Generation de l'iptables + injection et retrait des règles au démarage du service portail

portail_captif/portail_captif.service

@@ -11,9 +11,11 @@ User=root
 Group=root
 PIDFile=/run/portail_captif.pid
 WorkingDirectory=/var/www/portail_captif/
+ExecStartPre=/usr/bin/python3 /var/www/portail_captif/portail_captif/start_portail.py
 ExecStart=/usr/bin/gunicorn3 portail_captif.wsgi:application --pid=/run/portail_captif.pid --name www-data --user www-data --group www-data --daemon --log-file /var/log/gunicorn/portail_captif.log --log-level=info --bind=unix:///tmp/gunicorn-portail_captif.sock --workers=1
 ExecReload=/bin/kill -s HUP $MAINPID
 ExecStop=/bin/kill -s TERM $MAINPID
+ExecStopPost=/usr/bin/python3 /var/www/portail_captif/portail_captif/stop_portail.py
 Restart=on-failure
 RestartSec=65
 StartLimitInterval=60

portail_captif/start_portail.py

@@ -0,0 +1,42 @@
+# Copyright © 2017  Gabriel Détraz
+# Copyright © 2017  Goulven Kermarec
+# Copyright © 2017  Augustin Lemesle
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+# 
+# Ce script est appellé avant le démarage du portail, il insère les bonnes règles
+# dans l'iptables et active le routage
+
+import os, sys
+
+proj_path = "/var/www/portail_captif/"
+# This is so Django knows where to find stuff.
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "portail_captif.settings")
+sys.path.append(proj_path)
+
+# This is so my local_settings.py gets loaded.
+os.chdir(proj_path)
+
+from users.models import restore_iptables, apply
+from portail_captif.settings import AUTORIZED_INTERFACES
+
+# Restauration de l'iptables
+restore_iptables()
+# Activation du routage sur les bonnes if
+for interface in AUTORIZED_INTERFACES:
+    apply("echo 1 > /proc/sys/net/ipv6/conf/%s/forwarding" % interface)
+    apply("echo 1 > /proc/sys/net/ipv4/conf/%s/forwarding" % interface)
+
+

portail_captif/stop_portail.py

@@ -0,0 +1,44 @@
+# Copyright © 2017  Gabriel Détraz
+# Copyright © 2017  Goulven Kermarec
+# Copyright © 2017  Augustin Lemesle
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+# 
+# Ce script est appellé avant le démarage du portail, il insère les bonnes règles
+# dans l'iptables et active le routage
+
+import os, sys
+
+proj_path = "/var/www/portail_captif/"
+# This is so Django knows where to find stuff.
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "portail_captif.settings")
+sys.path.append(proj_path)
+
+# This is so my local_settings.py gets loaded.
+os.chdir(proj_path)
+
+from users.models import restore_iptables, apply
+from portail_captif.settings import AUTORIZED_INTERFACES
+
+# Destruction de l'iptables
+apply("iptables -t nat -F")
+apply("iptables -t filter -F")
+apply("iptables -t mangle  -F")
+# Desactivation du routage sur les bonnes if
+for interface in AUTORIZED_INTERFACES:
+    apply("echo 0 > /proc/sys/net/ipv6/conf/%s/forwarding" % interface)
+    apply("echo 0 > /proc/sys/net/ipv4/conf/%s/forwarding" % interface)
+
+

users/models.py

@@ -30,7 +30,7 @@ from django.utils.functional import cached_property
 
 from macaddress.fields import MACAddressField
 
-from portail_captif.settings import GENERIC_IPSET_COMMAND, IPSET_NAME, REQ_EXPIRE_HRS,FORBIDEN_INTERFACES, SERVER_SELF_IP, AUTORIZED_INTERFACES
+from portail_captif.settings import GENERIC_IPSET_COMMAND, IPSET_NAME, REQ_EXPIRE_HRS,FORBIDEN_INTERFACES, SERVER_SELF_IP, AUTORIZED_INTERFACES, PORTAIL_ACTIVE
 import re, uuid
 import datetime
 
@@ -108,7 +108,8 @@ def gen_nat(ipt):
     ipt.init_nat("CAPTIF", decision="-")
     ipt.jump("nat", "PREROUTING", "CAPTIF")
     ipt.jump("nat", "POSTROUTING", "MASQUERADE")
-    ipt.add("nat", "-A CAPTIF -m set ! --match-set %s src -j DNAT --to-destination %s" % (IPSET_NAME, SERVER_SELF_IP))
+    if PORTAIL_ACTIVE:
+        ipt.add("nat", "-A CAPTIF -m set ! --match-set %s src -j DNAT --to-destination %s" % (IPSET_NAME, SERVER_SELF_IP))
     ipt.jump("nat", "CAPTIF", "RETURN")
     ipt.commit("nat")
     return ipt