From 428d5e6aa3de419d6da00df003db2bb14b22ac05 Mon Sep 17 00:00:00 2001 From: Sunil Mohan Adapa Date: Sun, 27 Apr 2014 17:49:24 +0530 Subject: [PATCH 1/3] Add more firewalld service and fix typo in one --- lib/firewalld/services/privoxy.xml | 6 ++++++ lib/firewalld/services/tor-socks.xml | 6 ++++++ lib/firewalld/services/xmpp-server.xml | 2 +- 3 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 lib/firewalld/services/privoxy.xml create mode 100644 lib/firewalld/services/tor-socks.xml diff --git a/lib/firewalld/services/privoxy.xml b/lib/firewalld/services/privoxy.xml new file mode 100644 index 000000000..e456a8f9c --- /dev/null +++ b/lib/firewalld/services/privoxy.xml @@ -0,0 +1,6 @@ + + + Privoxy - A Privacy Enhancing Proxy Server + Privoxy is a web proxy for enhancing privacy by filtering web page content, managing cookies, controlling access, removing ads, banners, pop-ups and other obnoxious Internet junk. It does not cache web content. Enable this if you run Privoxy and would like to configure your web browser to browse the Internet via Privoxy. + + diff --git a/lib/firewalld/services/tor-socks.xml b/lib/firewalld/services/tor-socks.xml new file mode 100644 index 000000000..b6f7cad4f --- /dev/null +++ b/lib/firewalld/services/tor-socks.xml @@ -0,0 +1,6 @@ + + + Tor - SOCKS Proxy + Tor enables online anonymity and censorship resistance by directing Internet traffic through a network of relays. It conceals user's location from anyone conducting network surveillance and traffic analysis. A user wishing to use Tor for anonymity can configure a program such as a web browser to direct traffic to a Tor client using its SOCKS proxy port. Enable this if you run Tor and would like to configure your web browser or other programs to channel their traffic through the Tor SOCKS proxy port. It is recommended that you make this service available only for your computer or your internal networks. + + diff --git a/lib/firewalld/services/xmpp-server.xml b/lib/firewalld/services/xmpp-server.xml index 3656d96da..bf8a2ea6f 100644 --- a/lib/firewalld/services/xmpp-server.xml +++ b/lib/firewalld/services/xmpp-server.xml @@ -1,6 +1,6 @@ XMPP (Jabber) server - Extensible Messaging and Presence Protocol (XMPP) server connection protocols allows multiple XMPP (Jabber) servers to work in a fedrated fashion. Users on one server will be able to see the presence of and communicate with users on another servers. Enable this if you run an XMPP (Jabber) server and you wish users on your server to communicate with users on other XMPP servers. + Extensible Messaging and Presence Protocol (XMPP) server connection protocols allows multiple XMPP (Jabber) servers to work in a federated fashion. Users on one server will be able to see the presence of and communicate with users on another servers. Enable this if you run an XMPP (Jabber) server and you wish users on your server to communicate with users on other XMPP servers. From 3ef1ed83ce076016d7e840e04f5babe156f729d4 Mon Sep 17 00:00:00 2001 From: Sunil Mohan Adapa Date: Sun, 27 Apr 2014 18:16:32 +0530 Subject: [PATCH 2/3] Add support for zones in firewall service --- actions/firewall | 40 +++++++++++++------ lib/freedombox/first-run.d/90_firewall | 52 ++++++++++++++----------- modules/installed/apps/owncloud.py | 2 +- modules/installed/services/xmpp.py | 20 +++------- modules/installed/system/firewall.py | 53 +++++++++++++++++++------- service.py | 17 +++++---- 6 files changed, 114 insertions(+), 70 deletions(-) diff --git a/actions/firewall b/actions/firewall index 88a921d2b..520115c24 100755 --- a/actions/firewall +++ b/actions/firewall @@ -22,8 +22,6 @@ Configuration helper for Plinth firewall inteface """ import argparse -import os -import re import subprocess @@ -37,18 +35,31 @@ def parse_arguments(): help='Get whether firewalld is installed') # Get status - subparsers.add_parser('get-status', help='Get whether firewalld is running') + subparsers.add_parser('get-status', + help='Get whether firewalld is running') # Get service status - subparsers.add_parser('get-enabled-services', help='Get list of enabled services') + get_enabled_services = subparsers.add_parser( + 'get-enabled-services', help='Get list of enabled services') + get_enabled_services.add_argument( + '--zone', help='Zone from which the list is to be retrieved', + required=True) # Add a service add_service = subparsers.add_parser('add-service', help='Add a service') add_service.add_argument('service', help='Name of the service to add') + add_service.add_argument('--zone', + help='Zone to which service is to be added', + required=True) # Remove a service status - remove_service = subparsers.add_parser('remove-service', help='Remove a service') - remove_service.add_argument('service', help='Name of the service to remove') + remove_service = subparsers.add_parser('remove-service', + help='Remove a service') + remove_service.add_argument('service', + help='Name of the service to remove') + remove_service.add_argument( + '--zone', help='Zone from which service is to be removed', + required=True) return parser.parse_args() @@ -66,21 +77,26 @@ def subcommand_get_status(_): subprocess.call(['firewall-cmd', '--state']) -def subcommand_get_enabled_services(_): +def subcommand_get_enabled_services(arguments): """Print the status of variours services""" - subprocess.call(['firewall-cmd', '--list-services']) + subprocess.call(['firewall-cmd', '--zone', arguments.zone, + '--list-services']) def subcommand_add_service(arguments): """Permit a service in the firewall""" - subprocess.call(['firewall-cmd', '--add-service', arguments.service]) - subprocess.call(['firewall-cmd', '--permanent', '--add-service', arguments.service]) + subprocess.call(['firewall-cmd', '--zone', arguments.zone, '--add-service', + arguments.service]) + subprocess.call(['firewall-cmd', '--zone', arguments.zone, '--permanent', + '--add-service', arguments.service]) def subcommand_remove_service(arguments): """Block a service in the firewall""" - subprocess.call(['firewall-cmd', '--remove-service', arguments.service]) - subprocess.call(['firewall-cmd', '--permanent', '--remove-service', arguments.service]) + subprocess.call(['firewall-cmd', '--zone', arguments.zone, + '--remove-service', arguments.service]) + subprocess.call(['firewall-cmd', '--zone', arguments.zone, '--permanent', + '--remove-service', arguments.service]) def main(): diff --git a/lib/freedombox/first-run.d/90_firewall b/lib/freedombox/first-run.d/90_firewall index dadd7fe74..9e53235b8 100755 --- a/lib/freedombox/first-run.d/90_firewall +++ b/lib/freedombox/first-run.d/90_firewall @@ -1,48 +1,56 @@ #!/bin/sh -# Setup firewall rules for all the enabled services -# Ideally all non essential services are enabled from Plinth -# which automatically takes care of enabling appropirate firewall -# ports. This file is used then for essential services and services -# that are not yet configurable from Plinth. +# Setup firewall rules for all the services enabled by default. +# Ideally all non-essential services are enabled from Plinth which +# automatically takes care of enabling appropirate firewall ports. The +# following is then for essential services and services that are not +# yet configurable from Plinth. # HTTP (JWChat, ownCloud) -firewall-cmd --permanent --add-service=http +firewall-cmd --zone=external --permanent --add-service=http +firewall-cmd --zone=internal --permanent --add-service=http # HTTPS (Plinth, JWChat, ownCloud) -firewall-cmd --permanent --add-service=https +firewall-cmd --zone=external --permanent --add-service=https +firewall-cmd --zone=internal --permanent --add-service=https # Tor -firewall-cmd --permanent --add-port=9050/tcp +firewall-cmd --zone=internal --permanent --add-service=tor-socks # NTP -firewall-cmd --permanent --add-service=ntp +firewall-cmd --zone=internal --permanent --add-service=ntp # DNS -firewall-cmd --permanent --add-service=dns +firewall-cmd --zone=internal --permanent --add-service=dns # mDNS -firewall-cmd --permanent --add-service=mdns +firewall-cmd --zone=internal --permanent --add-service=mdns # DHCP -firewall-cmd --permanent --add-service=dhcp +firewall-cmd --zone=internal --permanent --add-service=dhcp # Bootp Server and Client (not enabled) -#firewall-cmd --permanent --add-port=67/tcp -#firewall-cmd --permanent --add-port=67/udp -#firewall-cmd --permanent --add-port=68/tcp -#firewall-cmd --permanent --add-port=68/udp +#firewall-cmd --zone=internal --permanent --add-port=67/tcp +#firewall-cmd --zone=internal --permanent --add-port=67/udp +#firewall-cmd --zone=internal --permanent --add-port=68/tcp +#firewall-cmd --zone=internal --permanent --add-port=68/udp # LDAP (not enabled) -#firewall-cmd --permanent --add-service=ldap -#firewall-cmd --permanent --add-service=ldaps +#firewall-cmd --zone=internal --permanent --add-service=ldap +#firewall-cmd --zone=internal --permanent --add-service=ldaps # OpenVPN (not enabled) -#firewall-cmd --permanent --add-service=openvpn +#firewall-cmd --zone=external --permanent --add-service=openvpn +#firewall-cmd --zone=internal --permanent --add-service=openvpn # Privoxy -firewall-cmd --permanent --add-port=8118/tcp +firewall-cmd --zone=internal --permanent --add-service=privoxy -# Obfsproxy -firewall-cmd --permanent --add-port=40202/tcp +# XMPP +firewall-cmd --zone=external --permanent --add-service=xmpp-server +firewall-cmd --zone=internal --permanent --add-service=xmpp-server +firewall-cmd --zone=external --permanent --add-service=xmpp-client +firewall-cmd --zone=internal --permanent --add-service=xmpp-client +firewall-cmd --zone=external --permanent --add-service=xmpp-bosh +firewall-cmd --zone=internal --permanent --add-service=xmpp-bosh diff --git a/modules/installed/apps/owncloud.py b/modules/installed/apps/owncloud.py index 9bfb84e9b..b3504a1b6 100644 --- a/modules/installed/apps/owncloud.py +++ b/modules/installed/apps/owncloud.py @@ -17,7 +17,7 @@ class Owncloud(PagePlugin, FormPlugin): cfg.html_root.apps.menu.add_item("Owncloud", "icon-picture", "/apps/owncloud", 35) self.service = service.Service('owncloud', _('ownCloud'), - ['http', 'https'], + ['http', 'https'], is_external=True, enabled=self.is_enabled) def is_enabled(self): diff --git a/modules/installed/services/xmpp.py b/modules/installed/services/xmpp.py index 858137af8..46063bfc1 100644 --- a/modules/installed/services/xmpp.py +++ b/modules/installed/services/xmpp.py @@ -17,22 +17,14 @@ class xmpp(PagePlugin): cfg.html_root.services.menu.add_item("XMPP", "icon-comment", "/services/xmpp", 40) self.client_service = service.Service( - 'xmpp-client', _('Chat Server - client connections'), enabled=True) + 'xmpp-client', _('Chat Server - client connections'), + is_external=True, enabled=True) self.server_service = service.Service( - 'xmpp-server', _('Chat Server - server connections'), enabled=True) + 'xmpp-server', _('Chat Server - server connections'), + is_external=True, enabled=True) self.bosh_service = service.Service( - 'xmpp-bosh', _('Chat Server - web interface'), enabled=True) - - # XXX: This is not correct. This essentially triggers firewall - # to enable XMPP ports. This happen on every start of - # Plinth. XMPP should be an option to be enabled on Plinth. If - # and when the user enables the following notifications must - # sent. If XMPP has be on by default in FreedomBox, then - # initial setup process that sets up XMPP also must open the - # firewall ports by default. - self.client_service.notify_enabled(self, enabled=True) - self.server_service.notify_enabled(self, enabled=True) - self.bosh_service.notify_enabled(self, enabled=True) + 'xmpp-bosh', _('Chat Server - web interface'), is_external=True, + enabled=True) @cherrypy.expose @require() diff --git a/modules/installed/system/firewall.py b/modules/installed/system/firewall.py index f3faf78ea..885859357 100644 --- a/modules/installed/system/firewall.py +++ b/modules/installed/system/firewall.py @@ -77,7 +77,9 @@ or in case of system with systemd 'systemctl start firewalld'

return self.fill_template(title=_("Firewall"), main=main + status) - enabled_services = self.get_enabled_services() + internal_enabled_sevices = self.get_enabled_services(zone='internal') + external_enabled_sevices = self.get_enabled_services(zone='external') + services_info = '