Refactoring code pt.1

backend/modules/porthijack/firewall.py

@@ -0,0 +1,114 @@
+import asyncio
+from typing import Dict
+from modules.porthijack.nftables import FiregexTables, FiregexFilter
+from modules.porthijack.models import Service
+from utils.sqlite import SQLite
+
+class STATUS:
+    STOP = "stop"
+    ACTIVE = "active"
+
+class FirewallManager:
+    def __init__(self, db:SQLite):
+        self.db = db
+        self.proxy_table: Dict[str, ServiceManager] = {}
+        self.lock = asyncio.Lock()
+
+    async def close(self):
+        for key in list(self.proxy_table.keys()):
+            await self.remove(key)
+
+    async def remove(self,srv_id):
+        async with self.lock: 
+            if srv_id in self.proxy_table:
+                await self.proxy_table[srv_id].next(STATUS.STOP)
+                del self.proxy_table[srv_id]
+    
+    async def init(self):
+        FiregexTables().init()
+        await self.reload()
+
+    async def reload(self):
+        async with self.lock: 
+            for srv in self.db.query('SELECT * FROM services;'):
+                srv = Service.from_dict(srv)
+                if srv.id in self.proxy_table:
+                    continue
+                self.proxy_table[srv.id] = ServiceManager(srv, self.db)
+                await self.proxy_table[srv.id].next(srv.status)
+
+    def get(self,srv_id):
+        if srv_id in self.proxy_table:
+            return self.proxy_table[srv_id]
+        else:
+            raise ServiceNotFoundException()
+        
+class ServiceNotFoundException(Exception): pass
+
+class ServiceManager:
+    def __init__(self, srv: Service, db):
+        self.srv = srv
+        self.db = db
+        self.status = STATUS.STOP
+        self.filters: Dict[int, FiregexFilter] = {}
+        self.lock = asyncio.Lock()
+        self.interceptor = None
+    
+    async def _update_filters_from_db(self):
+        regexes = [
+            Regex.from_dict(ele) for ele in
+                self.db.query("SELECT * FROM regexes WHERE service_id = ? AND active=1;", self.srv.id)
+        ]
+        #Filter check
+        old_filters = set(self.filters.keys())
+        new_filters = set([f.id for f in regexes])
+        #remove old filters
+        for f in old_filters:
+            if not f in new_filters:
+                del self.filters[f]
+        #add new filters
+        for f in new_filters:
+            if not f in old_filters:
+                filter = [ele for ele in regexes if ele.id == f][0]
+                self.filters[f] = RegexFilter.from_regex(filter, self._stats_updater)
+        if self.interceptor: await self.interceptor.reload(self.filters.values())
+    
+    def __update_status_db(self, status):
+        self.db.query("UPDATE services SET status = ? WHERE service_id = ?;", status, self.srv.id)
+
+    async def next(self,to):
+        async with self.lock:
+            if (self.status, to) == (STATUS.ACTIVE, STATUS.STOP):
+                await self.stop()
+                self._set_status(to)
+            # PAUSE -> ACTIVE
+            elif (self.status, to) == (STATUS.STOP, STATUS.ACTIVE):
+                await self.restart()
+
+    def _stats_updater(self,filter:RegexFilter):
+        self.db.query("UPDATE regexes SET blocked_packets = ? WHERE regex_id = ?;", filter.blocked, filter.id)
+
+    def _set_status(self,status):
+        self.status = status
+        self.__update_status_db(status)
+
+    async def start(self):
+        if not self.interceptor:
+            FiregexTables().delete_by_srv(self.srv)
+            self.interceptor = await FiregexInterceptor.start(FiregexFilter(self.srv.proto,self.srv.port, self.srv.ip_int))
+            await self._update_filters_from_db()
+            self._set_status(STATUS.ACTIVE)
+
+    async def stop(self):
+        FiregexTables().delete_by_srv(self.srv)
+        if self.interceptor:
+            await self.interceptor.stop()
+            self.interceptor = None
+    
+    async def restart(self):
+        await self.stop()
+        await self.start()
+
+    async def update_filters(self):
+        async with self.lock:
+            await self._update_filters_from_db()

backend/modules/porthijack/models.py

@@ -0,0 +1,13 @@
+class Service:
+    def __init__(self, service_id: str, active: bool, public_port: int, proxy_port: int, name: str, proto: str, ip_int: str):
+        self.service_id = service_id
+        self.active = active
+        self.public_port = public_port
+        self.proxy_port = proxy_port
+        self.name = name
+        self.proto = proto
+        self.ip_int = ip_int
+    
+    @classmethod
+    def from_dict(cls, var: dict):
+        return cls(id=var["service_id"], active=var["active"], public_port=var["public_port"], proxy_port=var["proxy_port"], name=var["name"], proto=var["proto"], ip_int=var["ip_int"])

backend/modules/porthijack/nftables.py

@@ -0,0 +1,95 @@
+from typing import List
+from utils import ip_parse, ip_family, NFTableManager
+
+class FiregexFilter():
+    def __init__(self, proto:str, port:int, ip_int:str, queue=None, target:str=None, id=None):
+        self.id = int(id) if id else None
+        self.queue = queue
+        self.target = target
+        self.proto = proto
+        self.port = int(port)
+        self.ip_int = str(ip_int)
+
+    def __eq__(self, o: object) -> bool:
+        if isinstance(o, FiregexFilter):
+            return self.port == o.port and self.proto == o.proto and ip_parse(self.ip_int) == ip_parse(o.ip_int)
+        return False
+
+class FiregexTables(NFTableManager):
+    prerouting_porthijack = "prerouting_porthijack"
+    postrouting_porthijack = "postrouting_porthijack"
+    
+    def __init__(self):
+        super().__init__([
+            {"add":{"chain":{
+                "family":"inet",
+                "table":self.table_name,
+                "name":self.prerouting_porthijack,
+                "type":"filter",
+                "hook":"prerouting",
+                "prio":-300,
+                "policy":"accept"
+            }}},
+            {"add":{"chain":{
+                "family":"inet",
+                "table":self.table_name,
+                "name":self.postrouting_porthijack,
+                "type":"filter",
+                "hook":"postrouting",
+                "prio":-300,
+                "policy":"accept"
+            }}}
+        ],[
+            {"flush":{"chain":{"table":self.table_name,"family":"inet", "name":self.prerouting_porthijack}}},
+            {"delete":{"chain":{"table":self.table_name,"family":"inet", "name":self.prerouting_porthijack}}},
+            {"flush":{"chain":{"table":self.table_name,"family":"inet", "name":self.postrouting_porthijack}}},
+            {"delete":{"chain":{"table":self.table_name,"family":"inet", "name":self.postrouting_porthijack}}}
+        ])
+
+    def add(self, ip_int, proto, public_port, proxy_port):
+        ip_int = ip_parse(ip_int)
+        ip_addr = str(ip_int).split("/")[0]
+        ip_addr_cidr = int(str(ip_int).split("/")[1])
+        self.cmd({ "insert":{ "rule": {
+            "family": "inet",
+            "table": self.table_name,
+            "chain": self.prerouting_porthijack,
+            "expr": [
+                    {'match': {'left': {'payload': {'protocol': ip_family(ip_int), 'field': 'daddr'}}, 'op': '==', 'right': {"prefix": {"addr": ip_addr, "len": ip_addr_cidr}}}},
+                    {'match': {'left': { "payload": {"protocol": str(proto), "field": "dport"}}, "op": "==", "right": int(public_port)}},
+                    {'mangle': {'key': {'payload': {'protocol': str(proto), 'field': 'dport'}}, 'value': int(proxy_port)}}
+                ]
+        }}})
+        self.cmd({ "insert":{ "rule": {
+            "family": "inet",
+            "table": self.table_name,
+            "chain": self.postrouting_porthijack,
+            "expr": [
+                    {'match': {'left': {'payload': {'protocol': ip_family(ip_int), 'field': 'saddr'}}, 'op': '==', 'right': {"prefix": {"addr": ip_addr, "len": ip_addr_cidr}}}},
+                    {'match': {'left': { "payload": {"protocol": str(proto), "field": "sport"}}, "op": "==", "right": int(proxy_port)}},
+                    {'mangle': {'key': {'payload': {'protocol': str(proto), 'field': 'sport'}}, 'value': int(public_port)}}
+                ]
+        }}})
+
+    def get(self) -> List[FiregexFilter]:
+        res = []
+        for filter in self.list_rules(tables=[self.table_name], chains=[self.input_chain,self.output_chain]):
+            queue_str = filter["expr"][2]["queue"]["num"]
+            queue = None
+            if isinstance(queue_str,dict): queue = int(queue_str["range"][0]), int(queue_str["range"][1])
+            else: queue = int(queue_str), int(queue_str)
+            ip_int = None
+            if isinstance(filter["expr"][0]["match"]["right"],str):
+                ip_int = str(ip_parse(filter["expr"][0]["match"]["right"]))
+            else:
+                ip_int = f'{filter["expr"][0]["match"]["right"]["prefix"]["addr"]}/{filter["expr"][0]["match"]["right"]["prefix"]["len"]}'
+            res.append(FiregexFilter(
+                target=filter["chain"],
+                id=int(filter["handle"]),
+                queue=queue,
+                proto=filter["expr"][1]["match"]["left"]["payload"]["protocol"],
+                port=filter["expr"][1]["match"]["right"],
+                ip_int=ip_int
+            ))
+        return res
+