diff --git a/network/filter/component.xml b/network/filter/component.xml new file mode 100644 index 0000000000..898a0b6bd9 --- /dev/null +++ b/network/filter/component.xml @@ -0,0 +1,3 @@ + + network.filter + diff --git a/network/filter/iproute2/actions.py b/network/filter/iproute2/actions.py new file mode 100644 index 0000000000..e12f5fe31b --- /dev/null +++ b/network/filter/iproute2/actions.py @@ -0,0 +1,25 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import get + +def setup(): + autotools.configure() + +def build(): + autotools.make('CC="%s" RPM_OPT_FLAGS="%s"' % (get.CC(), get.CFLAGS())) + +def install(): + autotools.rawInstall("DESTDIR=\"%s\" \ + SBINDIR=/sbin \ + DOCDIR=/%s/%s \ + MANDIR=/usr/share/man \ + " % (get.installDIR(), get.docDIR(), get.srcNAME())) + + pisitools.dodir("/usr/sbin") + pisitools.dodir("/var/lib/arpd") diff --git a/network/filter/iproute2/files/iproute2-2.6.29-IPPROTO_IP_for_SA.patch b/network/filter/iproute2/files/iproute2-2.6.29-IPPROTO_IP_for_SA.patch new file mode 100644 index 0000000000..48ffcb4274 --- /dev/null +++ b/network/filter/iproute2/files/iproute2-2.6.29-IPPROTO_IP_for_SA.patch @@ -0,0 +1,11 @@ +diff -up iproute2-2.6.29/ip/ipxfrm.c.old iproute2-2.6.29/ip/ipxfrm.c +--- iproute2-2.6.29/ip/ipxfrm.c.old 2009-03-24 23:15:14.000000000 +0100 ++++ iproute2-2.6.29/ip/ipxfrm.c 2009-04-24 09:35:58.203735119 +0200 +@@ -1156,6 +1156,7 @@ static int xfrm_selector_upspec_parse(st + case IPPROTO_UDP: + case IPPROTO_SCTP: + case IPPROTO_DCCP: ++ case IPPROTO_IP: /* to allow shared SA for different protocols */ + break; + default: + fprintf(stderr, "\"sport\" and \"dport\" are invalid with proto=%s\n", strxf_proto(sel->proto)); diff --git a/network/filter/iproute2/files/iproute2-2.6.29-kernel.patch b/network/filter/iproute2/files/iproute2-2.6.29-kernel.patch new file mode 100644 index 0000000000..df9125ac0c --- /dev/null +++ b/network/filter/iproute2/files/iproute2-2.6.29-kernel.patch @@ -0,0 +1,11 @@ +diff -up iproute2-20091009/Makefile.kernel iproute2-20091009/Makefile +--- iproute2-20091009/Makefile.kernel 2009-09-21 10:26:11.000000000 +0200 ++++ iproute2-20091009/Makefile 2009-10-09 12:27:03.687382422 +0200 +@@ -6,6 +6,7 @@ CONFDIR=/etc/iproute2 + DOCDIR=/share/doc/iproute2 + MANDIR=/share/man + ARPDDIR=/var/lib/arpd ++KERNEL_INCLUDE=/usr/include + + # Path to db_185.h include + DBM_INCLUDE:=$(ROOTDIR)/usr/include diff --git a/network/filter/iproute2/files/iproute2-2.6.31-tc_modules.patch b/network/filter/iproute2/files/iproute2-2.6.31-tc_modules.patch new file mode 100644 index 0000000000..0daa17bf8e --- /dev/null +++ b/network/filter/iproute2/files/iproute2-2.6.31-tc_modules.patch @@ -0,0 +1,12 @@ +diff -up iproute2-2.6.31/Makefile.old iproute2-2.6.31/Makefile +--- iproute2-2.6.31/Makefile.old 2010-01-04 12:46:47.000000000 +0100 ++++ iproute2-2.6.31/Makefile 2010-01-04 12:50:17.396384644 +0100 +@@ -13,7 +13,7 @@ DBM_INCLUDE:=$(ROOTDIR)/usr/include + + SHARED_LIBS = y + +-DEFINES= -DRESOLVE_HOSTNAMES -DLIBDIR=\"$(LIBDIR)\" ++DEFINES= -DRESOLVE_HOSTNAMES -DLIBDIR=\"$(LIBDIR)\" -DIPT_LIB_DIR=\"$(IPT_LIB_DIR)\" + ifneq ($(SHARED_LIBS),y) + DEFINES+= -DNO_SHARED_LIBS + endif diff --git a/network/filter/iproute2/files/iproute2-example-cbq-service.patch b/network/filter/iproute2/files/iproute2-example-cbq-service.patch new file mode 100644 index 0000000000..f8b4978161 --- /dev/null +++ b/network/filter/iproute2/files/iproute2-example-cbq-service.patch @@ -0,0 +1,22 @@ +diff -up iproute2-20091106/examples/cbq.init-v0.7.3.fix iproute2-20091106/examples/cbq.init-v0.7.3 +--- iproute2-20091106/examples/cbq.init-v0.7.3.fix 2009-11-10 19:41:44.000000000 +0100 ++++ iproute2-20091106/examples/cbq.init-v0.7.3 2009-11-27 13:36:07.957310549 +0100 +@@ -579,14 +579,14 @@ cbq_show () { + ### Check configuration and load DEVICES, DEVFIELDS and CLASSLIST from $1 + cbq_init () { + ### Get a list of configured classes +- CLASSLIST=`find $1 \( -type f -or -type l \) -name 'cbq-*' \ +- -not -name '*~' -maxdepth 1 -printf "%f\n"| sort` ++ CLASSLIST=`find $1 -maxdepth 1 \( -type f -or -type l \) -name 'cbq-*' \ ++ -not -name '*~' -printf "%f\n"| sort` + [ -z "$CLASSLIST" ] && + cbq_failure "no configuration files found in $1!" + + ### Gather all DEVICE fields from $1/cbq-* +- DEVFIELDS=`find $1 \( -type f -or -type l \) -name 'cbq-*' \ +- -not -name '*~' -maxdepth 1| xargs sed -n 's/#.*//; \ ++ DEVFIELDS=`find $1 -maxdepth 1 \( -type f -or -type l \) -name 'cbq-*' \ ++ -not -name '*~' | xargs sed -n 's/#.*//; \ + s/[[:space:]]//g; /^DEVICE=[^,]*,[^,]*\(,[^,]*\)\?/ \ + { s/.*=//; p; }'| sort -u` + [ -z "$DEVFIELDS" ] && diff --git a/network/filter/iproute2/files/iproute2-libxtables6.diff b/network/filter/iproute2/files/iproute2-libxtables6.diff new file mode 100644 index 0000000000..ed2e16a397 --- /dev/null +++ b/network/filter/iproute2/files/iproute2-libxtables6.diff @@ -0,0 +1,31 @@ +From: Jan Engelhardt +Date: 2011-06-01 00:52:29+0200 + +--- + tc/m_xt.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +Index: iproute2-2.6.38/tc/m_xt.c +=================================================================== +--- iproute2-2.6.38.orig/tc/m_xt.c ++++ iproute2-2.6.38/tc/m_xt.c +@@ -162,7 +162,8 @@ static int parse_ipt(struct action_util + return -1; + } + tcipt_globals.opts = +- xtables_merge_options(tcipt_globals.opts, ++ xtables_merge_options(tcipt_globals.orig_opts, ++ tcipt_globals.opts, + m->extra_opts, + &m->option_offset); + } else { +@@ -307,7 +308,8 @@ print_ipt(struct action_util *au,FILE * + } + + tcipt_globals.opts = +- xtables_merge_options(tcipt_globals.opts, ++ xtables_merge_options(tcipt_globals.orig_opts, ++ tcipt_globals.opts, + m->extra_opts, + &m->option_offset); + } else { diff --git a/network/filter/iproute2/files/iproute2-xt.diff b/network/filter/iproute2/files/iproute2-xt.diff new file mode 100644 index 0000000000..181d44050e --- /dev/null +++ b/network/filter/iproute2/files/iproute2-xt.diff @@ -0,0 +1,22 @@ +From: Jan Engelhardt +Date: 2011-06-01 00:52:07+0200 + +--- + tc/m_xt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +Index: iproute2-2.6.37/tc/m_xt.c +=================================================================== +--- iproute2-2.6.37.orig/tc/m_xt.c ++++ iproute2-2.6.37/tc/m_xt.c +@@ -343,8 +343,8 @@ print_ipt(struct action_util *au,FILE * + return 0; + } + +-struct action_util ipt_action_util = { +- .id = "ipt", ++struct action_util xt_action_util = { ++ .id = "xt", + .parse_aopt = parse_ipt, + .print_aopt = print_ipt, + }; diff --git a/network/filter/iproute2/pspec.xml b/network/filter/iproute2/pspec.xml new file mode 100644 index 0000000000..9a22b3e6d8 --- /dev/null +++ b/network/filter/iproute2/pspec.xml @@ -0,0 +1,65 @@ + + + + + iproute2 + http://linux-net.osdl.org/index.php/Iproute2 + + PisiLinux Community + admins@pisilinux.org + + GPLv2 + app:console + Kernel routing and traffic control utilities + Iproute2 is a collection of utilites for controlling TCP/IP networking and traffic control in Linux. + https://www.kernel.org/pub/linux/utils/net/iproute2/iproute2-4.0.0.tar.xz + + iptables-devel + linux-atm-devel + db-devel + + + + + iproute2 + + linux-atm + iptables + db + + + /etc + /sbin + /usr/sbin + /lib + /usr/lib + /usr/share/man + /usr/share/doc + /var/lib + + + + + + 2015-04-13 + 4.0.0 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + + + 2013-11-23 + 3.12.0 + Version bump + Richard de Bruin + richdb@pisilinux.org + + + 2012-09-01 + 3.5.1 + First release + PisiLinux Community + admins@pisilinux.org + + + diff --git a/network/filter/iproute2/translations.xml b/network/filter/iproute2/translations.xml new file mode 100644 index 0000000000..3281e88d0b --- /dev/null +++ b/network/filter/iproute2/translations.xml @@ -0,0 +1,8 @@ + + + + iproute2 + Çekirdek içinde yer alan ağ trafiği yönlendirme ve trafik kontrol araçları. + Iproute2 TCP/IP ağları ve trafik kontrolü için araçlar içeren bir koolleksiyondur. + + diff --git a/network/filter/iptables/actions.py b/network/filter/iptables/actions.py new file mode 100644 index 0000000000..be96668983 --- /dev/null +++ b/network/filter/iptables/actions.py @@ -0,0 +1,32 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools +from pisi.actionsapi import get + +def setup(): + autotools.configure("--sbindir=/sbin \ + --libexecdir=/usr/lib \ + --without-kernel \ + --enable-devel \ + --enable-libipq \ + --enable-shared \ + --enable-static") + +def build(): + autotools.make("V=1") + +def install(): + autotools.rawInstall('DESTDIR="%s"' % get.installDIR()) + + pisitools.insinto("/usr/include", "include/iptables.h") + pisitools.insinto("/usr/include", "include/ip6tables.h") + pisitools.insinto("/usr/include/libiptc", "include/libiptc/*.h") + + pisitools.dodir("/var/lib/iptables") + pisitools.dodir("/etc/iptables") diff --git a/network/filter/iptables/comar/firewall.py b/network/filter/iptables/comar/firewall.py new file mode 100644 index 0000000000..7939b7a53b --- /dev/null +++ b/network/filter/iptables/comar/firewall.py @@ -0,0 +1,528 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- + +# i18n + +MSG_CONNECTION_NAME = { + "en": "Internet Sharing", + "tr": "Internet Paylaşımı", + "sv": "Internetdelning", + "fr": "Partage de connexion Internet", + "es": "Compartir Internet", + "de": "Internet Freigabe", + "nl": "Internetverbinding delen", +} + +MSG_ALLOWED_PORTS = { + "en": "Allowed Port Numbers", + "tr": "İzin Verilen Port Numaraları", + "sv": "Tillåtna portar", + "fr": "Numéros de port autorisés", + "es": "Números de puertos permitidos", + "de": "Erlaubte Ports", + "nl": "Toegestane poortnummers", +} + +MSG_FORBIDDEN_PORTS = { + "en": "Forbidden Port Numbers", + "tr": "İzin Verilmeyen Port Numaraları", + "sv": "Otillåtna portar", + "nl": "Verboden poortnummers", +} + +MSG_GATEWAY_HOME = { + "en": "Gate to Home Network", + "tr": "Ev Ağına Çıkış", + "sv": "Länk till lokalt nätverk", + "fr": "Passerelle vers le réseau local", + "es": "Enlace a la red doméstica", + "de": "Gateway zum Haus-Netzwerk", + "nl": "Gateway naar thuisnetwerk", +} + +MSG_GATEWAY_INTERNET = { + "en": "Gate to Internet", + "tr": "Internet'e Çıkış", + "sv": "Länk till internet", + "fr": "Passerelle vers Internet", + "es": "Enlace a Internet", + "de": "Gateway zum Internet", + "nl": "Gateway naar Internet", +} + +TITLE_BLOCK_INCOMING = { + "en": "Block Incoming Connections", + "tr": "Gelen Bağlantıları Engelle", + "sv": "Blockera inkommande anslutningar", + "fr": "Bloquer les connexions entrantes", + "es": "Bloquear conexiones entrantes", + "de": "Eingehende Verbindungen blockieren", + "nl": "Inkomende verbindingen blokkeren", +} +DESCRIPTION_BLOCK_INCOMING = { + "en": "Blocks all incoming connections to the computer. Exceptions can be set from configuration dialog.", + "tr": "Bilgisayara gelen tüm bağlantıları engeller. İstisnalar ayarlar penceresinden belirlenebilir.", + "sv": "Blockerar alla inkommande anslutningar till datorn. Undantag kan läggas till under inställningar.", + "fr": "Bloque toute les connexions entrantes dans l'ordinateur. Des exceptions peuvent être définies dans la fenêtre de configuration.", + "es": "Bloquea todas las conexiones entrantes a la computadora. Se puede especificar excepciones desde el dialogo de configuración.", + "de": "Blockiert alle eingehenden Verbindungen. Im Konfigurations-Dialog können Ausnahmen angegeben werden.", + "nl": "Alle inkomende verbindingen naar deze computer blokkeren. Uitzonderingen kunnen in een configuratiedialoog ingesteld worden.", +} + +TITLE_BLOCK_OUTGOING = { + "en": "Block Outgoing Connections", + "tr": "Giden Bağlantıları Engelle", + "sv": "Blockera utgående anslutningar", + "fr": "Bloquer les connexions sortantes", + "es": "Bloquear conexiones salientes", + "de": "Ausgehende Verbindungen blockieren", + "nl": "Uitgaande verbindingen blokkeren", +} +DESCRIPTION_BLOCK_OUTGOING = { + "en": "Blocks outgoing connections. Forbidden ports can be set from configuration dialog.", + "tr": "Dışarı yapılan bağlantıları engeller. Yasaklı port numaraları ayarlar penceresinden belirlenebilir.", + "sv": "Blockerar alla utgående anslutningar till datorn. Undantag kan läggas till under inställningar.", + "nl": "Uitgaande verbindingen blokkeren. Verboden poorten kunnen in een configuratiedialoog ingesteld worden.", +} + +TITLE_INTERNET_SHARING = { + "en": "Internet Sharing", + "tr": "Internet Paylaşımı", + "sv": "Internetdelning", + "fr": "Partage de connexion Internet", + "es": "Compartir Internet", + "de": "Internet Freigabe", + "nl": "Internetverbinding delen", +} +DESCRIPTION_INTERNET_SHARING = { + "en": "Allows computers in your local network to connect Internet through this computer.", + "tr": "Yerel ağınızdaki bilgisayarların, bu bilgisayarı kullanarak Internet'e bağlanmalarını sağlar.", + "sv": "Låter datorer i det lokala nätverket ansluta till internet via den här datorn.", + "fr": "Permet aux ordinateurs de votre réseau domestique de se connecter à Internet via cet ordinateur.", + "es": "Permitir a otros computadoras en su red local acceder a la Internet, a través de ésta computadora", + "de": "Gibt anderen Computern aus dem lokalen Netzwer die Mäglichkeit, Internet durch diesen Computer hier zu benutzen.", + "nl": "Geeft andere computers in het lokale netwerk via deze computer toegang tot het internet.", +} + + +# Don't touch below, if you don't know what you're doing. + +# Module configuration settings and templates + +FIREWALL_CONF = "/etc/firewall.conf" + +IPTABLES_RULES = { + 'filter': [ + '-P INPUT DROP', # Default policies + '-P FORWARD DROP', + '-P OUTPUT ACCEPT', + '-N PARDUS-IN', # Module container table for INPUT + '-N PARDUS-IN-MOD-BLOCK', # Table for BlockIncoming rules + '-N PARDUS-FW', # Module container table for FORWARD + '-N PARDUS-FW-MOD-SHARING', # Table for InternetSharingModule rules + '-N PARDUS-FW-MOD-BLOCK', # Table for BlockOutgoing rules + '-N PARDUS-OUT', # Module container table for OUTPUT + '-N PARDUS-OUT-MOD-BLOCK', # Table for BlockOutgoing rules + '-A INPUT -i lo -j ACCEPT', # Accept local + '-A FORWARD -o lo -j ACCEPT', + '-A INPUT -m state --state INVALID -j DROP', + '-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT', + '-A INPUT -j PARDUS-IN', # Jump into container tables + '-A FORWARD -j PARDUS-FW', + '-A OUTPUT -j PARDUS-OUT', + '-A PARDUS-IN -j PARDUS-IN-MOD-BLOCK' , # Jump into module tables + '-A PARDUS-FW -j PARDUS-FW-MOD-BLOCK', + '-A PARDUS-FW -j PARDUS-FW-MOD-SHARING', + '-A PARDUS-OUT -j PARDUS-OUT-MOD-BLOCK', + '-A INPUT -m state --state NEW -j ACCEPT', + ], + 'nat': [ + '-P PREROUTING ACCEPT', + '-P POSTROUTING ACCEPT', + '-P OUTPUT ACCEPT', + '-N PARDUS-POST', + '-N PARDUS-POST-MOD-SHARING', + '-A POSTROUTING -j PARDUS-POST', + '-A PARDUS-POST -j PARDUS-POST-MOD-SHARING', + ], +} + +DHCPD_CONF = """ +ddns-update-style interim; +ignore client-updates; +max-lease-time 500; +default-lease-time 500; +option domain-name-servers 193.140.100.220; +option routers 172.16.0.1; +option subnet-mask 255.255.255.0; +subnet 172.16.0.0 netmask 255.255.255.0 { + range 172.16.0.2 172.16.0.254; +} +""" + +# Utils + +import os +import subprocess + +from pardus import iniutils +from pardus import netutils +from pardus import netfilterutils + +INI = iniutils.iniParser(FIREWALL_CONF) + +def listModuleConfigs(): + """ + Returns a list of modules that are configured. + """ + try: + modules = INI.listSections() + except iniutils.iniParserError: + return + if "general" in modules: + modules.remove("general") + return modules + +class ModuleConfig: + """ + Module configuration parser. + """ + def __init__(self, name): + self.name = name + try: + self.info = INI.getSection(name) + except iniutils.iniParserError: + self.info = {} + + def delete(self): + INI.removeSection(self.name) + + def save(self): + is_new = self.name not in listModuleConfigs() + INI.setSection(self.name, self.info) + +def getServiceState(package): + """ + Returns state of a service. + """ + return call(package, "System.Service", "info")[2] in ["on", "started"] + +def stopService(package, permanent=False): + """ + Stops a service. + """ + call(package, "System.Service", "stop") + if permanent: + call(package, "System.Service", "setState", ("off")) + +def startService(package, restart=False, auto_start=False): + """ + Starts a service. + """ + if restart: + stopService(package) + if not getServiceState(package): + call(package, "System.Service", "start") + if auto_start: + call(package, "System.Service", "setState", ("on")) + +def initializeIPTables(): + """ + Initializes IPTables. + """ + # Active rules + rules_active = netfilterutils.parseConf(netfilterutils.getRules()) + + # Compare rules + for chain, rules in IPTABLES_RULES.iteritems(): + if chain not in rules_active or len(set(rules) - set(rules_active[chain])): + # At least one different rule, need re-initialization + netfilterutils.clear() + conf = netfilterutils.makeConf(IPTABLES_RULES) + netfilterutils.restoreRules(conf) + break + +def execRule(rule): + """ + Executes IPTables rule + """ + rule = rule.split() + rule.insert(0, "/sbin/iptables") + subprocess.call(rule) + +def createConnection(package, device): + import comar + link = comar.Link() + connection = _(MSG_CONNECTION_NAME) + link.Network.Link[package].setDevice(connection, device) + link.Network.Link[package].setAddress(connection, "manual", "172.16.0.1", "255.255.255.0", "") + return connection + +def findOrCreateConnection(link, device): + o_package, o_connecion = None, None + for package in link.Network.Link: + if device in link.Network.Link[package].deviceList(): + for connection in link.Network.Link[package].connections(): + info = link.Network.Link[package].connectionInfo(connection) + if info.get("net_address", "") == "172.16.0.1": + return package, connection + return package, createConnection(package, device) + +def makeDHCPConf(interface): + file("/etc/dhcp/dhcpd.conf", "w").write(DHCPD_CONF) + file("/etc/conf.d/dhcpd", "w").write("DHCPD_IFACE=%s" % interface) + +# Modules + +class BlockIncoming: + def __init__(self): + self.parametersLast = {} + + def getInfo(self): + title = _(TITLE_BLOCK_INCOMING) + description = _(DESCRIPTION_BLOCK_INCOMING) + icon = "network-server" + return (title, description, icon) + + def getParameters(self): + parameters = [ + ("port_exceptions", _(MSG_ALLOWED_PORTS), "editlist", {"format": "[0-9\-]+"}), + ] + return parameters + + def checkModule(self, parameters={}, quiet=False): + pass + + def loadModule(self, parameters={}): + # Initialize IPTables + initializeIPTables() + # Flush rules + self.unloadModule() + # Load rules + for port in parameters.get("port_exceptions", "").split(): + if "-" in port: + port = port.replace("-", ":") + execRule("-A PARDUS-IN-MOD-BLOCK -p tcp -m multiport --dports %s -j ACCEPT" % port) + execRule("-A PARDUS-IN-MOD-BLOCK -p udp -m multiport --dports %s -j ACCEPT" % port) + # Block else... + execRule("-A PARDUS-IN-MOD-BLOCK -p tcp -m multiport --dports 0:1024 -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable") + execRule("-A PARDUS-IN-MOD-BLOCK -p udp -m multiport --dports 0:1024 -j REJECT --reject-with icmp-port-unreachable") + execRule("-A PARDUS-IN-MOD-BLOCK -j REJECT --reject-with icmp-host-prohibited") + + def unloadModule(self, shutdown=False): + if not shutdown: + # Unload rules + execRule("-F PARDUS-IN-MOD-BLOCK") + + +class BlockOutgoing: + def __init__(self): + self.parametersLast = {} + + def getInfo(self): + title = _(TITLE_BLOCK_OUTGOING) + description = _(DESCRIPTION_BLOCK_OUTGOING) + icon = "security-medium" + return (title, description, icon) + + def getParameters(self): + parameters = [ + ("port_exceptions", _(MSG_FORBIDDEN_PORTS), "editlist", {"format": "[0-9\-]+"}), + ] + return parameters + + def checkModule(self, parameters={}, quiet=False): + pass + + def loadModule(self, parameters={}): + # Initialize IPTables + initializeIPTables() + # Flush rules + self.unloadModule() + # Load rules + for port in parameters.get("port_exceptions", "").split(): + if "-" in port: + port = port.replace("-", ":") + execRule("-A PARDUS-OUT-MOD-BLOCK -p tcp -m multiport --dports %s -j DROP" % port) + execRule("-A PARDUS-OUT-MOD-BLOCK -p udp -m multiport --dports %s -j DROP" % port) + execRule("-A PARDUS-FW-MOD-BLOCK -p tcp -m multiport --dports %s -j DROP" % port) + execRule("-A PARDUS-FW-MOD-BLOCK -p udp -m multiport --dports %s -j DROP" % port) + + def unloadModule(self, shutdown=False): + if not shutdown: + # Unload rules + execRule("-F PARDUS-OUT-MOD-BLOCK") + execRule("-F PARDUS-FW-MOD-BLOCK") + + +class InternetSharingModule: + def __init__(self): + self.parametersLast = {} + + def getInfo(self): + title = _(TITLE_INTERNET_SHARING) + description = _(DESCRIPTION_INTERNET_SHARING) + icon = "network-workgroup" + return (title, description, icon) + + def getParameters(self): + def findInterfaces(wireless=True): + ifaces = [] + for iface in netutils.interfaces(): + if iface.name.startswith("lo") or iface.name.startswith("pan"): + continue + if not wireless and iface.isWireless(): + continue + if iface.isEthernet(): + dev_id = iface.deviceUID() + dev_name = netutils.deviceName(iface.deviceUID()) + if " - " in dev_name: + dev_name = dev_name.split(" - ")[1] + ifaces.append("%s\t%s" % (dev_id, dev_name)) + return ifaces + options_in = { + "choose": "\n".join(findInterfaces()) + } + options_out = { + "choose": "\n".join(findInterfaces(wireless=False)) + } + parameters = [ + ("device-input", _(MSG_GATEWAY_INTERNET), "combo", options_in), + ("device-output", _(MSG_GATEWAY_HOME), "combo", options_out), + ] + return parameters + + def checkModule(self, parameters={}, quiet=False): + pass + + def loadModule(self, parameters={}): + # Initialize IPTables + initializeIPTables() + # Flush rules + self.unloadModule() + # Enable forwarding + os.system("echo 1 > /proc/sys/net/ipv4/ip_forward") + os.system("echo 1 > /proc/sys/net/ipv4/ip_dynaddr") + # Load rules + input = parameters.get("device-input", "") + output = parameters.get("device-output", "") + if input and output and input != output: + in_name = input.split("_")[-1] + out_name = output.split("_")[-1] + execRule("-A PARDUS-FW-MOD-SHARING -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT" % (in_name, out_name)) + execRule("-A PARDUS-FW-MOD-SHARING -i %s -o %s -j ACCEPT" % (out_name, in_name)) + execRule("-t nat -A PARDUS-POST-MOD-SHARING -o %s -j MASQUERADE" % in_name) + # Create local NAT profile + import comar + link = comar.Link() + package, connection = findOrCreateConnection(link, output) + link.Network.Link[package].setState(connection, "up") + # Configure DHCP + makeDHCPConf(out_name) + # Start DHCP + startService("dhcpd", restart=True) + + def unloadModule(self, shutdown=False): + # Stop DHCP + stopService("dhcpd") + if not shutdown: + # Unload rules + execRule("-F PARDUS-FW-MOD-SHARING") + execRule("-P PARDUS-FW-MOD-SHARING ACCEPT") + execRule("-t nat -F PARDUS-POST-MOD-SHARING") + + +# Usable modules +MODULES = { + "internet_sharing": InternetSharingModule, + "block_incoming": BlockIncoming, + "block_outgoing": BlockOutgoing, +} + +# Network.Firewall model + +def listModules(): + return MODULES.keys() + +def moduleInfo(module): + inst = MODULES[module]() + return inst.getInfo() + +def moduleParameters(module): + inst = MODULES[module]() + return inst.getParameters() + +def getModuleState(module): + info = ModuleConfig(module).info + return info.get("state", "off") + +def setModuleState(name, state): + if state in ["on", "off"]: + # Save state + module = ModuleConfig(name) + module.info["state"] = state + module.save() + # Execute module if firewall is active + if getState() == "on": + inst = MODULES[name]() + if state == "on": + inst.loadModule(getModuleParameters(name)) + else: + inst.unloadModule() + # Notify clients + notify("Network.Firewall", "moduleStateChanged", (name, state)) + +def getModuleParameters(module): + info = ModuleConfig(module).info + return info + +def setModuleParameters(name, parameters): + # Save module parameters + module = ModuleConfig(name) + for key, value in parameters.iteritems(): + module.info[key] = value + module.save() + # Execute module if it's active + if getState() == "on" and getModuleState(name) == "on": + inst = MODULES[name]() + inst.checkModule(parameters) + inst.loadModule(parameters) + # Notify clients + notify("Network.Firewall", "moduleSettingsChanged", (name)) + +def getState(): + state = ModuleConfig("general").info.get("state", "off") + if state not in ["on", "off"] or not getServiceState(script()): + return "off" + return state + +def setState(state): + if state in ["on", "off"]: + # Save state + general = ModuleConfig("general") + general.info["state"] = state + general.save() + if state == "on": + # Start IPTables + startService(script(), auto_start=True) + # Execute active modules + for module in listModuleConfigs(): + if module not in MODULES: + continue + info = ModuleConfig(module).info + if info.get("state", "off") == "on": + inst = MODULES[module]() + inst.loadModule(getModuleParameters(module)) + else: + # Flush IPTables since every module depends on it + netfilterutils.clear() + # Stop IPTables + stopService(script(), permanent=True) + # Unload modules + for module in listModuleConfigs(): + if module not in MODULES: + continue + inst = MODULES[module]() + inst.unloadModule(shutdown=True) + # Notify clients + notify("Network.Firewall", "stateChanged", (state)) diff --git a/network/filter/iptables/comar/service.py b/network/filter/iptables/comar/service.py new file mode 100644 index 0000000000..103f24dffb --- /dev/null +++ b/network/filter/iptables/comar/service.py @@ -0,0 +1,69 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- + +from comar.service import * + +serviceType = "local" +serviceDesc = _({"en": "Firewall", + "tr": "Güvenlik Duvarı"}) + +LOCK_FILE = "/var/lock/subsys/iptables" +FIREWALL_PATH = "/etc/firewall.conf" + +import os +import pardus.netfilterutils as iptables +from pardus import iniutils + +def writeFile(filename, content="", mode=0600): + '''Writes content to filename and sets file mode.''' + file(filename, "w").write(content) + os.chmod(filename, mode) + +def readFile(filename): + """Return content of a file""" + return file(filename, "r").read() + +def startNetworkFirewall(): + INI = iniutils.iniParser(FIREWALL_PATH) + try: + info = INI.getSection("general") + except iniutils.iniParserError: + return + if info.get("state", "off") == "on": + call(script(), "Network.Firewall", "setState", ("on")) + +def stop(): + # Save rules + writeFile("/var/lib/iptables/rules", iptables.getRules()) + + # Clear chains & rules + iptables.clear() + + # Remove lock file + if os.access(LOCK_FILE, os.F_OK): + os.unlink(LOCK_FILE) + + # Notify clients + notify("System.Service", "Changed", (script(), "stopped")) + +def start(): + # Clear chains & rules + iptables.clear() + + # Load rules + profile_file = "/var/lib/iptables/rules" + if os.path.exists(profile_file): + rules = readFile(profile_file) + iptables.restoreRules(rules) + + # Create lock file + writeFile(LOCK_FILE, "") + + # Initialize Network.Firewall, if necessary + startNetworkFirewall() + + # Notify clients + notify("System.Service", "Changed", (script(), "started")) + +def status(): + return os.access(LOCK_FILE, os.F_OK) diff --git a/network/filter/iptables/pspec.xml b/network/filter/iptables/pspec.xml new file mode 100644 index 0000000000..0c035659e5 --- /dev/null +++ b/network/filter/iptables/pspec.xml @@ -0,0 +1,89 @@ + + + + + iptables + http://www.iptables.org/ + + PisiLinux Community + admins@pisilinux.org + + GPLv2 + app:console + Firewall, NAT and packet mangling tools + Contains iptables firewall, NAT and packet mangling tools. + ftp://ftp.netfilter.org/pub/iptables/iptables-1.4.21.tar.bz2 + + libnfnetlink-devel + + + + + + + + + iptables + + libnfnetlink + + + /usr/bin + /sbin + /lib + /usr/lib + /usr/share/man + /etc + /var + /usr/share/xtables + + + System.Service + Network.Firewall + + + + + iptables-devel + Development files for iptables + + iptables + + + /usr/include + /usr/lib/*.a + /usr/lib/pkgconfig + /usr/share/man/man3 + + + + + + 2013-11-23 + 1.4.21 + Version bump + Richard de Bruin + richdb@pisilinux.org + + + 2013-03-04 + 1.4.17 + Version bump + Yusuf Aydemir + yusuf.aydemir@pisilinux.org + + + 2012-10-21 + 1.4.16.3 + First release + + reverseDependencyUpdate + + PisiLinux Community + admins@pisilinux.org + + + diff --git a/network/filter/iptables/translations.xml b/network/filter/iptables/translations.xml new file mode 100644 index 0000000000..c56f16daf1 --- /dev/null +++ b/network/filter/iptables/translations.xml @@ -0,0 +1,13 @@ + + + + iptables + Güvenlik duvarı, ağ adres çevrimi ve paket çevrimi aracı + Iptables kural tabanlı gelişmiş güvenlik duvarı uygulamasıdır. + + + + iptables-devel + iptables için geliştirme dosyaları + +