ynerant/med
1
0
Fork 0
mirror of https://gitlab.crans.org/mediatek/med.git synced 2025-11-04 13:12:18 +01:00
Code Issues Releases Wiki Activity

Generation de l'iptables + injection et retrait des règles au démarage du service portail

Browse Source
This commit is contained in:
Gabriel Detraz
2017-06-12 03:58:05 +02:00
parent 853be5e1f8
commit ba5151c3bd
4 changed files with 91 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
portail_captif/portail_captif.service
View File

@@ -11,9 +11,11 @@ User=root
Group=root
PIDFile=/run/portail_captif.pid
WorkingDirectory=/var/www/portail_captif/
ExecStartPre=/usr/bin/python3 /var/www/portail_captif/portail_captif/start_portail.py
ExecStart=/usr/bin/gunicorn3 portail_captif.wsgi:application --pid=/run/portail_captif.pid --name www-data --user www-data --group www-data --daemon --log-file /var/log/gunicorn/portail_captif.log --log-level=info --bind=unix:///tmp/gunicorn-portail_captif.sock --workers=1
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s TERM $MAINPID
ExecStopPost=/usr/bin/python3 /var/www/portail_captif/portail_captif/stop_portail.py
Restart=on-failure
RestartSec=65
StartLimitInterval=60

42
portail_captif/start_portail.py Executable file
View File

@@ -0,0 +1,42 @@
# Copyright © 2017 Gabriel Détraz
# Copyright © 2017 Goulven Kermarec
# Copyright © 2017 Augustin Lemesle
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# Ce script est appellé avant le démarage du portail, il insère les bonnes règles
# dans l'iptables et active le routage
import os, sys
proj_path = "/var/www/portail_captif/"
# This is so Django knows where to find stuff.
os.environ.setdefault("DJANGO_SETTINGS_MODULE", "portail_captif.settings")
sys.path.append(proj_path)
# This is so my local_settings.py gets loaded.
os.chdir(proj_path)
from users.models import restore_iptables, apply
from portail_captif.settings import AUTORIZED_INTERFACES
# Restauration de l'iptables
restore_iptables()
# Activation du routage sur les bonnes if
for interface in AUTORIZED_INTERFACES:
apply("echo 1 > /proc/sys/net/ipv6/conf/%s/forwarding" % interface)
apply("echo 1 > /proc/sys/net/ipv4/conf/%s/forwarding" % interface)

44
portail_captif/stop_portail.py Executable file
View File

@@ -0,0 +1,44 @@
# Copyright © 2017 Gabriel Détraz
# Copyright © 2017 Goulven Kermarec
# Copyright © 2017 Augustin Lemesle
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# Ce script est appellé avant le démarage du portail, il insère les bonnes règles
# dans l'iptables et active le routage
import os, sys
proj_path = "/var/www/portail_captif/"
# This is so Django knows where to find stuff.
os.environ.setdefault("DJANGO_SETTINGS_MODULE", "portail_captif.settings")
sys.path.append(proj_path)
# This is so my local_settings.py gets loaded.
os.chdir(proj_path)
from users.models import restore_iptables, apply
from portail_captif.settings import AUTORIZED_INTERFACES
# Destruction de l'iptables
apply("iptables -t nat -F")
apply("iptables -t filter -F")
apply("iptables -t mangle -F")
# Desactivation du routage sur les bonnes if
for interface in AUTORIZED_INTERFACES:
apply("echo 0 > /proc/sys/net/ipv6/conf/%s/forwarding" % interface)
apply("echo 0 > /proc/sys/net/ipv4/conf/%s/forwarding" % interface)

5
users/models.py
View File

@@ -30,7 +30,7 @@ from django.utils.functional import cached_property
from macaddress.fields import MACAddressField
from portail_captif.settings import GENERIC_IPSET_COMMAND, IPSET_NAME, REQ_EXPIRE_HRS,FORBIDEN_INTERFACES, SERVER_SELF_IP, AUTORIZED_INTERFACES
from portail_captif.settings import GENERIC_IPSET_COMMAND, IPSET_NAME, REQ_EXPIRE_HRS,FORBIDEN_INTERFACES, SERVER_SELF_IP, AUTORIZED_INTERFACES, PORTAIL_ACTIVE
import re, uuid
import datetime
@@ -108,7 +108,8 @@ def gen_nat(ipt):
ipt.init_nat("CAPTIF", decision="-")
ipt.jump("nat", "PREROUTING", "CAPTIF")
ipt.jump("nat", "POSTROUTING", "MASQUERADE")
ipt.add("nat", "-A CAPTIF -m set ! --match-set %s src -j DNAT --to-destination %s" % (IPSET_NAME, SERVER_SELF_IP))
if PORTAIL_ACTIVE:
ipt.add("nat", "-A CAPTIF -m set ! --match-set %s src -j DNAT --to-destination %s" % (IPSET_NAME, SERVER_SELF_IP))
ipt.jump("nat", "CAPTIF", "RETURN")
ipt.commit("nat")
return ipt