Iptables -> NFtables
This commit is contained in:
DomySh
@@ -1,113 +1,140 @@
|
||||
from typing import Dict, List, Set
|
||||
from ipaddress import ip_interface
|
||||
from modules.iptables import IPTables
|
||||
from utils import ip_parse, ip_family
|
||||
from modules.sqlite import Service
|
||||
import re, os, asyncio
|
||||
import traceback
|
||||
import traceback, nftables
|
||||
|
||||
from modules.sqlite import Regex
|
||||
|
||||
class FilterTypes:
|
||||
INPUT = "FIREGEX-INPUT"
|
||||
OUTPUT = "FIREGEX-OUTPUT"
|
||||
|
||||
QUEUE_BASE_NUM = 1000
|
||||
|
||||
class FiregexFilter():
|
||||
def __init__(self, proto:str, port:int, ip_int:str, queue=None, target=None, id=None):
|
||||
self.target = target
|
||||
def __init__(self, proto:str, port:int, ip_int:str, queue=None, target:str=None, id=None):
|
||||
self.nftables = nftables.Nftables()
|
||||
self.id = int(id) if id else None
|
||||
self.queue = queue
|
||||
self.target = target
|
||||
self.proto = proto
|
||||
self.port = int(port)
|
||||
self.ip_int = str(ip_int)
|
||||
|
||||
def __eq__(self, o: object) -> bool:
|
||||
if isinstance(o, FiregexFilter):
|
||||
return self.port == o.port and self.proto == o.proto and ip_interface(self.ip_int) == ip_interface(o.ip_int)
|
||||
return self.port == o.port and self.proto == o.proto and ip_parse(self.ip_int) == ip_parse(o.ip_int)
|
||||
return False
|
||||
|
||||
def ipv6(self):
|
||||
return ip_interface(self.ip_int).version == 6
|
||||
|
||||
def ipv4(self):
|
||||
return ip_interface(self.ip_int).version == 4
|
||||
class FiregexTables:
|
||||
|
||||
class FiregexTables(IPTables):
|
||||
def __init__(self):
|
||||
self.table_name = "firegex"
|
||||
self.nft = nftables.Nftables()
|
||||
|
||||
def raw_cmd(self, *cmds):
|
||||
return self.nft.json_cmd({"nftables": list(cmds)})
|
||||
|
||||
def __init__(self, ipv6=False):
|
||||
super().__init__(ipv6, "mangle")
|
||||
self.create_chain(FilterTypes.INPUT)
|
||||
self.add_chain_to_input(FilterTypes.INPUT)
|
||||
self.create_chain(FilterTypes.OUTPUT)
|
||||
self.add_chain_to_output(FilterTypes.OUTPUT)
|
||||
|
||||
def target_in_chain(self, chain, target):
|
||||
for filter in self.list()[chain]:
|
||||
if filter.target == target:
|
||||
return True
|
||||
return False
|
||||
|
||||
def add_chain_to_input(self, chain):
|
||||
if not self.target_in_chain("PREROUTING", str(chain)):
|
||||
self.insert_rule("PREROUTING", str(chain))
|
||||
|
||||
def add_chain_to_output(self, chain):
|
||||
if not self.target_in_chain("POSTROUTING", str(chain)):
|
||||
self.insert_rule("POSTROUTING", str(chain))
|
||||
def cmd(self, *cmds):
|
||||
code, out, err = self.raw_cmd(*cmds)
|
||||
|
||||
def add_output(self, queue_range, proto = None, port = None, ip_int = None):
|
||||
if code == 0: return out
|
||||
else: raise Exception(err)
|
||||
|
||||
def init(self):
|
||||
code, out, err = self.raw_cmd({"create":{"table":{"name":self.table_name,"family":"inet"}}})
|
||||
if code == 0:
|
||||
self.cmd(
|
||||
{"create":{"chain":{
|
||||
"family":"inet",
|
||||
"table":self.table_name,
|
||||
"name":"input",
|
||||
"type":"filter",
|
||||
"hook":"prerouting",
|
||||
"prio":-150,
|
||||
"policy":"accept"
|
||||
}}},
|
||||
{"create":{"chain":{
|
||||
"family":"inet",
|
||||
"table":self.table_name,
|
||||
"name":"output",
|
||||
"type":"filter",
|
||||
"hook":"postrouting",
|
||||
"prio":-150,
|
||||
"policy":"accept"
|
||||
}}}
|
||||
)
|
||||
self.reset()
|
||||
|
||||
def reset(self):
|
||||
self.cmd({"flush":{"table":{"name":"firegex","family":"inet"}}})
|
||||
|
||||
def list(self):
|
||||
return self.cmd({"list": {"ruleset": None}})["nftables"]
|
||||
|
||||
def add_output(self, queue_range, proto, port, ip_int):
|
||||
init, end = queue_range
|
||||
if init > end: init, end = end, init
|
||||
self.append_rule(FilterTypes.OUTPUT,"NFQUEUE",
|
||||
* (["-p", str(proto)] if proto else []),
|
||||
* (["-s", str(ip_int)] if ip_int else []),
|
||||
* (["--sport", str(port)] if port else []),
|
||||
* (["--queue-num", f"{init}"] if init == end else ["--queue-balance", f"{init}:{end}"]),
|
||||
"--queue-bypass"
|
||||
)
|
||||
ip_int = ip_parse(ip_int)
|
||||
ip_addr = str(ip_int).split("/")[0]
|
||||
ip_addr_cidr = int(str(ip_int).split("/")[1])
|
||||
self.cmd({ "insert":{ "rule": {
|
||||
"family": "inet",
|
||||
"table": self.table_name,
|
||||
"chain": "output",
|
||||
"expr": [
|
||||
{'match': {'left': {'payload': {'protocol': ip_family(ip_int), 'field': 'saddr'}}, 'op': '==', 'right': {"prefix": {"addr": ip_addr, "len": ip_addr_cidr}}}}, #ip_int
|
||||
{'match': {'left': {'meta': {'key': 'l4proto'}}, 'op': '==', 'right': str(proto)}},
|
||||
{'match': {"left": { "payload": {"protocol": str(proto), "field": "sport"}}, "op": "==", "right": int(port)}},
|
||||
{"queue": {"num": str(init) if init == end else f"{init}-{end}", "flags": ["bypass"]}}
|
||||
]
|
||||
}}})
|
||||
|
||||
def add_input(self, queue_range, proto = None, port = None, ip_int = None):
|
||||
init, end = queue_range
|
||||
if init > end: init, end = end, init
|
||||
self.append_rule(FilterTypes.INPUT, "NFQUEUE",
|
||||
* (["-p", str(proto)] if proto else []),
|
||||
* (["-d", str(ip_int)] if ip_int else []),
|
||||
* (["--dport", str(port)] if port else []),
|
||||
* (["--queue-num", f"{init}"] if init == end else ["--queue-balance", f"{init}:{end}"]),
|
||||
"--queue-bypass"
|
||||
)
|
||||
ip_int = ip_parse(ip_int)
|
||||
ip_addr = str(ip_int).split("/")[0]
|
||||
ip_addr_cidr = int(str(ip_int).split("/")[1])
|
||||
self.cmd({"insert":{"rule":{
|
||||
"family": "inet",
|
||||
"table": self.table_name,
|
||||
"chain": "input",
|
||||
"expr": [
|
||||
{'match': {'left': {'payload': {'protocol': ip_family(ip_int), 'field': 'daddr'}}, 'op': '==', 'right': {"prefix": {"addr": ip_addr, "len": ip_addr_cidr}}}}, #ip_int
|
||||
{'match': {"left": { "payload": {"protocol": str(proto), "field": "dport"}}, "op": "==", "right": int(port)}},
|
||||
{"queue": {"num": str(init) if init == end else f"{init}-{end}", "flags": ["bypass"]}}
|
||||
]
|
||||
}}})
|
||||
|
||||
def get(self) -> List[FiregexFilter]:
|
||||
res = []
|
||||
iptables_filters = self.list()
|
||||
for filter_type in [FilterTypes.INPUT, FilterTypes.OUTPUT]:
|
||||
for filter in iptables_filters[filter_type]:
|
||||
port = filter.sport() if filter_type == FilterTypes.OUTPUT else filter.dport()
|
||||
queue = filter.nfqueue()
|
||||
if queue and port:
|
||||
res.append(FiregexFilter(
|
||||
target=filter_type,
|
||||
id=filter.id,
|
||||
queue=queue,
|
||||
proto=filter.prot,
|
||||
port=port,
|
||||
ip_int=filter.source if filter_type == FilterTypes.OUTPUT else filter.destination
|
||||
))
|
||||
for filter in [ele["rule"] for ele in self.list() if "rule" in ele and ele["rule"]["table"] == self.table_name]:
|
||||
queue_str = str(filter["expr"][2]["queue"]["num"]).split("-")
|
||||
queue = None
|
||||
if len(queue_str) == 1: queue = int(queue_str[0]), int(queue_str[0])
|
||||
else: queue = int(queue_str[0]), int(queue_str[1])
|
||||
ip_int = None
|
||||
if isinstance(filter["expr"][0]["match"]["right"],str):
|
||||
ip_int = str(ip_parse(filter["expr"][0]["match"]["right"]))
|
||||
else:
|
||||
ip_int = f'{filter["expr"][0]["match"]["right"]["prefix"]["addr"]}/{filter["expr"][0]["match"]["right"]["prefix"]["len"]}'
|
||||
res.append(FiregexFilter(
|
||||
target=filter["chain"],
|
||||
id=int(filter["handle"]),
|
||||
queue=queue,
|
||||
proto=filter["expr"][1]["match"]["left"]["payload"]["protocol"],
|
||||
port=filter["expr"][1]["match"]["right"],
|
||||
ip_int=ip_int
|
||||
))
|
||||
return res
|
||||
|
||||
async def add(self, filter:FiregexFilter):
|
||||
if filter in self.get(): return None
|
||||
return await FiregexInterceptor.start( iptables=self, filter=filter, n_queues=int(os.getenv("N_THREADS_NFQUEUE","1")))
|
||||
|
||||
def delete_all(self):
|
||||
for filter_type in [FilterTypes.INPUT, FilterTypes.OUTPUT]:
|
||||
self.flush_chain(filter_type)
|
||||
return await FiregexInterceptor.start( filter=filter, n_queues=int(os.getenv("N_THREADS_NFQUEUE","1")))
|
||||
|
||||
def delete_by_srv(self, srv:Service):
|
||||
for filter in self.get():
|
||||
if filter.port == srv.port and filter.proto == srv.proto and ip_interface(filter.ip_int) == ip_interface(srv.ip_int):
|
||||
self.delete_rule(filter.target, filter.id)
|
||||
if filter.port == srv.port and filter.proto == srv.proto and ip_parse(filter.ip_int) == ip_parse(srv.ip_int):
|
||||
print("DELETE CMD", {"delete":{"rule": {"handle": filter.id, "table": self.table_name, "chain": filter.target, "family": "inet"}}})
|
||||
self.cmd({"delete":{"rule": {"handle": filter.id, "table": self.table_name, "chain": filter.target, "family": "inet"}}})
|
||||
|
||||
|
||||
class RegexFilter:
|
||||
@@ -159,7 +186,6 @@ class FiregexInterceptor:
|
||||
|
||||
def __init__(self):
|
||||
self.filter:FiregexFilter
|
||||
self.ipv6:bool
|
||||
self.filter_map_lock:asyncio.Lock
|
||||
self.filter_map: Dict[str, RegexFilter]
|
||||
self.regex_filters: Set[RegexFilter]
|
||||
@@ -167,21 +193,18 @@ class FiregexInterceptor:
|
||||
self.process:asyncio.subprocess.Process
|
||||
self.n_queues:int
|
||||
self.update_task: asyncio.Task
|
||||
self.iptables:FiregexTables
|
||||
|
||||
@classmethod
|
||||
async def start(cls, iptables: FiregexTables, filter: FiregexFilter, n_queues:int = 1):
|
||||
async def start(cls, filter: FiregexFilter, n_queues:int = 1):
|
||||
self = cls()
|
||||
self.filter = filter
|
||||
self.n_queues = n_queues
|
||||
self.iptables = iptables
|
||||
self.ipv6 = self.filter.ipv6()
|
||||
self.filter_map_lock = asyncio.Lock()
|
||||
self.update_config_lock = asyncio.Lock()
|
||||
input_range, output_range = await self._start_binary()
|
||||
self.update_task = asyncio.create_task(self.update_blocked())
|
||||
self.iptables.add_input(queue_range=input_range, proto=self.filter.proto, port=self.filter.port, ip_int=self.filter.ip_int)
|
||||
self.iptables.add_output(queue_range=output_range, proto=self.filter.proto, port=self.filter.port, ip_int=self.filter.ip_int)
|
||||
FiregexTables().add_input(queue_range=input_range, proto=self.filter.proto, port=self.filter.port, ip_int=self.filter.ip_int)
|
||||
FiregexTables().add_output(queue_range=output_range, proto=self.filter.proto, port=self.filter.port, ip_int=self.filter.ip_int)
|
||||
return self
|
||||
|
||||
async def _start_binary(self):
|
||||
@@ -221,7 +244,8 @@ class FiregexInterceptor:
|
||||
|
||||
async def stop(self):
|
||||
self.update_task.cancel()
|
||||
self.process.kill()
|
||||
if self.process and self.process.returncode is None:
|
||||
self.process.kill()
|
||||
|
||||
async def _update_config(self, filters_codes):
|
||||
async with self.update_config_lock:
|
||||
|
||||
@@ -24,6 +24,7 @@ class FirewallManager:
|
||||
del self.proxy_table[srv_id]
|
||||
|
||||
async def init(self):
|
||||
FiregexTables().init()
|
||||
await self.reload()
|
||||
|
||||
async def reload(self):
|
||||
@@ -47,7 +48,6 @@ class ServiceManager:
|
||||
def __init__(self, srv: Service, db):
|
||||
self.srv = srv
|
||||
self.db = db
|
||||
self.firegextable = FiregexTables(self.srv.ipv6)
|
||||
self.status = STATUS.STOP
|
||||
self.filters: Dict[int, FiregexFilter] = {}
|
||||
self.lock = asyncio.Lock()
|
||||
@@ -93,13 +93,13 @@ class ServiceManager:
|
||||
|
||||
async def start(self):
|
||||
if not self.interceptor:
|
||||
self.firegextable.delete_by_srv(self.srv)
|
||||
self.interceptor = await self.firegextable.add(FiregexFilter(self.srv.proto,self.srv.port, self.srv.ip_int))
|
||||
FiregexTables().delete_by_srv(self.srv)
|
||||
self.interceptor = await FiregexTables().add(FiregexFilter(self.srv.proto,self.srv.port, self.srv.ip_int))
|
||||
await self._update_filters_from_db()
|
||||
self._set_status(STATUS.ACTIVE)
|
||||
|
||||
async def stop(self):
|
||||
self.firegextable.delete_by_srv(self.srv)
|
||||
FiregexTables().delete_by_srv(self.srv)
|
||||
if self.interceptor:
|
||||
await self.interceptor.stop()
|
||||
self.interceptor = None
|
||||
|
||||
@@ -1,85 +0,0 @@
|
||||
import os, re
|
||||
from subprocess import PIPE, Popen
|
||||
from typing import Dict, List, Tuple, Union
|
||||
|
||||
class Rule():
|
||||
def __init__(self, id, target, prot, opt, source, destination, details):
|
||||
self.id = id
|
||||
self.target = target
|
||||
self.prot = prot
|
||||
self.opt = opt
|
||||
self.source = source
|
||||
self.destination = destination
|
||||
self.details = details
|
||||
|
||||
def __repr__(self) -> str:
|
||||
return f"Rule {self.id} : {self.target}, {self.prot}, {self.opt}, {self.source}, {self.destination}, {self.details}"
|
||||
|
||||
def dport(self) -> Union[int, None]:
|
||||
port = re.findall(r"dpt:([0-9]+)", self.details)
|
||||
return int(port[0]) if port else None
|
||||
|
||||
def sport(self) -> Union[int, None]:
|
||||
port = re.findall(r"spt:([0-9]+)", self.details)
|
||||
return int(port[0]) if port else None
|
||||
|
||||
def nfqueue(self) -> Union[Tuple[int,int], None]:
|
||||
balanced = re.findall(r"NFQUEUE balance ([0-9]+):([0-9]+)", self.details)
|
||||
numbered = re.findall(r"NFQUEUE num ([0-9]+)", self.details)
|
||||
queue_num = None
|
||||
if balanced: queue_num = (int(balanced[0][0]), int(balanced[0][1]))
|
||||
if numbered: queue_num = (int(numbered[0]), int(numbered[0]))
|
||||
return queue_num
|
||||
|
||||
class IPTables:
|
||||
|
||||
def __init__(self, ipv6=False, table="filter"):
|
||||
self.ipv6 = ipv6
|
||||
self.table = table
|
||||
|
||||
def command(self, params) -> Tuple[bytes, bytes]:
|
||||
params = ["-t", self.table] + params
|
||||
if os.geteuid() != 0:
|
||||
exit("You need to have root privileges to run this script.\nPlease try again, this time using 'sudo'. Exiting.")
|
||||
return Popen(["ip6tables"]+params if self.ipv6 else ["iptables"]+params, stdout=PIPE, stderr=PIPE).communicate()
|
||||
|
||||
def list(self) -> Dict[str, List[Rule]]:
|
||||
stdout, strerr = self.command(["-L", "--line-number", "-n"])
|
||||
lines = stdout.decode().split("\n")
|
||||
res: Dict[str, List[Rule]] = {}
|
||||
chain_name = ""
|
||||
for line in lines:
|
||||
if line.startswith("Chain"):
|
||||
chain_name = line.split()[1]
|
||||
res[chain_name] = []
|
||||
elif line and line.split()[0].isnumeric():
|
||||
parsed = re.findall(r"([^ ]*)[ ]{,10}([^ ]*)[ ]{,5}([^ ]*)[ ]{,5}([^ ]*)[ ]{,5}([^ ]*)[ ]+([^ ]*)[ ]+(.*)", line)
|
||||
if len(parsed) > 0:
|
||||
parsed = parsed[0]
|
||||
res[chain_name].append(Rule(
|
||||
id=parsed[0].strip(),
|
||||
target=parsed[1].strip(),
|
||||
prot=parsed[2].strip(),
|
||||
opt=parsed[3].strip(),
|
||||
source=parsed[4].strip(),
|
||||
destination=parsed[5].strip(),
|
||||
details=" ".join(parsed[6:]).strip() if len(parsed) >= 7 else ""
|
||||
))
|
||||
return res
|
||||
|
||||
def delete_rule(self, chain, id) -> None:
|
||||
self.command(["-D", str(chain), str(id)])
|
||||
|
||||
def create_chain(self, name) -> None:
|
||||
self.command(["-N", str(name)])
|
||||
|
||||
def flush_chain(self, name) -> None:
|
||||
self.command(["-F", str(name)])
|
||||
|
||||
def insert_rule(self, chain, rule, *args, rulenum=1) -> None:
|
||||
self.command(["-I", str(chain), str(rulenum), "-j", str(rule), *args])
|
||||
|
||||
def append_rule(self, chain, rule, *args) -> None:
|
||||
self.command(["-A", str(chain), "-j", str(rule), *args])
|
||||
|
||||
|
||||
@@ -8,6 +8,7 @@ class SQLite():
|
||||
self.conn: Union[None, sqlite3.Connection] = None
|
||||
self.cur = None
|
||||
self.db_name = db_name
|
||||
self.__backup = None
|
||||
self.schema = {
|
||||
'services': {
|
||||
'service_id': 'VARCHAR(100) PRIMARY KEY',
|
||||
@@ -49,6 +50,17 @@ class SQLite():
|
||||
return d
|
||||
self.conn.row_factory = dict_factory
|
||||
|
||||
def backup(self):
|
||||
if self.conn:
|
||||
with open(self.db_name, "rb") as f:
|
||||
self.__backup = f.read()
|
||||
|
||||
def restore(self):
|
||||
if self.__backup:
|
||||
with open(self.db_name, "wb") as f:
|
||||
f.write(self.__backup)
|
||||
self.__backup = None
|
||||
|
||||
def disconnect(self) -> None:
|
||||
if self.conn: self.conn.close()
|
||||
|
||||
@@ -101,18 +113,17 @@ class SQLite():
|
||||
|
||||
|
||||
class Service:
|
||||
def __init__(self, id: str, status: str, port: int, name: str, ipv6: bool, proto: str, ip_int: str):
|
||||
def __init__(self, id: str, status: str, port: int, name: str, proto: str, ip_int: str):
|
||||
self.id = id
|
||||
self.status = status
|
||||
self.port = port
|
||||
self.name = name
|
||||
self.ipv6 = ipv6
|
||||
self.proto = proto
|
||||
self.ip_int = ip_int
|
||||
|
||||
@classmethod
|
||||
def from_dict(cls, var: dict):
|
||||
return cls(id=var["service_id"], status=var["status"], port=var["port"], name=var["name"], ipv6=var["ipv6"], proto=var["proto"], ip_int=var["ip_int"])
|
||||
return cls(id=var["service_id"], status=var["status"], port=var["port"], name=var["name"], proto=var["proto"], ip_int=var["ip_int"])
|
||||
|
||||
|
||||
class Regex:
|
||||
|
||||
Reference in New Issue
Block a user