Pisilinux/main
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

moved into main for pisi 2.0

Browse Source
This commit is contained in:
ayhanyalcinsoy
2015-07-04 15:11:14 +03:00
parent 44aa282132
commit d0e6c89825
15 changed files with 941 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
network/filter/component.xml
+3
View File
@@ -0,0 +1,3 @@
<PISI>
<Name>network.filter</Name>
</PISI>
network/filter/iproute2/actions.py
+25
View File
@@ -0,0 +1,25 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Licensed under the GNU General Public License, version 3.
# See the file http://www.gnu.org/licenses/gpl.txt
from pisi.actionsapi import autotools
from pisi.actionsapi import pisitools
from pisi.actionsapi import get
def setup():
autotools.configure()
def build():
autotools.make('CC="%s" RPM_OPT_FLAGS="%s"' % (get.CC(), get.CFLAGS()))
def install():
autotools.rawInstall("DESTDIR=\"%s\" \
SBINDIR=/sbin \
DOCDIR=/%s/%s \
MANDIR=/usr/share/man \
" % (get.installDIR(), get.docDIR(), get.srcNAME()))
pisitools.dodir("/usr/sbin")
pisitools.dodir("/var/lib/arpd")
network/filter/iproute2/files/iproute2-2.6.29-IPPROTO_IP_for_SA.patch
+11
View File
@@ -0,0 +1,11 @@
diff -up iproute2-2.6.29/ip/ipxfrm.c.old iproute2-2.6.29/ip/ipxfrm.c
--- iproute2-2.6.29/ip/ipxfrm.c.old 2009-03-24 23:15:14.000000000 +0100
+++ iproute2-2.6.29/ip/ipxfrm.c 2009-04-24 09:35:58.203735119 +0200
@@ -1156,6 +1156,7 @@ static int xfrm_selector_upspec_parse(st
case IPPROTO_UDP:
case IPPROTO_SCTP:
case IPPROTO_DCCP:
+ case IPPROTO_IP: /* to allow shared SA for different protocols */
break;
default:
fprintf(stderr, "\"sport\" and \"dport\" are invalid with proto=%s\n", strxf_proto(sel->proto));
network/filter/iproute2/files/iproute2-2.6.29-kernel.patch
+11
View File
@@ -0,0 +1,11 @@
diff -up iproute2-20091009/Makefile.kernel iproute2-20091009/Makefile
--- iproute2-20091009/Makefile.kernel 2009-09-21 10:26:11.000000000 +0200
+++ iproute2-20091009/Makefile 2009-10-09 12:27:03.687382422 +0200
@@ -6,6 +6,7 @@ CONFDIR=/etc/iproute2
DOCDIR=/share/doc/iproute2
MANDIR=/share/man
ARPDDIR=/var/lib/arpd
+KERNEL_INCLUDE=/usr/include
# Path to db_185.h include
DBM_INCLUDE:=$(ROOTDIR)/usr/include
network/filter/iproute2/files/iproute2-2.6.31-tc_modules.patch
+12
View File
@@ -0,0 +1,12 @@
diff -up iproute2-2.6.31/Makefile.old iproute2-2.6.31/Makefile
--- iproute2-2.6.31/Makefile.old 2010-01-04 12:46:47.000000000 +0100
+++ iproute2-2.6.31/Makefile 2010-01-04 12:50:17.396384644 +0100
@@ -13,7 +13,7 @@ DBM_INCLUDE:=$(ROOTDIR)/usr/include
SHARED_LIBS = y
-DEFINES= -DRESOLVE_HOSTNAMES -DLIBDIR=\"$(LIBDIR)\"
+DEFINES= -DRESOLVE_HOSTNAMES -DLIBDIR=\"$(LIBDIR)\" -DIPT_LIB_DIR=\"$(IPT_LIB_DIR)\"
ifneq ($(SHARED_LIBS),y)
DEFINES+= -DNO_SHARED_LIBS
endif
network/filter/iproute2/files/iproute2-example-cbq-service.patch
+22
View File
@@ -0,0 +1,22 @@
diff -up iproute2-20091106/examples/cbq.init-v0.7.3.fix iproute2-20091106/examples/cbq.init-v0.7.3
--- iproute2-20091106/examples/cbq.init-v0.7.3.fix 2009-11-10 19:41:44.000000000 +0100
+++ iproute2-20091106/examples/cbq.init-v0.7.3 2009-11-27 13:36:07.957310549 +0100
@@ -579,14 +579,14 @@ cbq_show () {
### Check configuration and load DEVICES, DEVFIELDS and CLASSLIST from $1
cbq_init () {
### Get a list of configured classes
- CLASSLIST=`find $1 \( -type f -or -type l \) -name 'cbq-*' \
- -not -name '*~' -maxdepth 1 -printf "%f\n"| sort`
+ CLASSLIST=`find $1 -maxdepth 1 \( -type f -or -type l \) -name 'cbq-*' \
+ -not -name '*~' -printf "%f\n"| sort`
[ -z "$CLASSLIST" ] &&
cbq_failure "no configuration files found in $1!"
### Gather all DEVICE fields from $1/cbq-*
- DEVFIELDS=`find $1 \( -type f -or -type l \) -name 'cbq-*' \
- -not -name '*~' -maxdepth 1| xargs sed -n 's/#.*//; \
+ DEVFIELDS=`find $1 -maxdepth 1 \( -type f -or -type l \) -name 'cbq-*' \
+ -not -name '*~' | xargs sed -n 's/#.*//; \
s/[[:space:]]//g; /^DEVICE=[^,]*,[^,]*\(,[^,]*\)\?/ \
{ s/.*=//; p; }'| sort -u`
[ -z "$DEVFIELDS" ] &&
network/filter/iproute2/files/iproute2-libxtables6.diff
+31
View File
@@ -0,0 +1,31 @@
From: Jan Engelhardt <jengelh@medozas.de>
Date: 2011-06-01 00:52:29+0200
---
tc/m_xt.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
Index: iproute2-2.6.38/tc/m_xt.c
===================================================================
--- iproute2-2.6.38.orig/tc/m_xt.c
+++ iproute2-2.6.38/tc/m_xt.c
@@ -162,7 +162,8 @@ static int parse_ipt(struct action_util
return -1;
}
tcipt_globals.opts =
- xtables_merge_options(tcipt_globals.opts,
+ xtables_merge_options(tcipt_globals.orig_opts,
+ tcipt_globals.opts,
m->extra_opts,
&m->option_offset);
} else {
@@ -307,7 +308,8 @@ print_ipt(struct action_util *au,FILE *
}
tcipt_globals.opts =
- xtables_merge_options(tcipt_globals.opts,
+ xtables_merge_options(tcipt_globals.orig_opts,
+ tcipt_globals.opts,
m->extra_opts,
&m->option_offset);
} else {
network/filter/iproute2/files/iproute2-xt.diff
+22
View File
@@ -0,0 +1,22 @@
From: Jan Engelhardt <jengelh@medozas.de>
Date: 2011-06-01 00:52:07+0200
---
tc/m_xt.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
Index: iproute2-2.6.37/tc/m_xt.c
===================================================================
--- iproute2-2.6.37.orig/tc/m_xt.c
+++ iproute2-2.6.37/tc/m_xt.c
@@ -343,8 +343,8 @@ print_ipt(struct action_util *au,FILE *
return 0;
}
-struct action_util ipt_action_util = {
- .id = "ipt",
+struct action_util xt_action_util = {
+ .id = "xt",
.parse_aopt = parse_ipt,
.print_aopt = print_ipt,
};
network/filter/iproute2/pspec.xml
+65
View File
@@ -0,0 +1,65 @@
<?xml version="1.0" ?>
<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
<PISI>
<Source>
<Name>iproute2</Name>
<Homepage>http://linux-net.osdl.org/index.php/Iproute2</Homepage>
<Packager>
<Name>PisiLinux Community</Name>
<Email>admins@pisilinux.org</Email>
</Packager>
<License>GPLv2</License>
<IsA>app:console</IsA>
<Summary>Kernel routing and traffic control utilities</Summary>
<Description>Iproute2 is a collection of utilites for controlling TCP/IP networking and traffic control in Linux.</Description>
<Archive sha1sum="d24385ae619966d1bd71e146322d6035d60aaa1a" type="tarxz">https://www.kernel.org/pub/linux/utils/net/iproute2/iproute2-4.0.0.tar.xz</Archive>
<BuildDependencies>
<Dependency>iptables-devel</Dependency>
<Dependency>linux-atm-devel</Dependency>
<Dependency>db-devel</Dependency>
</BuildDependencies>
</Source>
<Package>
<Name>iproute2</Name>
<RuntimeDependencies>
<Dependency>linux-atm</Dependency>
<Dependency>iptables</Dependency>
<Dependency>db</Dependency>
</RuntimeDependencies>
<Files>
<Path fileType="config">/etc</Path>
<Path fileType="executable">/sbin</Path>
<Path fileType="executable">/usr/sbin</Path>
<Path fileType="library">/lib</Path>
<Path fileType="library">/usr/lib</Path>
<Path fileType="man">/usr/share/man</Path>
<Path fileType="doc">/usr/share/doc</Path>
<Path fileType="data">/var/lib</Path>
</Files>
</Package>
<History>
<Update release="3">
<Date>2015-04-13</Date>
<Version>4.0.0</Version>
<Comment>Version bump.</Comment>
<Name>Ertuğrul Erata</Name>
<Email>ertugrulerata@gmail.com</Email>
</Update>
<Update release="2">
<Date>2013-11-23</Date>
<Version>3.12.0</Version>
<Comment>Version bump</Comment>
<Name>Richard de Bruin</Name>
<Email>richdb@pisilinux.org</Email>
</Update>
<Update release="1">
<Date>2012-09-01</Date>
<Version>3.5.1</Version>
<Comment>First release</Comment>
<Name>PisiLinux Community</Name>
<Email>admins@pisilinux.org</Email>
</Update>
</History>
</PISI>
network/filter/iproute2/translations.xml
+8
View File
@@ -0,0 +1,8 @@
<?xml version="1.0" ?>
<PISI>
<Source>
<Name>iproute2</Name>
<Summary xml:lang="tr">Çekirdek içinde yer alan ağ trafiği yönlendirme ve trafik kontrol araçları.</Summary>
<Description xml:lang="tr">Iproute2 TCP/IP ağları ve trafik kontrolü için araçlar içeren bir koolleksiyondur.</Description>
</Source>
</PISI>
network/filter/iptables/actions.py
+32
View File
@@ -0,0 +1,32 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Licensed under the GNU General Public License, version 3.
# See the file http://www.gnu.org/licenses/gpl.txt
from pisi.actionsapi import autotools
from pisi.actionsapi import pisitools
from pisi.actionsapi import shelltools
from pisi.actionsapi import get
def setup():
autotools.configure("--sbindir=/sbin \
--libexecdir=/usr/lib \
--without-kernel \
--enable-devel \
--enable-libipq \
--enable-shared \
--enable-static")
def build():
autotools.make("V=1")
def install():
autotools.rawInstall('DESTDIR="%s"' % get.installDIR())
pisitools.insinto("/usr/include", "include/iptables.h")
pisitools.insinto("/usr/include", "include/ip6tables.h")
pisitools.insinto("/usr/include/libiptc", "include/libiptc/*.h")
pisitools.dodir("/var/lib/iptables")
pisitools.dodir("/etc/iptables")
network/filter/iptables/comar/firewall.py
+528
View File
@@ -0,0 +1,528 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
# i18n
MSG_CONNECTION_NAME = {
"en": "Internet Sharing",
"tr": "Internet Paylaşımı",
"sv": "Internetdelning",
"fr": "Partage de connexion Internet",
"es": "Compartir Internet",
"de": "Internet Freigabe",
"nl": "Internetverbinding delen",
}
MSG_ALLOWED_PORTS = {
"en": "Allowed Port Numbers",
"tr": "İzin Verilen Port Numaraları",
"sv": "Tillåtna portar",
"fr": "Numéros de port autorisés",
"es": "Números de puertos permitidos",
"de": "Erlaubte Ports",
"nl": "Toegestane poortnummers",
}
MSG_FORBIDDEN_PORTS = {
"en": "Forbidden Port Numbers",
"tr": "İzin Verilmeyen Port Numaraları",
"sv": "Otillåtna portar",
"nl": "Verboden poortnummers",
}
MSG_GATEWAY_HOME = {
"en": "Gate to Home Network",
"tr": "Ev Ağına Çıkış",
"sv": "Länk till lokalt nätverk",
"fr": "Passerelle vers le réseau local",
"es": "Enlace a la red doméstica",
"de": "Gateway zum Haus-Netzwerk",
"nl": "Gateway naar thuisnetwerk",
}
MSG_GATEWAY_INTERNET = {
"en": "Gate to Internet",
"tr": "Internet'e Çıkış",
"sv": "Länk till internet",
"fr": "Passerelle vers Internet",
"es": "Enlace a Internet",
"de": "Gateway zum Internet",
"nl": "Gateway naar Internet",
}
TITLE_BLOCK_INCOMING = {
"en": "Block Incoming Connections",
"tr": "Gelen Bağlantıları Engelle",
"sv": "Blockera inkommande anslutningar",
"fr": "Bloquer les connexions entrantes",
"es": "Bloquear conexiones entrantes",
"de": "Eingehende Verbindungen blockieren",
"nl": "Inkomende verbindingen blokkeren",
}
DESCRIPTION_BLOCK_INCOMING = {
"en": "Blocks all incoming connections to the computer. Exceptions can be set from configuration dialog.",
"tr": "Bilgisayara gelen tüm bağlantıları engeller. İstisnalar ayarlar penceresinden belirlenebilir.",
"sv": "Blockerar alla inkommande anslutningar till datorn. Undantag kan läggas till under inställningar.",
"fr": "Bloque toute les connexions entrantes dans l'ordinateur. Des exceptions peuvent être définies dans la fenêtre de configuration.",
"es": "Bloquea todas las conexiones entrantes a la computadora. Se puede especificar excepciones desde el dialogo de configuración.",
"de": "Blockiert alle eingehenden Verbindungen. Im Konfigurations-Dialog können Ausnahmen angegeben werden.",
"nl": "Alle inkomende verbindingen naar deze computer blokkeren. Uitzonderingen kunnen in een configuratiedialoog ingesteld worden.",
}
TITLE_BLOCK_OUTGOING = {
"en": "Block Outgoing Connections",
"tr": "Giden Bağlantıları Engelle",
"sv": "Blockera utgående anslutningar",
"fr": "Bloquer les connexions sortantes",
"es": "Bloquear conexiones salientes",
"de": "Ausgehende Verbindungen blockieren",
"nl": "Uitgaande verbindingen blokkeren",
}
DESCRIPTION_BLOCK_OUTGOING = {
"en": "Blocks outgoing connections. Forbidden ports can be set from configuration dialog.",
"tr": "Dışarı yapılan bağlantıları engeller. Yasaklı port numaraları ayarlar penceresinden belirlenebilir.",
"sv": "Blockerar alla utgående anslutningar till datorn. Undantag kan läggas till under inställningar.",
"nl": "Uitgaande verbindingen blokkeren. Verboden poorten kunnen in een configuratiedialoog ingesteld worden.",
}
TITLE_INTERNET_SHARING = {
"en": "Internet Sharing",
"tr": "Internet Paylaşımı",
"sv": "Internetdelning",
"fr": "Partage de connexion Internet",
"es": "Compartir Internet",
"de": "Internet Freigabe",
"nl": "Internetverbinding delen",
}
DESCRIPTION_INTERNET_SHARING = {
"en": "Allows computers in your local network to connect Internet through this computer.",
"tr": "Yerel ağınızdaki bilgisayarların, bu bilgisayarı kullanarak Internet'e bağlanmalarını sağlar.",
"sv": "Låter datorer i det lokala nätverket ansluta till internet via den här datorn.",
"fr": "Permet aux ordinateurs de votre réseau domestique de se connecter à Internet via cet ordinateur.",
"es": "Permitir a otros computadoras en su red local acceder a la Internet, a través de ésta computadora",
"de": "Gibt anderen Computern aus dem lokalen Netzwer die Mäglichkeit, Internet durch diesen Computer hier zu benutzen.",
"nl": "Geeft andere computers in het lokale netwerk via deze computer toegang tot het internet.",
}
# Don't touch below, if you don't know what you're doing.
# Module configuration settings and templates
FIREWALL_CONF = "/etc/firewall.conf"
IPTABLES_RULES = {
'filter': [
'-P INPUT DROP', # Default policies
'-P FORWARD DROP',
'-P OUTPUT ACCEPT',
'-N PARDUS-IN', # Module container table for INPUT
'-N PARDUS-IN-MOD-BLOCK', # Table for BlockIncoming rules
'-N PARDUS-FW', # Module container table for FORWARD
'-N PARDUS-FW-MOD-SHARING', # Table for InternetSharingModule rules
'-N PARDUS-FW-MOD-BLOCK', # Table for BlockOutgoing rules
'-N PARDUS-OUT', # Module container table for OUTPUT
'-N PARDUS-OUT-MOD-BLOCK', # Table for BlockOutgoing rules
'-A INPUT -i lo -j ACCEPT', # Accept local
'-A FORWARD -o lo -j ACCEPT',
'-A INPUT -m state --state INVALID -j DROP',
'-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT',
'-A INPUT -j PARDUS-IN', # Jump into container tables
'-A FORWARD -j PARDUS-FW',
'-A OUTPUT -j PARDUS-OUT',
'-A PARDUS-IN -j PARDUS-IN-MOD-BLOCK' , # Jump into module tables
'-A PARDUS-FW -j PARDUS-FW-MOD-BLOCK',
'-A PARDUS-FW -j PARDUS-FW-MOD-SHARING',
'-A PARDUS-OUT -j PARDUS-OUT-MOD-BLOCK',
'-A INPUT -m state --state NEW -j ACCEPT',
],
'nat': [
'-P PREROUTING ACCEPT',
'-P POSTROUTING ACCEPT',
'-P OUTPUT ACCEPT',
'-N PARDUS-POST',
'-N PARDUS-POST-MOD-SHARING',
'-A POSTROUTING -j PARDUS-POST',
'-A PARDUS-POST -j PARDUS-POST-MOD-SHARING',
],
}
DHCPD_CONF = """
ddns-update-style interim;
ignore client-updates;
max-lease-time 500;
default-lease-time 500;
option domain-name-servers 193.140.100.220;
option routers 172.16.0.1;
option subnet-mask 255.255.255.0;
subnet 172.16.0.0 netmask 255.255.255.0 {
range 172.16.0.2 172.16.0.254;
}
"""
# Utils
import os
import subprocess
from pardus import iniutils
from pardus import netutils
from pardus import netfilterutils
INI = iniutils.iniParser(FIREWALL_CONF)
def listModuleConfigs():
"""
Returns a list of modules that are configured.
"""
try:
modules = INI.listSections()
except iniutils.iniParserError:
return
if "general" in modules:
modules.remove("general")
return modules
class ModuleConfig:
"""
Module configuration parser.
"""
def __init__(self, name):
self.name = name
try:
self.info = INI.getSection(name)
except iniutils.iniParserError:
self.info = {}
def delete(self):
INI.removeSection(self.name)
def save(self):
is_new = self.name not in listModuleConfigs()
INI.setSection(self.name, self.info)
def getServiceState(package):
"""
Returns state of a service.
"""
return call(package, "System.Service", "info")[2] in ["on", "started"]
def stopService(package, permanent=False):
"""
Stops a service.
"""
call(package, "System.Service", "stop")
if permanent:
call(package, "System.Service", "setState", ("off"))
def startService(package, restart=False, auto_start=False):
"""
Starts a service.
"""
if restart:
stopService(package)
if not getServiceState(package):
call(package, "System.Service", "start")
if auto_start:
call(package, "System.Service", "setState", ("on"))
def initializeIPTables():
"""
Initializes IPTables.
"""
# Active rules
rules_active = netfilterutils.parseConf(netfilterutils.getRules())
# Compare rules
for chain, rules in IPTABLES_RULES.iteritems():
if chain not in rules_active or len(set(rules) - set(rules_active[chain])):
# At least one different rule, need re-initialization
netfilterutils.clear()
conf = netfilterutils.makeConf(IPTABLES_RULES)
netfilterutils.restoreRules(conf)
break
def execRule(rule):
"""
Executes IPTables rule
"""
rule = rule.split()
rule.insert(0, "/sbin/iptables")
subprocess.call(rule)
def createConnection(package, device):
import comar
link = comar.Link()
connection = _(MSG_CONNECTION_NAME)
link.Network.Link[package].setDevice(connection, device)
link.Network.Link[package].setAddress(connection, "manual", "172.16.0.1", "255.255.255.0", "")
return connection
def findOrCreateConnection(link, device):
o_package, o_connecion = None, None
for package in link.Network.Link:
if device in link.Network.Link[package].deviceList():
for connection in link.Network.Link[package].connections():
info = link.Network.Link[package].connectionInfo(connection)
if info.get("net_address", "") == "172.16.0.1":
return package, connection
return package, createConnection(package, device)
def makeDHCPConf(interface):
file("/etc/dhcp/dhcpd.conf", "w").write(DHCPD_CONF)
file("/etc/conf.d/dhcpd", "w").write("DHCPD_IFACE=%s" % interface)
# Modules
class BlockIncoming:
def __init__(self):
self.parametersLast = {}
def getInfo(self):
title = _(TITLE_BLOCK_INCOMING)
description = _(DESCRIPTION_BLOCK_INCOMING)
icon = "network-server"
return (title, description, icon)
def getParameters(self):
parameters = [
("port_exceptions", _(MSG_ALLOWED_PORTS), "editlist", {"format": "[0-9\-]+"}),
]
return parameters
def checkModule(self, parameters={}, quiet=False):
pass
def loadModule(self, parameters={}):
# Initialize IPTables
initializeIPTables()
# Flush rules
self.unloadModule()
# Load rules
for port in parameters.get("port_exceptions", "").split():
if "-" in port:
port = port.replace("-", ":")
execRule("-A PARDUS-IN-MOD-BLOCK -p tcp -m multiport --dports %s -j ACCEPT" % port)
execRule("-A PARDUS-IN-MOD-BLOCK -p udp -m multiport --dports %s -j ACCEPT" % port)
# Block else...
execRule("-A PARDUS-IN-MOD-BLOCK -p tcp -m multiport --dports 0:1024 -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable")
execRule("-A PARDUS-IN-MOD-BLOCK -p udp -m multiport --dports 0:1024 -j REJECT --reject-with icmp-port-unreachable")
execRule("-A PARDUS-IN-MOD-BLOCK -j REJECT --reject-with icmp-host-prohibited")
def unloadModule(self, shutdown=False):
if not shutdown:
# Unload rules
execRule("-F PARDUS-IN-MOD-BLOCK")
class BlockOutgoing:
def __init__(self):
self.parametersLast = {}
def getInfo(self):
title = _(TITLE_BLOCK_OUTGOING)
description = _(DESCRIPTION_BLOCK_OUTGOING)
icon = "security-medium"
return (title, description, icon)
def getParameters(self):
parameters = [
("port_exceptions", _(MSG_FORBIDDEN_PORTS), "editlist", {"format": "[0-9\-]+"}),
]
return parameters
def checkModule(self, parameters={}, quiet=False):
pass
def loadModule(self, parameters={}):
# Initialize IPTables
initializeIPTables()
# Flush rules
self.unloadModule()
# Load rules
for port in parameters.get("port_exceptions", "").split():
if "-" in port:
port = port.replace("-", ":")
execRule("-A PARDUS-OUT-MOD-BLOCK -p tcp -m multiport --dports %s -j DROP" % port)
execRule("-A PARDUS-OUT-MOD-BLOCK -p udp -m multiport --dports %s -j DROP" % port)
execRule("-A PARDUS-FW-MOD-BLOCK -p tcp -m multiport --dports %s -j DROP" % port)
execRule("-A PARDUS-FW-MOD-BLOCK -p udp -m multiport --dports %s -j DROP" % port)
def unloadModule(self, shutdown=False):
if not shutdown:
# Unload rules
execRule("-F PARDUS-OUT-MOD-BLOCK")
execRule("-F PARDUS-FW-MOD-BLOCK")
class InternetSharingModule:
def __init__(self):
self.parametersLast = {}
def getInfo(self):
title = _(TITLE_INTERNET_SHARING)
description = _(DESCRIPTION_INTERNET_SHARING)
icon = "network-workgroup"
return (title, description, icon)
def getParameters(self):
def findInterfaces(wireless=True):
ifaces = []
for iface in netutils.interfaces():
if iface.name.startswith("lo") or iface.name.startswith("pan"):
continue
if not wireless and iface.isWireless():
continue
if iface.isEthernet():
dev_id = iface.deviceUID()
dev_name = netutils.deviceName(iface.deviceUID())
if " - " in dev_name:
dev_name = dev_name.split(" - ")[1]
ifaces.append("%s\t%s" % (dev_id, dev_name))
return ifaces
options_in = {
"choose": "\n".join(findInterfaces())
}
options_out = {
"choose": "\n".join(findInterfaces(wireless=False))
}
parameters = [
("device-input", _(MSG_GATEWAY_INTERNET), "combo", options_in),
("device-output", _(MSG_GATEWAY_HOME), "combo", options_out),
]
return parameters
def checkModule(self, parameters={}, quiet=False):
pass
def loadModule(self, parameters={}):
# Initialize IPTables
initializeIPTables()
# Flush rules
self.unloadModule()
# Enable forwarding
os.system("echo 1 > /proc/sys/net/ipv4/ip_forward")
os.system("echo 1 > /proc/sys/net/ipv4/ip_dynaddr")
# Load rules
input = parameters.get("device-input", "")
output = parameters.get("device-output", "")
if input and output and input != output:
in_name = input.split("_")[-1]
out_name = output.split("_")[-1]
execRule("-A PARDUS-FW-MOD-SHARING -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT" % (in_name, out_name))
execRule("-A PARDUS-FW-MOD-SHARING -i %s -o %s -j ACCEPT" % (out_name, in_name))
execRule("-t nat -A PARDUS-POST-MOD-SHARING -o %s -j MASQUERADE" % in_name)
# Create local NAT profile
import comar
link = comar.Link()
package, connection = findOrCreateConnection(link, output)
link.Network.Link[package].setState(connection, "up")
# Configure DHCP
makeDHCPConf(out_name)
# Start DHCP
startService("dhcpd", restart=True)
def unloadModule(self, shutdown=False):
# Stop DHCP
stopService("dhcpd")
if not shutdown:
# Unload rules
execRule("-F PARDUS-FW-MOD-SHARING")
execRule("-P PARDUS-FW-MOD-SHARING ACCEPT")
execRule("-t nat -F PARDUS-POST-MOD-SHARING")
# Usable modules
MODULES = {
"internet_sharing": InternetSharingModule,
"block_incoming": BlockIncoming,
"block_outgoing": BlockOutgoing,
}
# Network.Firewall model
def listModules():
return MODULES.keys()
def moduleInfo(module):
inst = MODULES[module]()
return inst.getInfo()
def moduleParameters(module):
inst = MODULES[module]()
return inst.getParameters()
def getModuleState(module):
info = ModuleConfig(module).info
return info.get("state", "off")
def setModuleState(name, state):
if state in ["on", "off"]:
# Save state
module = ModuleConfig(name)
module.info["state"] = state
module.save()
# Execute module if firewall is active
if getState() == "on":
inst = MODULES[name]()
if state == "on":
inst.loadModule(getModuleParameters(name))
else:
inst.unloadModule()
# Notify clients
notify("Network.Firewall", "moduleStateChanged", (name, state))
def getModuleParameters(module):
info = ModuleConfig(module).info
return info
def setModuleParameters(name, parameters):
# Save module parameters
module = ModuleConfig(name)
for key, value in parameters.iteritems():
module.info[key] = value
module.save()
# Execute module if it's active
if getState() == "on" and getModuleState(name) == "on":
inst = MODULES[name]()
inst.checkModule(parameters)
inst.loadModule(parameters)
# Notify clients
notify("Network.Firewall", "moduleSettingsChanged", (name))
def getState():
state = ModuleConfig("general").info.get("state", "off")
if state not in ["on", "off"] or not getServiceState(script()):
return "off"
return state
def setState(state):
if state in ["on", "off"]:
# Save state
general = ModuleConfig("general")
general.info["state"] = state
general.save()
if state == "on":
# Start IPTables
startService(script(), auto_start=True)
# Execute active modules
for module in listModuleConfigs():
if module not in MODULES:
continue
info = ModuleConfig(module).info
if info.get("state", "off") == "on":
inst = MODULES[module]()
inst.loadModule(getModuleParameters(module))
else:
# Flush IPTables since every module depends on it
netfilterutils.clear()
# Stop IPTables
stopService(script(), permanent=True)
# Unload modules
for module in listModuleConfigs():
if module not in MODULES:
continue
inst = MODULES[module]()
inst.unloadModule(shutdown=True)
# Notify clients
notify("Network.Firewall", "stateChanged", (state))
network/filter/iptables/comar/service.py
+69
View File
@@ -0,0 +1,69 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
from comar.service import *
serviceType = "local"
serviceDesc = _({"en": "Firewall",
"tr": "Güvenlik Duvarı"})
LOCK_FILE = "/var/lock/subsys/iptables"
FIREWALL_PATH = "/etc/firewall.conf"
import os
import pardus.netfilterutils as iptables
from pardus import iniutils
def writeFile(filename, content="", mode=0600):
'''Writes content to filename and sets file mode.'''
file(filename, "w").write(content)
os.chmod(filename, mode)
def readFile(filename):
"""Return content of a file"""
return file(filename, "r").read()
def startNetworkFirewall():
INI = iniutils.iniParser(FIREWALL_PATH)
try:
info = INI.getSection("general")
except iniutils.iniParserError:
return
if info.get("state", "off") == "on":
call(script(), "Network.Firewall", "setState", ("on"))
def stop():
# Save rules
writeFile("/var/lib/iptables/rules", iptables.getRules())
# Clear chains & rules
iptables.clear()
# Remove lock file
if os.access(LOCK_FILE, os.F_OK):
os.unlink(LOCK_FILE)
# Notify clients
notify("System.Service", "Changed", (script(), "stopped"))
def start():
# Clear chains & rules
iptables.clear()
# Load rules
profile_file = "/var/lib/iptables/rules"
if os.path.exists(profile_file):
rules = readFile(profile_file)
iptables.restoreRules(rules)
# Create lock file
writeFile(LOCK_FILE, "")
# Initialize Network.Firewall, if necessary
startNetworkFirewall()
# Notify clients
notify("System.Service", "Changed", (script(), "started"))
def status():
return os.access(LOCK_FILE, os.F_OK)
network/filter/iptables/pspec.xml
+89
View File
@@ -0,0 +1,89 @@
<?xml version="1.0" ?>
<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
<PISI>
<Source>
<Name>iptables</Name>
<Homepage>http://www.iptables.org/</Homepage>
<Packager>
<Name>PisiLinux Community</Name>
<Email>admins@pisilinux.org</Email>
</Packager>
<License>GPLv2</License>
<IsA>app:console</IsA>
<Summary>Firewall, NAT and packet mangling tools</Summary>
<Description>Contains iptables firewall, NAT and packet mangling tools.</Description>
<Archive sha1sum="85d4160537546a23a7e42bc26dd7ee62a0ede4c8" type="tarbz2">ftp://ftp.netfilter.org/pub/iptables/iptables-1.4.21.tar.bz2</Archive>
<BuildDependencies>
<Dependency>libnfnetlink-devel</Dependency>
</BuildDependencies>
<Patches>
<!-- these got in
<Patch>iptables-1.4.2-as-needed.patch</Patch>
<Patch>iptables-1.4.2-no-ldconfig.patch</Patch>
-->
<!--<Patch>iptables-1.4.2-glibc.patch</Patch>-->
</Patches>
</Source>
<Package>
<Name>iptables</Name>
<RuntimeDependencies>
<Dependency>libnfnetlink</Dependency>
</RuntimeDependencies>
<Files>
<Path fileType="executable">/usr/bin</Path>
<Path fileType="executable">/sbin</Path>
<Path fileType="library">/lib</Path>
<Path fileType="library">/usr/lib</Path>
<Path fileType="man">/usr/share/man</Path>
<Path fileType="config">/etc</Path>
<Path fileType="data">/var</Path>
<Path fileType="data">/usr/share/xtables</Path>
</Files>
<Provides>
<COMAR script="service.py">System.Service</COMAR>
<COMAR script="firewall.py">Network.Firewall</COMAR>
</Provides>
</Package>
<Package>
<Name>iptables-devel</Name>
<Summary>Development files for iptables</Summary>
<RuntimeDependencies>
<Dependency release="current">iptables</Dependency>
</RuntimeDependencies>
<Files>
<Path fileType="header">/usr/include</Path>
<Path fileType="library">/usr/lib/*.a</Path>
<Path fileType="data">/usr/lib/pkgconfig</Path>
<Path fileType="man">/usr/share/man/man3</Path>
</Files>
</Package>
<History>
<Update release="3">
<Date>2013-11-23</Date>
<Version>1.4.21</Version>
<Comment>Version bump</Comment>
<Name>Richard de Bruin</Name>
<Email>richdb@pisilinux.org</Email>
</Update>
<Update release="2">
<Date>2013-03-04</Date>
<Version>1.4.17</Version>
<Comment>Version bump</Comment>
<Name>Yusuf Aydemir</Name>
<Email>yusuf.aydemir@pisilinux.org</Email>
</Update>
<Update release="1">
<Date>2012-10-21</Date>
<Version>1.4.16.3</Version>
<Comment>First release</Comment>
<Requires>
<Action>reverseDependencyUpdate</Action>
</Requires>
<Name>PisiLinux Community</Name>
<Email>admins@pisilinux.org</Email>
</Update>
</History>
</PISI>
network/filter/iptables/translations.xml
+13
View File
@@ -0,0 +1,13 @@
<?xml version="1.0" ?>
<PISI>
<Source>
<Name>iptables</Name>
<Summary xml:lang="tr">Güvenlik duvarı, ağ adres çevrimi ve paket çevrimi aracı</Summary>
<Description xml:lang="tr">Iptables kural tabanlı gelişmiş güvenlik duvarı uygulamasıdır.</Description>
</Source>
<Package>
<Name>iptables-devel</Name>
<Summary xml:lang="tr">iptables için geliştirme dosyaları</Summary>
</Package>
</PISI>