mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-07-08 11:40:25 +00:00
92f6f8723c
- Significantly reduce the time taken to perform the operations in the following cases: - Enable/disable an app - list services in firewall page - Load app page when interfaces belonging to internal zone need to shown - First run setup of FreedomBox - Install a polkit local authority configuration file to allow FreedomBox service to perform: information queries and configuration changes. - Drop unused actions. - Alter the template for showing firewall port information since port/protocol pairs are no longer pre-formatted. - Handle errors when trying to get ports details of an unknown service. Tests performed: - Enable/disable an app. Ensure with firewall-cmd that ports are added/removed properly. - Temporarily modify code to call add_service() and remove_service() twice in a row. Perform enable/disable operations and ensure that there are not error thrown to test that add/remove services operations are idempotent. - Visit the firewalld page and see the current state is reflected properly. - Visit an app that shows the list of interfaces in firewall zone. Internal interfaces should be listed properly. - Reset the installed version of firewall app and disable all firewall services. Start FreedomBox and ensure that when setup is re-run, default ports (http, https, dns and dhcp) are opened properly. Run again but with ports already enabled to check that the setup operation is idempotent. - Visit diagnostics of an app that uses firewall components and see that ports are listed properly in the port diagnostic test result. - Remove some needed services such as those in /etc/firewalld/services and try to visit the firewalld page. The page should show blank details against the affected services. Reviewed-by: Veiko Aasa <veiko17@disroot.org>
122 lines
3.8 KiB
Python
Executable File
122 lines
3.8 KiB
Python
Executable File
#!/usr/bin/python3
|
|
#
|
|
# This file is part of FreedomBox.
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU Affero General Public License as
|
|
# published by the Free Software Foundation, either version 3 of the
|
|
# License, or (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU Affero General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
"""
|
|
Configuration helper for FreedomBox firewall interface.
|
|
"""
|
|
|
|
import argparse
|
|
import subprocess
|
|
|
|
import augeas
|
|
|
|
from plinth import action_utils
|
|
|
|
|
|
def parse_arguments():
|
|
"""Return parsed command line arguments as dictionary"""
|
|
parser = argparse.ArgumentParser()
|
|
subparsers = parser.add_subparsers(dest='subcommand', help='Sub command')
|
|
|
|
# Setup
|
|
subparsers.add_parser('setup', help='Perform basic firewall setup')
|
|
|
|
# Get status
|
|
subparsers.add_parser('get-status',
|
|
help='Get whether firewalld is running')
|
|
|
|
subparsers.required = True
|
|
return parser.parse_args()
|
|
|
|
|
|
def _flush_iptables_rules():
|
|
"""Flush firewalld iptables rules before restarting it.
|
|
|
|
This is workaround for
|
|
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914694
|
|
|
|
This workaround can be removed if the bug is fixed or if firewalld starts
|
|
defaulting to nftables again.
|
|
|
|
The bug leads to firewalld failing to flush rules when there are custom
|
|
chains in the rules. This only happens on firewalld iptables backend when
|
|
nftables is running with iptables compatibility.
|
|
|
|
Flushing the tables before a restart will make the restart succeed and
|
|
after the restart nftables backend is used avoiding the problem.
|
|
|
|
"""
|
|
rule_template = '*{table}\n-F\n-X\n-Z\nCOMMIT\n'
|
|
iptables_rules = ''
|
|
ip6tables_rules = ''
|
|
for table in ['security', 'raw', 'mangle', 'nat', 'filter']:
|
|
iptables_rules += rule_template.format(table=table)
|
|
ip6tables_rules += rule_template.format(table=table)
|
|
|
|
subprocess.run(['iptables-restore'], input=iptables_rules.encode(),
|
|
check=True)
|
|
subprocess.run(['ip6tables-restore'], input=iptables_rules.encode(),
|
|
check=True)
|
|
|
|
|
|
def set_firewall_backend(backend):
|
|
"""Set FirewallBackend attribute to the specified string."""
|
|
conf_file = '/etc/firewalld/firewalld.conf'
|
|
aug = augeas.Augeas(flags=augeas.Augeas.NO_LOAD +
|
|
augeas.Augeas.NO_MODL_AUTOLOAD)
|
|
|
|
# lens for shell-script config file
|
|
aug.set('/augeas/load/Shellvars/lens', 'Shellvars.lns')
|
|
aug.set('/augeas/load/Shellvars/incl[last() + 1]', conf_file)
|
|
aug.load()
|
|
|
|
old_backend = aug.get('/files/{}/FirewallBackend'.format(conf_file))
|
|
aug.set('/files/{}/FirewallBackend'.format(conf_file),
|
|
'{}'.format(backend))
|
|
aug.save()
|
|
|
|
if old_backend == 'iptables':
|
|
_flush_iptables_rules()
|
|
|
|
if backend != old_backend:
|
|
action_utils.service_restart('firewalld')
|
|
|
|
|
|
def subcommand_setup(_):
|
|
"""Perform basic firewalld setup."""
|
|
action_utils.service_enable('firewalld')
|
|
subprocess.call(['firewall-cmd', '--set-default-zone=external'])
|
|
set_firewall_backend('nftables')
|
|
|
|
|
|
def subcommand_get_status(_):
|
|
"""Print status of the firewalld service"""
|
|
subprocess.call(['firewall-cmd', '--state'])
|
|
|
|
|
|
def main():
|
|
"""Parse arguments and perform all duties"""
|
|
arguments = parse_arguments()
|
|
|
|
subcommand = arguments.subcommand.replace('-', '_')
|
|
subcommand_method = globals()['subcommand_' + subcommand]
|
|
subcommand_method(arguments)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|