Skip to content
Toggle navigation
P
Projects
G
Groups
S
Snippets
Help
Fukász Rómeó Ervin
/
cloud
This project
Loading...
Sign in
Toggle navigation
Go to a project
Project
Repository
Issues
0
Merge Requests
0
Pipelines
Wiki
Members
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
A prog2-höz tartozó friss repo anyagok itt elérhetőek:
https://git.iit.bme.hu/
Commit
29bbf837
authored
Jul 04, 2013
by
Kálmán Viktor
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
firewall: fixing trivial pep8 errors
parent
935d2a02
Expand all
Hide whitespace changes
Inline
Side-by-side
Showing
6 changed files
with
93 additions
and
50 deletions
+93
-50
firewall/admin.py
+28
-16
firewall/fields.py
+16
-2
firewall/fw.py
+0
-0
firewall/models.py
+11
-7
firewall/tasks.py
+9
-3
firewall/views.py
+29
-22
No files found.
firewall/admin.py
View file @
29bbf837
# -*- coding: utf8 -*-
from
django.contrib
import
admin
from
firewall.models
import
*
from
firewall.models
import
(
Rule
,
Host
,
Vlan
,
Group
,
VlanGroup
,
Firewall
,
Domain
,
Record
,
Blacklist
)
from
django
import
contrib
class
RuleInline
(
contrib
.
admin
.
TabularInline
):
model
=
Rule
class
RecordInline
(
contrib
.
admin
.
TabularInline
):
model
=
Record
class
HostAdmin
(
admin
.
ModelAdmin
):
list_display
=
(
'hostname'
,
'vlan'
,
'ipv4'
,
'ipv6'
,
'pub_ipv4'
,
'mac'
,
'shared_ip'
,
'owner'
,
'description'
,
'reverse'
,
'list_groups'
)
'shared_ip'
,
'owner'
,
'description'
,
'reverse'
,
'list_groups'
)
ordering
=
(
'hostname'
,
)
list_filter
=
(
'owner'
,
'vlan'
,
'groups'
)
search_fields
=
(
'hostname'
,
'description'
,
'ipv4'
,
'ipv6'
,
'mac'
)
...
...
@@ -26,42 +30,46 @@ class HostAdmin(admin.ModelAdmin):
names
=
[
group
.
name
for
group
in
instance
.
groups
.
all
()]
return
u', '
.
join
(
names
)
class
HostInline
(
contrib
.
admin
.
TabularInline
):
model
=
Host
fields
=
(
'hostname'
,
'ipv4'
,
'ipv6'
,
'pub_ipv4'
,
'mac'
,
'shared_ip'
,
'owner'
,
'reverse'
)
'owner'
,
'reverse'
)
class
VlanAdmin
(
admin
.
ModelAdmin
):
list_display
=
(
'vid'
,
'name'
,
'ipv4'
,
'net_ipv4'
,
'ipv6'
,
'net_ipv6'
,
'description'
,
'domain'
,
'snat_ip'
,
)
'description'
,
'domain'
,
'snat_ip'
,
)
ordering
=
(
'vid'
,
)
inlines
=
(
RuleInline
,
)
class
RuleAdmin
(
admin
.
ModelAdmin
):
list_display
=
(
'r_type'
,
'color_desc'
,
'owner'
,
'extra'
,
'direction'
,
'accept'
,
'proto'
,
'sport'
,
'dport'
,
'nat'
,
'nat_dport'
,
'used_in'
)
'accept'
,
'proto'
,
'sport'
,
'dport'
,
'nat'
,
'nat_dport'
,
'used_in'
)
list_filter
=
(
'r_type'
,
'vlan'
,
'owner'
,
'direction'
,
'accept'
,
'proto'
,
'nat'
)
'proto'
,
'nat'
)
def
color_desc
(
self
,
instance
):
"""Returns a colorful description of the instance."""
return
(
u'<span style="color: #FF0000;">[
%(type)
s]</span> '
u'
%(src)
s<span style="color: #0000FF;"> ▸ </span>
%(dst)
s '
u'
%(para)
s
%(desc)
s'
)
%
{
'type'
:
instance
.
r_type
,
'src'
:
(
instance
.
foreign_network
.
name
if
instance
.
direction
==
'1'
else
instance
.
r_type
),
'dst'
:
(
instance
.
r_type
if
instance
.
direction
==
'1'
else
instance
.
foreign_network
.
name
),
'para'
:
(
u'<span style="color: #00FF00;">'
+
'type'
:
instance
.
r_type
,
'src'
:
(
instance
.
foreign_network
.
name
if
instance
.
direction
==
'1'
else
instance
.
r_type
),
'dst'
:
(
instance
.
r_type
if
instance
.
direction
==
'1'
else
instance
.
foreign_network
.
name
),
'para'
:
(
u'<span style="color: #00FF00;">'
+
((
'proto=
%
s '
%
instance
.
proto
)
if
instance
.
proto
else
''
)
+
((
'sport=
%
s '
%
instance
.
sport
)
if
instance
.
sport
else
''
)
+
((
'dport=
%
s '
%
instance
.
dport
)
if
instance
.
dport
else
''
)
+
'</span>'
),
'desc'
:
instance
.
description
}
'</span>'
),
'desc'
:
instance
.
description
}
color_desc
.
allow_tags
=
True
@staticmethod
...
...
@@ -73,7 +81,7 @@ class RuleAdmin(admin.ModelAdmin):
@staticmethod
def
used_in
(
instance
):
for
field
in
[
instance
.
vlan
,
instance
.
vlangroup
,
instance
.
host
,
instance
.
hostgroup
,
instance
.
firewall
]:
instance
.
hostgroup
,
instance
.
firewall
]:
if
field
:
return
unicode
(
field
)
+
' '
+
field
.
_meta
.
object_name
...
...
@@ -81,16 +89,20 @@ class RuleAdmin(admin.ModelAdmin):
class
AliasAdmin
(
admin
.
ModelAdmin
):
list_display
=
(
'alias'
,
'host'
)
class
GroupAdmin
(
admin
.
ModelAdmin
):
list_display
=
(
'name'
,
'owner'
,
'description'
)
inlines
=
(
RuleInline
,
)
class
FirewallAdmin
(
admin
.
ModelAdmin
):
inlines
=
(
RuleInline
,
)
class
DomainAdmin
(
admin
.
ModelAdmin
):
list_display
=
(
'name'
,
'owner'
)
class
RecordAdmin
(
admin
.
ModelAdmin
):
list_display
=
(
'name_'
,
'type'
,
'address_'
,
'ttl'
,
'host'
,
'owner'
)
...
...
@@ -104,6 +116,7 @@ class RecordAdmin(admin.ModelAdmin):
a
=
instance
.
get_data
()
return
a
[
'name'
]
if
a
else
None
class
BlacklistAdmin
(
admin
.
ModelAdmin
):
list_display
=
(
'ipv4'
,
'reason'
,
'created_at'
,
'modified_at'
)
...
...
@@ -116,4 +129,3 @@ admin.site.register(Firewall, FirewallAdmin)
admin
.
site
.
register
(
Domain
,
DomainAdmin
)
admin
.
site
.
register
(
Record
,
RecordAdmin
)
admin
.
site
.
register
(
Blacklist
,
BlacklistAdmin
)
firewall/fields.py
View file @
29bbf837
...
...
@@ -6,12 +6,14 @@ from django.utils.ipv6 import is_valid_ipv6_address
from
south.modelsinspector
import
add_introspection_rules
import
re
mac_re
=
re
.
compile
(
r'^([0-9a-fA-F]{2}(:|$)){6}$'
)
alfanum_re
=
re
.
compile
(
r'^[A-Za-z0-9_-]+$'
)
domain_re
=
re
.
compile
(
r'^([A-Za-z0-9_-]\.?)+$'
)
ipv4_re
=
re
.
compile
(
'^[0-9]+
\
.([0-9]+)
\
.([0-9]+)
\
.([0-9]+)$'
)
reverse_domain_re
=
re
.
compile
(
r'^(
%
\([abcd]\)d|[a-z0-9.-])+$'
)
class
MACAddressFormField
(
fields
.
RegexField
):
default_error_messages
=
{
'invalid'
:
_
(
u'Enter a valid MAC address.'
),
...
...
@@ -20,8 +22,10 @@ class MACAddressFormField(fields.RegexField):
def
__init__
(
self
,
*
args
,
**
kwargs
):
super
(
MACAddressFormField
,
self
)
.
__init__
(
mac_re
,
*
args
,
**
kwargs
)
class
MACAddressField
(
models
.
Field
):
empty_strings_allowed
=
False
def
__init__
(
self
,
*
args
,
**
kwargs
):
kwargs
[
'max_length'
]
=
17
super
(
MACAddressField
,
self
)
.
__init__
(
*
args
,
**
kwargs
)
...
...
@@ -35,44 +39,53 @@ class MACAddressField(models.Field):
return
super
(
MACAddressField
,
self
)
.
formfield
(
**
defaults
)
add_introspection_rules
([],
[
"firewall
\
.fields
\
.MACAddressField"
])
def
val_alfanum
(
value
):
"""Validate whether the parameter is a valid alphanumeric value."""
if
not
alfanum_re
.
match
(
value
):
raise
ValidationError
(
_
(
u'
%
s - only letters, numbers, underscores '
'and hyphens are allowed!'
)
%
value
)
'and hyphens are allowed!'
)
%
value
)
def
is_valid_domain
(
value
):
"""Check whether the parameter is a valid domain name."""
return
domain_re
.
match
(
value
)
is
not
None
def
val_domain
(
value
):
"""Validate whether the parameter is a valid domin name."""
if
not
is_valid_domain
(
value
):
raise
ValidationError
(
_
(
u'
%
s - invalid domain name'
)
%
value
)
def
is_valid_reverse_domain
(
value
):
"""Check whether the parameter is a valid reverse domain name."""
return
reverse_domain_re
.
match
(
value
)
is
not
None
def
val_reverse_domain
(
value
):
"""Validate whether the parameter is a valid reverse domain name."""
if
not
is_valid_reverse_domain
(
value
):
raise
ValidationError
(
u'
%
s - invalid reverse domain name'
%
value
)
def
is_valid_ipv4_address
(
value
):
"""Check whether the parameter is a valid IPv4 address."""
return
ipv4_re
.
match
(
value
)
is
not
None
def
val_ipv4
(
value
):
"""Validate whether the parameter is a valid IPv4 address."""
if
not
is_valid_ipv4_address
(
value
):
raise
ValidationError
(
_
(
u'
%
s - not an IPv4 address'
)
%
value
)
def
val_ipv6
(
value
):
"""Validate whether the parameter is a valid IPv6 address."""
if
not
is_valid_ipv6_address
(
value
):
raise
ValidationError
(
_
(
u'
%
s - not an IPv6 address'
)
%
value
)
def
val_mx
(
value
):
"""Validate whether the parameter is a valid MX address definition.
...
...
@@ -84,9 +97,10 @@ def val_mx(value):
raise
ValidationError
(
_
(
"Bad MX address format. "
"Should be: <priority>:<hostname>"
))
def
ipv4_2_ipv6
(
ipv4
):
"""Convert IPv4 address string to IPv6 address string."""
val_ipv4
(
ipv4
)
m
=
ipv4_re
.
match
(
ipv4
)
return
(
"2001:738:2001:4031:
%
s:
%
s:
%
s:0"
%
(
m
.
group
(
1
),
m
.
group
(
2
),
m
.
group
(
3
)))
(
m
.
group
(
1
),
m
.
group
(
2
),
m
.
group
(
3
)))
firewall/fw.py
View file @
29bbf837
This diff is collapsed.
Click to expand it.
firewall/models.py
View file @
29bbf837
...
...
@@ -4,7 +4,9 @@ from django.contrib.auth.models import User
from
django.db
import
models
from
django.forms
import
ValidationError
from
django.utils.translation
import
ugettext_lazy
as
_
from
firewall.fields
import
*
from
firewall.fields
import
(
MACAddressField
,
val_alfanum
,
val_reverse_domain
,
val_domain
,
val_ipv4
,
val_ipv6
,
val_mx
,
ipv4_2_ipv6
)
from
django.core.validators
import
MinValueValidator
,
MaxValueValidator
import
django.conf
from
django.db.models.signals
import
post_save
...
...
@@ -85,7 +87,7 @@ class Rule(models.Model):
"(if type is vlan)."
))
vlangroup
=
models
.
ForeignKey
(
'VlanGroup'
,
related_name
=
"rules"
,
blank
=
True
,
null
=
True
,
verbose_name
=
_
(
"vlan group"
),
"vlan group"
),
help_text
=
_
(
"Group of vlans the rule "
"applies to (if type is vlan)."
))
host
=
models
.
ForeignKey
(
'Host'
,
related_name
=
"rules"
,
blank
=
True
,
...
...
@@ -185,15 +187,17 @@ class Vlan(models.Model):
ipv4
=
models
.
GenericIPAddressField
(
protocol
=
'ipv4'
,
unique
=
True
,
verbose_name
=
_
(
'IPv4 address'
),
help_text
=
_
(
'The IPv4 address of the gateway. '
'Recommended value is the last valid '
'address of the subnet, for example '
'10.4.255.254 for 10.4.0.0/16.'
))
'The IPv4 address of the gateway. '
'Recommended value is the last '
'valid address of the subnet, '
'for example '
'10.4.255.254 for 10.4.0.0/16.'
))
ipv6
=
models
.
GenericIPAddressField
(
protocol
=
'ipv6'
,
unique
=
True
,
verbose_name
=
_
(
'IPv6 address'
),
help_text
=
_
(
'The IPv6 address of the gateway.'
))
'The IPv6 address of the '
'gateway.'
))
snat_ip
=
models
.
GenericIPAddressField
(
protocol
=
'ipv4'
,
blank
=
True
,
null
=
True
,
verbose_name
=
_
(
'NAT IP address'
),
...
...
firewall/tasks.py
View file @
29bbf837
from
celery.task
import
Task
,
PeriodicTask
import
celery
from
django.core.cache
import
cache
import
os
import
time
from
firewall.fw
import
*
import
django.conf
settings
=
django
.
conf
.
settings
.
FIREWALL_SETTINGS
@celery.task
def
reload_dns_task
(
data
):
pass
@celery.task
def
reload_firewall_task
(
data4
,
data6
):
pass
@celery.task
def
reload_dhcp_task
(
data
):
pass
@celery.task
def
reload_blacklist_task
(
data
):
pass
class
Periodic
(
PeriodicTask
):
run_every
=
timedelta
(
seconds
=
10
)
...
...
@@ -48,6 +54,7 @@ class Periodic(PeriodicTask):
reload_blacklist_task
.
delay
(
list
(
ipset
()))
print
"blacklist ujratoltese kesz"
class
ReloadTask
(
Task
):
def
run
(
self
,
type
=
'Host'
):
...
...
@@ -64,4 +71,3 @@ class ReloadTask(Task):
cache
.
add
(
"blacklist_lock"
,
"true"
,
30
)
print
type
firewall/views.py
View file @
29bbf837
...
...
@@ -2,12 +2,10 @@ import base64
import
datetime
import
json
import
re
import
sys
from
django.conf
import
settings
from
django.db
import
IntegrityError
from
django.http
import
HttpResponse
from
django.shortcuts
import
render_to_response
from
django.template.loader
import
render_to_string
from
django.utils
import
translation
from
django.utils.timezone
import
utc
...
...
@@ -15,13 +13,13 @@ from django.utils.translation import ugettext_lazy as _
from
django.views.decorators.csrf
import
csrf_exempt
from
django.views.decorators.http
import
require_POST
from
celery.task.control
import
inspect
from
tasks
import
*
from
firewall.fw
import
*
from
firewall.models
import
*
from
one.tasks
import
SendMailTask
def
reload_firewall
(
request
):
if
request
.
user
.
is_authenticated
():
if
request
.
user
.
is_superuser
:
...
...
@@ -34,34 +32,44 @@ def reload_firewall(request):
html
=
_
(
"Dear anonymous, you've not signed in yet!"
)
return
HttpResponse
(
html
)
@csrf_exempt
@require_POST
def
firewall_api
(
request
):
try
:
data
=
json
.
loads
(
base64
.
b64decode
(
request
.
POST
[
"data"
]))
data
=
json
.
loads
(
base64
.
b64decode
(
request
.
POST
[
"data"
]))
command
=
request
.
POST
[
"command"
]
if
data
[
"password"
]
!=
"bdmegintelrontottaanetet"
:
raise
Exception
(
_
(
"Wrong password."
))
if
command
==
"blacklist"
:
obj
,
created
=
Blacklist
.
objects
.
get_or_create
(
ipv4
=
data
[
"ip"
])
obj
.
reason
=
data
[
"reason"
]
obj
.
snort_message
=
data
[
"snort_message"
]
obj
.
reason
=
data
[
"reason"
]
obj
.
snort_message
=
data
[
"snort_message"
]
if
created
:
try
:
obj
.
host
=
Host
.
objects
.
get
(
ipv4
=
data
[
"ip"
])
user
=
obj
.
host
.
owner
lang
=
user
.
person_set
.
all
()[
0
]
.
language
translation
.
activate
(
lang
)
msg
=
render_to_string
(
'mails/notification-ban-now.txt'
,
{
'user'
:
user
,
'bl'
:
obj
,
'instance:'
:
obj
.
host
.
instance_set
.
get
(),
'url'
:
settings
.
CLOUD_URL
}
)
SendMailTask
.
delay
(
to
=
obj
.
host
.
owner
.
email
,
subject
=
'[IK Cloud]
%
s'
%
obj
.
host
.
instance_set
.
get
()
.
name
,
msg
=
msg
,
sender
=
u'cloud@ik.bme.hu'
)
except
(
Host
.
DoesNotExist
,
ValidationError
,
IntegrityError
,
AttributeError
):
msg
=
render_to_string
(
'mails/notification-ban-now.txt'
,
{
'user'
:
user
,
'bl'
:
obj
,
'instance:'
:
obj
.
host
.
instance_set
.
get
(),
'url'
:
settings
.
CLOUD_URL
})
SendMailTask
.
delay
(
to
=
obj
.
host
.
owner
.
email
,
subject
=
'[IK Cloud]
%
s'
%
obj
.
host
.
instance_set
.
get
()
.
name
,
msg
=
msg
,
sender
=
u'cloud@ik.bme.hu'
)
except
(
Host
.
DoesNotExist
,
ValidationError
,
IntegrityError
,
AttributeError
):
pass
if
obj
.
type
==
'tempwhite'
and
obj
.
modified_at
+
datetime
.
timedelta
(
minutes
=
1
)
<
datetime
.
datetime
.
utcnow
()
.
replace
(
tzinfo
=
utc
):
modified
=
obj
.
modified_at
+
datetime
.
timedelta
(
minutes
=
1
)
now
=
datetime
.
dateime
.
utcnow
()
.
replace
(
tzinfo
=
utc
)
if
obj
.
type
==
'tempwhite'
and
modified
<
now
:
obj
.
type
=
'tempban'
obj
.
save
()
return
HttpResponse
(
unicode
(
_
(
"OK"
)))
...
...
@@ -75,27 +83,26 @@ def firewall_api(request):
data
[
"owner"
]
=
"opennebula"
owner
=
auth
.
models
.
User
.
objects
.
get
(
username
=
data
[
"owner"
])
host
=
Host
(
hostname
=
data
[
"hostname"
],
vlan
=
Vlan
.
objects
.
get
(
name
=
data
[
"vlan"
]),
mac
=
data
[
"mac"
],
ipv4
=
data
[
"ip"
],
owner
=
owner
,
description
=
data
[
"description"
],
pub_ipv4
=
vlan
=
Vlan
.
objects
.
get
(
name
=
data
[
"vlan"
]),
mac
=
data
[
"mac"
],
ipv4
=
data
[
"ip"
],
owner
=
owner
,
description
=
data
[
"description"
],
pub_ipv4
=
Vlan
.
objects
.
get
(
name
=
data
[
"vlan"
])
.
snat_ip
,
shared_ip
=
True
)
shared_ip
=
True
)
host
.
full_clean
()
host
.
save
()
host
.
enable_net
()
for
p
in
data
[
"portforward"
]:
host
.
add_port
(
proto
=
p
[
"proto"
],
public
=
int
(
p
[
"public_port"
]),
private
=
int
(
p
[
"private_port"
]))
host
.
add_port
(
proto
=
p
[
"proto"
],
public
=
int
(
p
[
"public_port"
]),
private
=
int
(
p
[
"private_port"
]))
elif
command
==
"destroy"
:
data
[
"owner"
]
=
"opennebula"
print
data
[
"hostname"
]
owner
=
auth
.
models
.
User
.
objects
.
get
(
username
=
data
[
"owner"
])
host
=
Host
.
objects
.
get
(
hostname
=
data
[
"hostname"
],
owner
=
owner
)
owner
=
owner
)
host
.
delete
()
else
:
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment