Skip to content
Toggle navigation
P
Projects
G
Groups
S
Snippets
Help
CIRCLE
/
cloud
This project
Loading...
Sign in
Toggle navigation
Go to a project
Project
Repository
Issues
94
Merge Requests
10
Pipelines
Wiki
Snippets
Members
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Commit
25a36d8e
authored
Feb 19, 2013
by
Bach Dániel
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
firewall: Blacklist added
parent
771d5049
Expand all
Hide whitespace changes
Inline
Side-by-side
Showing
4 changed files
with
22 additions
and
3 deletions
+22
-3
firewall/admin.py
+4
-0
firewall/fw.py
+12
-3
firewall/migrations/0030_auto__del_setting__del_alias__add_blacklist.py
+0
-0
firewall/models.py
+6
-0
No files found.
firewall/admin.py
View file @
25a36d8e
...
...
@@ -102,6 +102,9 @@ class RecordAdmin(admin.ModelAdmin):
if
a
:
return
a
[
'name'
]
class
BlacklistAdmin
(
admin
.
ModelAdmin
):
list_display
=
(
'ipv4'
,
'reason'
,
'created_at'
,
'modified_at'
)
admin
.
site
.
register
(
Host
,
HostAdmin
)
admin
.
site
.
register
(
Vlan
,
VlanAdmin
)
admin
.
site
.
register
(
Rule
,
RuleAdmin
)
...
...
@@ -110,4 +113,5 @@ admin.site.register(VlanGroup)
admin
.
site
.
register
(
Firewall
,
FirewallAdmin
)
admin
.
site
.
register
(
Domain
,
DomainAdmin
)
admin
.
site
.
register
(
Record
,
RecordAdmin
)
admin
.
site
.
register
(
Blacklist
,
BlacklistAdmin
)
firewall/fw.py
View file @
25a36d8e
...
...
@@ -6,6 +6,7 @@ from cloud.settings import firewall_settings as settings
import
subprocess
import
re
import
json
from
datetime
import
datetime
,
timedelta
class
firewall
:
...
...
@@ -17,6 +18,7 @@ class firewall:
pub
=
None
hosts
=
None
fw
=
None
ipset
=
None
def
dportsport
(
self
,
rule
,
repl
=
True
):
retval
=
' '
...
...
@@ -133,13 +135,14 @@ class firewall:
self
.
iptables
(
'-N PUB_OUT'
)
self
.
iptables
(
'-A FORWARD -m set --match-set blacklist src,dst -j DROP'
)
self
.
iptables
(
'-A FORWARD -m state --state INVALID -g LOG_DROP'
)
self
.
iptables
(
'-A FORWARD -m state --state ESTABLISHED,RELATED '
'-j ACCEPT'
)
self
.
iptables
(
'-A FORWARD -p icmp --icmp-type echo-request '
'-g LOG_ACC'
)
if
not
self
.
IPV6
:
self
.
iptables
(
'-A FORWARD -j r_pub_sIP -o pub
'
)
self
.
iptables
(
'-A INPUT -m set --match-set blacklist src -j DROP
'
)
self
.
iptables
(
'-A INPUT -m state --state INVALID -g LOG_DROP'
)
self
.
iptables
(
'-A INPUT -i lo -j ACCEPT'
)
self
.
iptables
(
'-A INPUT -m state --state ESTABLISHED,RELATED '
...
...
@@ -260,6 +263,7 @@ class firewall:
def
__init__
(
self
,
IPV6
=
False
):
self
.
RULES
=
[]
self
.
RULES_NAT
=
[]
self
.
IPSET
=
[]
self
.
IPV6
=
IPV6
self
.
vlans
=
models
.
Vlan
.
objects
.
all
()
self
.
hosts
=
models
.
Host
.
objects
.
all
()
...
...
@@ -269,6 +273,7 @@ class firewall:
self
.
ipt_filter
()
if
not
self
.
IPV6
:
self
.
ipt_nat
()
self
.
IPSET
=
self
.
ipset
()
def
reload
(
self
):
if
self
.
IPV6
:
...
...
@@ -287,7 +292,7 @@ class firewall:
if
self
.
IPV6
:
return
{
'filter'
:
self
.
RULES
,
}
else
:
return
{
'filter'
:
self
.
RULES
,
'nat'
:
self
.
RULES_NA
T
}
return
{
'filter'
:
self
.
RULES
,
'nat'
:
self
.
RULES_NAT
,
'ipset'
:
self
.
IPSE
T
}
def
show
(
self
):
if
self
.
IPV6
:
...
...
@@ -296,6 +301,10 @@ class firewall:
return
(
'
\n
'
.
join
(
self
.
RULES
)
+
'
\n
'
+
'
\n
'
.
join
(
self
.
RULES_NAT
)
+
'
\n
'
)
def
ipset
(
self
):
week
=
datetime
.
now
()
-
timedelta
(
days
=
7
)
return
models
.
Blacklist
.
objects
.
filter
(
modified_at__gte
=
week
)
.
values_list
(
'ipv4'
,
flat
=
True
)
def
ipv6_to_octal
(
ipv6
):
while
len
(
ipv6
.
split
(
':'
))
<
8
:
...
...
firewall/migrations/0030_auto__del_setting__del_alias__add_blacklist.py
0 → 100644
View file @
25a36d8e
This diff is collapsed.
Click to expand it.
firewall/models.py
View file @
25a36d8e
...
...
@@ -318,6 +318,11 @@ class Record(models.Model):
return
None
return
retval
class
Blacklist
(
models
.
Model
):
ipv4
=
models
.
GenericIPAddressField
(
protocol
=
'ipv4'
,
unique
=
True
)
reason
=
models
.
TextField
(
blank
=
True
)
created_at
=
models
.
DateTimeField
(
auto_now_add
=
True
)
modified_at
=
models
.
DateTimeField
(
auto_now
=
True
)
def
send_task
(
sender
,
instance
,
created
,
**
kwargs
):
from
firewall.tasks
import
ReloadTask
...
...
@@ -332,3 +337,4 @@ post_save.connect(send_task, sender=Vlan)
post_save
.
connect
(
send_task
,
sender
=
Firewall
)
post_save
.
connect
(
send_task
,
sender
=
Group
)
post_save
.
connect
(
send_task
,
sender
=
Host
)
post_save
.
connect
(
send_task
,
sender
=
Blacklist
)
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment