),
80 81 82 83 84 85 86 87
                                    validators=[MinValueValidator(1),
                                                MaxValueValidator(65535)])
    created_at = models.DateTimeField(
        auto_now_add=True,
        verbose_name=_("created at"))
    modified_at = models.DateTimeField(
        auto_now=True,
        verbose_name=_("modified at"))
88 89

    vlan = models.ForeignKey('Vlan', related_name="rules", blank=True,
90 91 92
                             null=True, verbose_name=_("vlan"),
                             help_text=_("Vlan the rule applies to "
                                         "(if type is vlan)."))
93
    vlangroup = models.ForeignKey('VlanGroup', related_name="rules",
94 95 96 97
                                  blank=True, null=True, verbose_name=_(
                                      "vlan group"),
                                  help_text=_("Group of vlans the rule "
                                              "applies to (if type is vlan)."))
98
    host = models.ForeignKey('Host', related_name="rules", blank=True,
99 100 101 102 103 104 105 106 107 108 109 110
                             verbose_name=_('host'), null=True,
                             help_text=_("Host the rule applies to "
                                         "(if type is host)."))
    hostgroup = models.ForeignKey(
        'Group', related_name="rules", verbose_name=_("host group"),
        blank=True, null=True, help_text=_("Group of hosts the rule applies "
                                           "to (if type is host)."))
    firewall = models.ForeignKey(
        'Firewall', related_name="rules", verbose_name=_("firewall"),
                                 help_text=_("Firewall the rule applies to "
                                             "(if type is firewall)."),
        blank=True, null=True)
111 112 113 114 115 116

    def __unicode__(self):
        return self.desc()

    def clean(self):
        fields = [self.vlan, self.vlangroup, self.host, self.hostgroup,
117
                  self.firewall]
118 119 120 121 122
        selected_fields = [field for field in fields if field]
        if len(selected_fields) > 1:
            raise ValidationError(_('Only one field can be selected.'))

    def desc(self):
123 124
        """Return a short string representation of the current rule.
        """
125 126 127
        return u'[%(type)s] %(src)s ▸ %(dst)s %(para)s %(desc)s' % {
            'type': self.r_type,
            'src': (unicode(self.foreign_network) if self.direction == '1'
128
                    else self.r_type),
129
            'dst': (self.r_type if self.direction == '1'
130
                    else unicode(self.foreign_network)),
131 132 133 134 135
            'para': ((("proto=%s " % self.proto) if self.proto else '') +
                     (("sport=%s " % self.sport) if self.sport else '') +
                     (("dport=%s " % self.dport) if self.dport else '')),
            'desc': self.description}

136 137 138 139 140 141 142 143 144
    @property
    def r_type(self):
        fields = [self.vlan, self.vlangroup, self.host, self.hostgroup,
                  self.firewall]
        for field in fields:
            if field is not None:
                return field.__class__.__name__.lower()
        return None

145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161
    @models.permalink
    def get_absolute_url(self):
        return ('network.rule', None, {'pk': self.pk})

    class Meta:
        verbose_name = _("rule")
        verbose_name_plural = _("rules")
        ordering = (
            'direction',
            'proto',
            'sport',
            'dport',
            'nat_dport',
            'host',
        )


162
class Vlan(AclBase, models.Model):
163 164 165 166 167 168 169 170 171 172 173 174

    """
    A vlan of the network,

    Networks controlled by this framework are split into separated subnets.
    These networks are izolated by the vlan (virtual lan) technology, which is
    commonly used by managed network switches to partition the network.

    Each vlan network has a unique identifier, a name, a unique IPv4 and IPv6
    range. The gateway also has an IP address in each range.
    """

175 176 177 178
    ACL_LEVELS = (
        ('user', _('user')),
        ('operator', _('operator')),
    )
179 180
    CHOICES_NETWORK_TYPE = (('public', _('public')), ('dmz', _('dmz')),
                            ('portforward', _('portforward')))
181 182 183 184 185 186 187 188 189 190
    vid = models.IntegerField(unique=True,
                              verbose_name=_('VID'),
                              help_text=_('The vlan ID of the subnet.'),
                              validators=[MinValueValidator(1),
                                          MaxValueValidator(4095)])
    name = models.CharField(max_length=20,
                            unique=True,
                            verbose_name=_('Name'),
                            help_text=_('The short name of the subnet.'),
                            validators=[val_alfanum])
191 192 193 194 195
    network4 = IPNetworkField(unique=False,
                              version=4,
                              verbose_name=_('IPv4 address/prefix'),
                              help_text=_(
                                  'The IPv4 address and the prefix length '
196
                                  'of the gateway. '
197 198 199 200 201 202 203 204 205 206 207 208
                                  'Recommended value is the last '
                                  'valid address of the subnet, '
                                  'for example '
                                  '10.4.255.254/16 for 10.4.0.0/16.'))
    network6 = IPNetworkField(unique=False,
                              version=6,
                              null=True,
                              blank=True,
                              verbose_name=_('IPv6 address/prefix'),
                              help_text=_(
                                  'The IPv6 address and the prefix length '
                                  'of the gateway.'))
209
    snat_ip = models.GenericIPAddressField(protocol='ipv4', blank=True,
210 211 212 213 214 215 216 217
                                           null=True,
                                           verbose_name=_('NAT IP address'),
                                           help_text=_(
                                               'Common IPv4 address used for '
                                               'address translation of '
                                               'connections to the networks '
                                               'selected below '
                                               '(typically to the internet).'))
218
    snat_to = models.ManyToManyField('self', symmetrical=False, blank=True,
219 220 221 222 223 224 225
                                     null=True, verbose_name=_('NAT to'),
                                     help_text=_(
                                         'Connections to these networks '
                                         'should be network address '
                                         'translated, i.e. their source '
                                         'address is rewritten to the value '
                                         'of NAT IP address.'))
226 227 228
    network_type = models.CharField(choices=CHOICES_NETWORK_TYPE,
                                    verbose_name=_('network type'),
                                    max_length=20)
229
    managed = models.BooleanField(default=True, verbose_name=_('managed'))
230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250
    description = models.TextField(blank=True, verbose_name=_('description'),
                                   help_text=_(
                                       'Description of the goals and elements '
                                       'of the vlan network.'))
    comment = models.TextField(blank=True, verbose_name=_('comment'),
                               help_text=_(
                                   'Notes, comments about the network'))
    domain = models.ForeignKey('Domain', verbose_name=_('domain name'),
                               help_text=_('Domain name of the members of '
                                           'this network.'))
    reverse_domain = models.TextField(
        validators=[val_reverse_domain],
        verbose_name=_('reverse domain'),
        help_text=_('Template of the IPv4 reverse domain name that '
                    'should be generated for each host. The template '
                    'should contain four tokens: "%(a)d", "%(b)d", '
                    '"%(c)d", and "%(d)d", representing the four bytes '
                    'of the address, respectively, in decimal notation. '
                    'For example, the template for the standard reverse '
                    'address is: "%(d)d.%(c)d.%(b)d.%(a)d.in-addr.arpa".'),
        default="%(d)d.%(c)d.%(b)d.%(a)d.in-addr.arpa")
251 252 253 254
    ipv6_template = models.TextField(
        validators=[val_ipv6_template],
        verbose_name=_('ipv6 template'),
        default="2001:738:2001:4031:%(b)d:%(c)d:%(d)d:0")
255 256 257 258 259 260 261 262 263 264 265 266 267
    dhcp_pool = models.TextField(blank=True, verbose_name=_('DHCP pool'),
                                 help_text=_(
                                     'The address range of the DHCP pool: '
                                     'empty for no DHCP service, "manual" for '
                                     'no DHCP pool, or the first and last '
                                     'address of the range separated by a '
                                     'space.'))
    created_at = models.DateTimeField(auto_now_add=True,
                                      verbose_name=_('created at'))
    owner = models.ForeignKey(User, blank=True, null=True,
                              verbose_name=_('owner'))
    modified_at = models.DateTimeField(auto_now=True,
                                       verbose_name=_('modified at'))
268 269

    def __unicode__(self):
270 271
        return "%s - %s" % ("managed" if self.managed else "unmanaged",
                            self.name)
272

273 274 275 276
    @models.permalink
    def get_absolute_url(self):
        return ('network.vlan', None, {'vid': self.vid})

277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300
    @property
    def net4(self):
        return self.network4.network

    @property
    def ipv4(self):
        return self.network4.ip

    @property
    def prefix4(self):
        return self.network4.prefixlen

    @property
    def net6(self):
        return self.network6.network

    @property
    def ipv6(self):
        return self.network6.ip

    @property
    def prefix6(self):
        return self.network6.prefixlen

301 302 303 304 305 306
    def get_random_addresses(self, used_v4, buffer_size=100, max_hosts=10000):
        addresses = islice(self.network4.iter_hosts(), max_hosts)
        unused_addresses = list(islice(
            ifilter(lambda x: x not in used_v4, addresses), buffer_size))
        random.shuffle(unused_addresses)
        return unused_addresses
307

308
    def get_new_address(self):
309
        hosts = self.host_set
310 311 312
        used_v4 = IPSet(hosts.values_list('ipv4', flat=True))
        used_v6 = IPSet(hosts.exclude(ipv6__isnull=True)
                        .values_list('ipv6', flat=True))
313

314 315 316 317 318 319 320 321 322 323
        for ipv4 in self.get_random_addresses(used_v4):
            logger.debug("Found unused IPv4 address %s.", ipv4)
            ipv6 = None
            if self.network6 is not None:
                ipv6 = convert_ipv4_to_ipv6(self.ipv6_template, ipv4)
                if ipv6 in used_v6:
                    continue
                else:
                    logger.debug("Found unused IPv6 address %s.", ipv6)
            return {'ipv4': ipv4, 'ipv6': ipv6}
324 325
        else:
            raise ValidationError(_("All IP addresses are already in use."))
326

327

328
class VlanGroup(models.Model):
329 330 331 332 333 334
    """
    A group of Vlans.
    """

    name = models.CharField(max_length=20, unique=True, verbose_name=_('name'),
                            help_text=_('The name of the group.'))
335
    vlans = models.ManyToManyField('Vlan', symmetrical=False, blank=True,
336 337 338 339 340 341 342 343 344 345 346
                                   null=True, verbose_name=_('vlans'),
                                   help_text=_('The vlans which are members '
                                               'of the group.'))
    description = models.TextField(blank=True, verbose_name=_('description'),
                                   help_text=_('Description of the group.'))
    owner = models.ForeignKey(User, blank=True, null=True,
                              verbose_name=_('owner'))
    created_at = models.DateTimeField(auto_now_add=True,
                                      verbose_name=_('created at'))
    modified_at = models.DateTimeField(auto_now=True,
                                       verbose_name=_('modified at'))
347 348 349 350

    def __unicode__(self):
        return self.name

351 352 353 354 355
    @models.permalink
    def get_absolute_url(self):
        return ('network.vlan_group', None, {'pk': self.pk})


356
class Group(models.Model):
357 358 359 360 361 362 363 364 365 366 367 368 369
    """
    A group of hosts.
    """
    name = models.CharField(max_length=20, unique=True, verbose_name=_('name'),
                            help_text=_('The name of the group.'))
    description = models.TextField(blank=True, verbose_name=_('description'),
                                   help_text=_('Description of the group.'))
    owner = models.ForeignKey(User, blank=True, null=True,
                              verbose_name=_('owner'))
    created_at = models.DateTimeField(auto_now_add=True,
                                      verbose_name=_('created at'))
    modified_at = models.DateTimeField(auto_now=True,
                                       verbose_name=_('modified at'))
370 371 372 373

    def __unicode__(self):
        return self.name

374 375 376 377 378
    @models.permalink
    def get_absolute_url(self):
        return ('network.group', None, {'pk': self.pk})


379
class Host(models.Model):
380 381 382 383
    """
    A host of the network.
    """

384
    hostname = models.CharField(max_length=40,
385 386 387 388 389
                                verbose_name=_('hostname'),
                                help_text=_('The alphanumeric hostname of '
                                            'the host, the first part of '
                                            'the FQDN.'),
                                validators=[val_alfanum])
390
    reverse = models.CharField(max_length=40, validators=[val_domain],
391 392 393 394 395 396 397 398 399
                               verbose_name=_('reverse'),
                               help_text=_('The fully qualified reverse '
                                           'hostname of the host, if '
                                           'different than hostname.domain.'),
                               blank=True, null=True)
    mac = MACAddressField(unique=True, verbose_name=_('MAC address'),
                          help_text=_('The MAC (Ethernet) address of the '
                                      'network interface. For example: '
                                      '99:AA:BB:CC:DD:EE.'))
400 401 402 403 404 405
    ipv4 = IPAddressField(version=4, unique=True,
                          verbose_name=_('IPv4 address'),
                          help_text=_('The real IPv4 address of the '
                                      'host, for example 10.5.1.34.'))
    pub_ipv4 = IPAddressField(
        version=4, blank=True, null=True,
406 407 408
        verbose_name=_('WAN IPv4 address'),
        help_text=_('The public IPv4 address of the host on the wide '
                    'area network, if different.'))
409 410 411 412 413
    ipv6 = IPAddressField(version=6, unique=True,
                          blank=True, null=True,
                          verbose_name=_('IPv6 address'),
                          help_text=_('The global IPv6 address of the host'
                                      ', for example 2001:db:88:200::10.'))
414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431
    shared_ip = models.BooleanField(default=False, verbose_name=_('shared IP'),
                                    help_text=_(
                                        'If the given WAN IPv4 address is '
                                        'used by multiple hosts.'))
    description = models.TextField(blank=True, verbose_name=_('description'),
                                   help_text=_('What is this host for, what '
                                               'kind of machine is it.'))
    comment = models.TextField(blank=True,
                               verbose_name=_('Notes'))
    location = models.TextField(blank=True, verbose_name=_('location'),
                                help_text=_(
                                    'The physical location of the machine.'))
    vlan = models.ForeignKey('Vlan', verbose_name=_('vlan'),
                             help_text=_(
                                 'Vlan network that the host is part of.'))
    owner = models.ForeignKey(User, verbose_name=_('owner'),
                              help_text=_(
                                  'The person responsible for this host.'))
432
    groups = models.ManyToManyField('Group', symmetrical=False, blank=True,
433 434 435 436 437 438 439
                                    null=True, verbose_name=_('groups'),
                                    help_text=_(
                                        'Host groups the machine is part of.'))
    created_at = models.DateTimeField(auto_now_add=True,
                                      verbose_name=_('created at'))
    modified_at = models.DateTimeField(auto_now=True,
                                       verbose_name=_('modified at'))
440

441 442 443
    class Meta(object):
        unique_together = ('hostname', 'vlan')

444 445 446
    def __unicode__(self):
        return self.hostname

447 448 449 450 451 452 453 454
    @property
    def incoming_rules(self):
        return self.rules.filter(direction='1')

    @property
    def outgoing_rules(self):
        return self.rules.filter(direction='0')

455
    def clean(self):
456 457 458
        if (not self.shared_ip and self.pub_ipv4 and Host.objects.
                exclude(id=self.id).filter(pub_ipv4=self.pub_ipv4)):
            raise ValidationError(_("If shared_ip has been checked, "
459
                                    "pub_ipv4 has to be unique."))
460 461
        if Host.objects.exclude(id=self.id).filter(pub_ipv4=self.ipv4):
            raise ValidationError(_("You can't use another host's NAT'd "
462
                                    "address as your own IPv4."))
463 464 465

    def save(self, *args, **kwargs):
        if not self.id and self.ipv6 == "auto":
466 467
            self.ipv6 = convert_ipv4_to_ipv6(self.vlan.ipv6_template,
                                             self.ipv4)
468
        self.full_clean()
469

470
        super(Host, self).save(*args, **kwargs)
471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502

        if self.ipv4 is not None:
            Record.objects.filter(host=self, name=self.hostname,
                                  type='A').update(address=self.ipv4)
            record_count = self.record_set.filter(host=self,
                                                  name=self.hostname,
                                                  address=self.ipv4,
                                                  type='A').count()
            if record_count == 0:
                Record(host=self,
                       name=self.hostname,
                       domain=self.vlan.domain,
                       address=self.ipv4,
                       owner=self.owner,
                       description='host.save()',
                       type='A').save()

        if self.ipv6:
            Record.objects.filter(host=self, name=self.hostname,
                                  type='AAAA').update(address=self.ipv6)
            record_count = self.record_set.filter(host=self,
                                                  name=self.hostname,
                                                  address=self.ipv6,
                                                  type='AAAA').count()
            if record_count == 0:
                Record(host=self,
                       name=self.hostname,
                       domain=self.vlan.domain,
                       address=self.ipv6,
                       owner=self.owner,
                       description='host.save()',
                       type='AAAA').save()
503 504

    def enable_net(self):
505 506
        for i in settings.get('default_host_groups', []):
            self.groups.add(Group.objects.get(name=i))
507

508 509 510 511
    def _get_ports_used(self, proto):
        """
        Gives a list of port numbers used for the public IP address of current
        host for the given protocol.
512

513 514 515 516 517 518 519 520 521
        :param proto: The transport protocol of the generated port (tcp|udp).
        :type proto: str.
        :returns: list -- list of int port numbers used.
        """
        if self.shared_ip:
            ports = Rule.objects.filter(host__pub_ipv4=self.pub_ipv4,
                                        nat=True, proto=proto)
        else:
            ports = self.rules.filter(proto=proto, )
522
        return set(ports.values_list('dport', flat=True))
523 524 525 526 527 528 529 530

    def _get_random_port(self, proto, used_ports=None):
        """
        Get a random unused port for given protocol for current host's public
        IP address.

        :param proto: The transport protocol of the generated port (tcp|udp).
        :type proto: str.
531
        :param used_ports: Optional set of used ports returned by
532 533 534 535 536 537 538 539 540 541 542 543 544
                           _get_ports_used.
        :returns: int -- the generated port number.
        :raises: ValidationError
        """
        if used_ports is None:
            used_ports = self._get_ports_used(proto)

        public = random.randint(1024, 21000)  # pick a random port
        if public in used_ports:  # if it's in use, select smallest free one
            for i in range(1024, 21000) + range(24000, 65535):
                if i not in used_ports:
                    public = i
                    break
545
            else:
546 547
                raise ValidationError(
                    _("All %s ports are already in use.") % proto)
548
        return public
549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568

    def add_port(self, proto, public=None, private=None):
        """
        Allow inbound traffic to a port.

        If the host uses a shared IP address, also set up port forwarding.

        :param proto: The transport protocol (tcp|udp).
        :type proto: str.
        :param public: Preferred public port number for forwarding (optional).
        :param private: Port number of host in subject.
        """
        assert proto in ('tcp', 'udp', )
        if public:
            if public in self._get_ports_used(proto):
                raise ValidationError(
                    _("Port %(proto)s %(public)s is already in use.") %
                    {'proto': proto, 'public': public})
        else:
            public = self._get_random_port(proto)
569

570 571 572 573 574 575
        try:
            vgname = settings["default_vlangroup"]
            vg = VlanGroup.objects.get(name=vgname)
        except VlanGroup.DoesNotExist as e:
            logger.error('Host.add_port: default_vlangroup %s missing. %s',
                         vgname, unicode(e))
576
        else:
577 578 579 580 581 582 583 584 585 586 587 588 589
            if self.shared_ip:
                if public < 1024:
                    raise ValidationError(
                        _("Only ports above 1024 can be used."))
                rule = Rule(direction='1', owner=self.owner, dport=public,
                            proto=proto, nat=True, accept=True,
                            nat_dport=private, host=self, foreign_network=vg)
            else:
                rule = Rule(direction='1', owner=self.owner, dport=private,
                            proto=proto, nat=False, accept=True,
                            host=self, foreign_network=vg)
            rule.full_clean()
            rule.save()
590 591

    def del_port(self, proto, private):
592 593 594 595 596 597 598 599 600 601
        """
        Remove rules about inbound traffic to a given port.

        If the host uses a shared IP address, also set up port forwarding.

        :param proto: The transport protocol (tcp|udp).
        :type proto: str.
        :param private: Port number of host in subject.
        """

602 603
        if self.shared_ip:
            self.rules.filter(owner=self.owner, proto=proto, host=self,
604
                              nat_dport=private).delete()
605 606
        else:
            self.rules.filter(owner=self.owner, proto=proto, host=self,
607
                              dport=private).delete()
608

609
    def get_hostname(self, proto, public=True):
610
        """
611
        Get a private or public hostname for host.
612 613 614 615 616

        :param proto: The IP version (ipv4|ipv6).
        :type proto: str.
        """
        assert proto in ('ipv6', 'ipv4', )
617 618
        try:
            if proto == 'ipv6':
619 620
                res = self.record_set.filter(type='AAAA',
                                             address=self.ipv6)
621
            elif proto == 'ipv4':
622
                if self.shared_ip and public:
623
                    res = Record.objects.filter(type='A',
624
                                                address=self.pub_ipv4)
625 626
                    if res.count() < 1:
                        return unicode(self.pub_ipv4)
627
                else:
628 629 630
                    res = self.record_set.filter(type='A',
                                                 address=self.ipv4)
            return unicode(res[0].fqdn)
631
        except:
632
            return None
633 634

    def list_ports(self):
635 636 637
        """
        Return a list of ports with forwarding rules set.
        """
638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654
        retval = []
        for rule in self.rules.filter(owner=self.owner):
            private = rule.nat_dport if self.shared_ip else rule.dport
            forward = {
                'proto': rule.proto,
                'private': private,
            }
            if self.shared_ip:
                public4 = rule.dport
                public6 = rule.nat_dport
            else:
                public4 = public6 = rule.dport

            if True:      # ipv4
                forward['ipv4'] = {
                    'host': self.get_hostname(proto='ipv4'),
                    'port': public4,
655
                    'pk': rule.pk,
656
                }
657
            if self.ipv6:  # ipv6
658 659 660
                forward['ipv6'] = {
                    'host': self.get_hostname(proto='ipv6'),
                    'port': public6,
661
                    'pk': rule.pk,
662 663 664 665 666
                }
            retval.append(forward)
        return retval

    def get_fqdn(self):
667 668 669
        """
        Get fully qualified host name of host.
        """
670
        return self.get_hostname('ipv4', public=False)
671

672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697
    def get_public_endpoints(self, port, protocol='tcp'):
        """Get public IPv4 and IPv6 endpoints for local port.

        Optionally the required protocol (e.g. TCP, UDP) can be specified.
        """
        endpoints = {}
        # IPv4
        public_ipv4 = self.pub_ipv4 if self.pub_ipv4 else self.ipv4
        # try get matching port(s) without NAT
        ports = self.incoming_rules.filter(accept=True, dport=port,
                                           nat=False, proto=protocol)
        if ports.exists():
            public_port = ports[0].dport
        else:
            # try get matching port(s) with NAT
            ports = self.incoming_rules.filter(accept=True, nat_dport=port,
                                               nat=True, proto=protocol)
            public_port = ports[0].dport if ports.exists() else None
        endpoints['ipv4'] = ((public_ipv4, public_port) if public_port else
                             None)
        # IPv6
        blocked = self.incoming_rules.filter(accept=False, dport=port,
                                             proto=protocol).exists()
        endpoints['ipv6'] = (self.ipv6, port) if not blocked else None
        return endpoints

698 699 700 701
    @models.permalink
    def get_absolute_url(self):
        return ('network.host', None, {'pk': self.pk})

702 703 704 705 706 707 708 709 710 711 712
    @property
    def eui(self):
        return EUI(self.mac)

    @property
    def hw_vendor(self):
        try:
            return self.eui.oui.registration().org
        except:
            return None

713 714

class Firewall(models.Model):
715 716
    name = models.CharField(max_length=20, unique=True,
                            verbose_name=_('name'))
717 718 719 720

    def __unicode__(self):
        return self.name

721

722
class Domain(models.Model):
723 724 725 726 727 728 729 730 731
    name = models.CharField(max_length=40, validators=[val_domain],
                            verbose_name=_('name'))
    owner = models.ForeignKey(User, verbose_name=_('owner'))
    created_at = models.DateTimeField(auto_now_add=True,
                                      verbose_name=_('created_at'))
    modified_at = models.DateTimeField(auto_now=True,
                                       verbose_name=_('modified_at'))
    ttl = models.IntegerField(default=600, verbose_name=_('ttl'))
    description = models.TextField(blank=True, verbose_name=_('description'))
732 733 734 735

    def __unicode__(self):
        return self.name

736 737 738 739 740
    @models.permalink
    def get_absolute_url(self):
        return ('network.domain', None, {'pk': self.pk})


741 742
class Record(models.Model):
    CHOICES_type = (('A', 'A'), ('CNAME', 'CNAME'), ('AAAA', 'AAAA'),
743
                   ('MX', 'MX'), ('NS', 'NS'), ('PTR', 'PTR'), ('TXT', 'TXT'))
744
    name = models.CharField(max_length=40, validators=[val_domain],
745 746 747 748 749 750
                            blank=True, null=True, verbose_name=_('name'))
    domain = models.ForeignKey('Domain', verbose_name=_('domain'))
    host = models.ForeignKey('Host', blank=True, null=True,
                             verbose_name=_('host'))
    type = models.CharField(max_length=6, choices=CHOICES_type,
                            verbose_name=_('type'))
751
    address = models.CharField(max_length=200,
752 753 754 755 756 757 758 759
                               verbose_name=_('address'))
    ttl = models.IntegerField(default=600, verbose_name=_('ttl'))
    owner = models.ForeignKey(User, verbose_name=_('owner'))
    description = models.TextField(blank=True, verbose_name=_('description'))
    created_at = models.DateTimeField(auto_now_add=True,
                                      verbose_name=_('created_at'))
    modified_at = models.DateTimeField(auto_now=True,
                                       verbose_name=_('modified_at'))
760 761 762 763 764

    def __unicode__(self):
        return self.desc()

    def desc(self):
765
        return u' '.join([self.fqdn, self.type, self.address])
766 767 768 769 770

    def save(self, *args, **kwargs):
        self.full_clean()
        super(Record, self).save(*args, **kwargs)

771 772
    def _validate_record(self):
        """Validate a record."""
773 774
        if not self.address:
            raise ValidationError(_("Address must be specified!"))
775 776 777 778 779 780 781 782 783 784 785 786

        try:
            validator = {
                'A': val_ipv4,
                'AAAA': val_ipv6,
                'CNAME': val_domain,
                'MX': val_mx,
                'NS': val_domain,
                'PTR': val_domain,
                'TXT': None,
            }[self.type]
        except KeyError:
787
            raise ValidationError(_("Unknown record type."))
788 789 790
        else:
            if validator:
                validator(self.address)
791

792
    def clean(self):
793 794
        """Validate the Record to be saved.
        """
795 796 797
        if self.name:
            self.name = self.name.rstrip(".")    # remove trailing dots

798
        self._validate_record()
799

800 801
    @property
    def fqdn(self):
802 803 804 805
        if self.name:
            return '%s.%s' % (self.name, self.domain.name)
        else:
            return self.domain.name
806

807 808 809 810
    @models.permalink
    def get_absolute_url(self):
        return ('network.record', None, {'pk': self.pk})

811 812 813 814 815 816
    class Meta:
        ordering = (
            'domain',
            'name',
        )

817

818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838
class SwitchPort(models.Model):
    untagged_vlan = models.ForeignKey('Vlan',
                                      related_name='untagged_ports',
                                      verbose_name=_('untagged vlan'))
    tagged_vlans = models.ForeignKey('VlanGroup', blank=True, null=True,
                                     related_name='tagged_ports',
                                     verbose_name=_('tagged vlans'))
    description = models.TextField(blank=True, verbose_name=_('description'))
    created_at = models.DateTimeField(auto_now_add=True,
                                      verbose_name=_('created_at'))
    modified_at = models.DateTimeField(auto_now=True,
                                       verbose_name=_('modified_at'))

    def __unicode__(self):
        devices = ','.join(self.ethernet_devices.values_list('name',
                                                             flat=True))
        tagged_vlans = self.tagged_vlans.name if self.tagged_vlans else ''
        return 'devices=%s untagged=%s tagged=%s' % (devices,
                                                     self.untagged_vlan,
                                                     tagged_vlans)

839 840 841 842
    @models.permalink
    def get_absolute_url(self):
        return ('network.switch_port', None, {'pk': self.pk})

843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862

class EthernetDevice(models.Model):
    name = models.CharField(max_length=20,
                            unique=True,
                            verbose_name=_('interface'),
                            help_text=_('The name of network interface the '
                                        'gateway should serve this network '
                                        'on. For example eth2.'))
    switch_port = models.ForeignKey('SwitchPort',
                                    related_name='ethernet_devices',
                                    verbose_name=_('switch port'))
    created_at = models.DateTimeField(auto_now_add=True,
                                      verbose_name=_('created_at'))
    modified_at = models.DateTimeField(auto_now=True,
                                       verbose_name=_('modified_at'))

    def __unicode__(self):
        return self.name


863
class Blacklist(models.Model):
864 865
    CHOICES_type = (('permban', 'permanent ban'), ('tempban', 'temporary ban'),
                    ('whitelist', 'whitelist'), ('tempwhite', 'tempwhite'))
866
    ipv4 = models.GenericIPAddressField(protocol='ipv4', unique=True)
867 868 869 870 871 872 873 874 875 876 877 878 879 880 881
    host = models.ForeignKey('Host', blank=True, null=True,
                             verbose_name=_('host'))
    reason = models.TextField(blank=True, verbose_name=_('reason'))
    snort_message = models.TextField(blank=True,
                                     verbose_name=_('short message'))
    type = models.CharField(
        max_length=10,
        choices=CHOICES_type,
        default='tempban',
        verbose_name=_('type')
    )
    created_at = models.DateTimeField(auto_now_add=True,
                                      verbose_name=_('created_at'))
    modified_at = models.DateTimeField(auto_now=True,
                                       verbose_name=_('modified_at'))
882 883 884 885

    def save(self, *args, **kwargs):
        self.full_clean()
        super(Blacklist, self).save(*args, **kwargs)
886

887 888 889
    def __unicode__(self):
        return self.ipv4

890 891 892 893 894
    @models.permalink
    def get_absolute_url(self):
        return ('network.blacklist', None, {'pk': self.pk})


895
def send_task(sender, instance, created=False, **kwargs):
896
    reloadtask.apply_async(queue='localhost.man', args=[sender.__name__])
897 898


899 900 901 902
for sender in [Host, Rule, Domain, Record, Vlan, Firewall, Group, Blacklist,
               SwitchPort, EthernetDevice]:
    post_save.connect(send_task, sender=sender)
    post_delete.connect(send_task, sender=sender)