aurore-firewall/main.py

#!/usr/bin/env python3
from configparser import ConfigParser
import socket

from re2oapi import Re2oAPIClient

from jinja2 import Environment, FileSystemLoader

import requests
import base64
import json
import subprocess
import socket
import argparse

import firewall_config

import sys
import os

path =(os.path.dirname(os.path.abspath(__file__)))

config = ConfigParser()
config.read(path+'/config.ini')

api_hostname = config.get('Re2o', 'hostname')
api_password = config.get('Re2o', 'password')
api_username = config.get('Re2o', 'username')

api_client = Re2oAPIClient(api_hostname, api_username, api_password, use_tls=True)

client_hostname = socket.gethostname().split('.', 1)[0]


class iptables:
    def __init__(self):
        self.nat4 = "\n*nat"
        self.mangle4 = "\n*mangle"
        self.filter4 = "\n*filter"
        self.nat6 = "\n*nat"
        self.mangle6 = "\n*mangle"
        self.filter6 = "\n*filter"
        self.global_chain4 = None
        self.global_chain6 = None
        self.subnet_ports = api_client.list("firewall/subnet-ports/")
        self.interface_ports = api_client.list("firewall/interface-ports/")
        self.normal_users = api_client.list("users/normaluser/")
        self.verbose = False
        self.action = None
        self.dry = False
        self.export = False
        self.export4 = False
        self.export6 = False
        self.role = getattr(firewall_config, 'role', None)
        self.interfaces_settings = getattr(firewall_config, 'interfaces_type', None)
        self.nat_settings = getattr(firewall_config, 'nat', None)
        self.portail_settings = getattr(firewall_config, 'portail', None)

    def commit(self, chain):
        self.add(chain, "COMMIT\n")

    def commit_filter(self):
        self.add("filter4", "COMMIT\n")
        self.add("filter6", "COMMIT\n")

    def commit_mangle(self):
        self.add("mangle4", "COMMIT\n")
        self.add("mangle6", "COMMIT\n")

    def commit_nat(self):
        self.add("nat4", "COMMIT\n")
        self.add("nat6", "COMMIT\n")

    def add(self, chain, value):
        setattr(self, chain, getattr(self, chain) + "\n" + value)

    def add_in_subtable(self, chain, subtable, value):
        if '4' in chain:
            self.add(chain, "-A " + subtable + " " + value)
        elif '6' in chain:
            self.add(chain, "-A " + subtable + " " + value)
        else:
            self.add(chain + '4', "-A " + subtable + " " + value)
            self.add(chain + '6', "-A " + subtable + " " + value)

    def init_filter(self, subchain, decision="ACCEPT", mode='all'):
        if mode == 'all' or mode == '4':
            self.add("filter4", ":" + subchain + " " + decision)
        if mode == 'all' or mode == '6':
            self.add("filter6", ":" + subchain + " " + decision)

    def init_nat(self, subchain, decision="ACCEPT", mode='all'):
        if mode == 'all' or mode == '4':
            self.add("nat4", ":" + subchain + " " + decision)
        if mode == 'all' or mode == '6':
            self.add("nat6", ":" + subchain + " " + decision)

    def init_mangle(self, subchain, decision="ACCEPT", mode='all'):
        if mode == 'all' or mode == '4':
            self.add("mangle4", ":" + subchain + " " + decision)
        if mode == 'all' or mode == '6':
            self.add("mangle6", ":" + subchain + " " + decision)

    def jump(self, chain, subchainA, subchainB):
        self.add(chain, "-A " + subchainA + " -j " + subchainB)

    def jump_all_trafic(self, chain, subchainA, subchainB, mode='all'):
        if mode == 'all' or mode == '4':
            self.add(chain + '4', "-A " + subchainA + " -j " + subchainB)
        if mode == 'all' or mode == '6':
            self.add(chain + '6', "-A " + subchainA + " -j " + subchainB)

    def jump_traficfrom(self, chain, interface, subchainA, subchainB, mode='all'):
        if mode == 'all' or mode == '4':
            self.add(chain + '4', "-A " + subchainA + " -i " + interface + " -j " + subchainB)
        if mode == 'all' or mode == '6':
            self.add(chain + '6', "-A " + subchainA + " -i " + interface + " -j " + subchainB)

    def jump_traficto(self, chain, interface, subchainA, subchainB, mode='all'):
        if mode == 'all' or mode == '4':
            self.add(chain + '4', "-A " + subchainA + " -o " + interface + " -j " + subchainB)
        if mode == 'all' or mode == '6':
            self.add(chain + '6', "-A " + subchainA + " -o " + interface + " -j " + subchainB)

    def atomic_add(self, chain, subtable, command, mode='4'):
        command_to_send = "-t %s -I %s 1 %s" % (chain, subtable, command)
        if mode == 'all' or mode == '4':
            command_to_execute = ["sudo","-n","/sbin/iptables"] + command_to_send.split()
        if mode == 'all' or mode == '6':
            command_to_execute = ["sudo","-n","/sbin/ip6tables"] + command_to_send.split()
        process = subprocess.Popen(command_to_execute, stdin=subprocess.PIPE, stdout=subprocess.PIPE)

    def atomic_del(self, chain, subtable, command, mode='4'):
        command_to_send = "-t %s -D %s %s" % (chain, subtable, command)
        if mode == 'all' or mode == '4':
            command_to_execute = ["sudo","-n","/sbin/iptables"] + command_to_send.split()
        if mode == 'all' or mode == '6':
            command_to_execute = ["sudo","-n","/sbin/ip6tables"] + command_to_send.split()
        process = subprocess.Popen(command_to_execute, stdin=subprocess.PIPE, stdout=subprocess.PIPE)

    def routeur6(self, table):
        """Methode appellée spécifiquement pour le parefeu v6"""
        if table == "filter":
            self.base_filter()
            if self.verbose:
                print("Filter : filtage ports v6")
            self.filtrage_ports(ip_type='6')
            if self.verbose:
                print("Filter : limit connexions forward")
            self.limit_ssh_connexion_forward()
            if self.verbose:
                print("Filter : Limit connexion src")
            self.limit_connexion_srcip()
        elif table == "mangle":
            if self.verbose:
                print("Mangle : Mise en place des logs")
            self.log()
            if self.verbose:
                print("Mangle : Réglage correct du MSS")
            self.mss()
        else:
            pass

    def routeur4(self, table):
        """Methode appellée spécifiquement pour le parefeu v4"""
        if table == "filter":
            self.base_filter()
            if self.verbose:
                print("Filter : filtrage ports 4")
            self.filtrage_ports(ip_type='4')
            if self.verbose:
                print("Filter : limit ssh connexion forward")
            self.limit_ssh_connexion_forward()
            if self.verbose:
                print("Filter : limit connexion src ip")
            self.limit_connexion_srcip()
        elif table == "mangle":
            if self.verbose:
                print("Mangle : Mise en place des logs")
            self.log()
            if self.verbose:
                print("Mangle : Réglage correct du MSS")
            self.mss()
        elif table == "nat":
            for nat_to_do in self.nat_settings:
                if self.verbose:
                    print("Nat : priv" + nat_to_do['name'])
                self.nat_prive_ip(nat_to_do)

    def portail(self, table):
        if table == "filter":
            self.base_filter()
            if self.verbose:
                print("Filter : autorisation des ip en sortie")
            self.captif_autorized_ip()
        if table == "nat":
            if self.verbose:
                print("Nat : nat et captures les connexions du portail masquerade")
            self.nat_connexion_portail()
            self.capture_connexion_portail()

    def users(self, table):
        """Securisation d'un serveur avec comptes d'utilisateurs"""
        if table == 'filter':
            self.base_filter()
            if self.verbose:
                print("Filter : Forbid admin vlan for users")
            self.forbid_adm()
        else:
            pass

    def radius(self, table):
        if table == 'filter':
            if self.verbose:
                print("Filter : acceptation des connexions uniquement des serveurs federez")
            self.accept_freerad_from_server()
        else:
            pass

    def base_filter(self):
        if self.verbose:
            print("Filter : reseaux non routables")
        self.reseaux_non_routables()
        if self.verbose:
            print("Filter : connexion input")
        if self.verbose:
            print("Limitation des connexions")
        self.limit_ssh_connexion_input()
        self.limit_connexion_dstip()

    def gen_filter(self, empty=False):
        self.init_filter("INPUT")
        self.init_filter("FORWARD")
        self.init_filter("OUTPUT")
        if not empty:
            if self.verbose:
                print("Filter : icmp")
            self.filter_icmp()
            if self.verbose:
                print("Filter : icmpv6")
            self.filter_icmpv6()
            if self.verbose:
                print("Filter : accept established")
            self.accept_established()
            for role in self.role:
                if hasattr(self, role):
                    getattr(self, role)('filter')
        self.commit_filter()

    def filtrage_ports(self, ip_type='4', subtable='FILTRAGE-PORTS'):
        """Filtrage ports en entrée/sortie du réseau"""
        if ip_type == '4':
            chain = "filter4"
        else:
            chain = "filter6"

        self.init_filter(subtable, decision="-")
        for interface in self.interfaces_settings['sortie']:
            self.jump_traficto("filter", interface, "FORWARD", subtable, mode=ip_type)
            self.jump_traficfrom("filter", interface, "FORWARD", subtable, mode=ip_type)

        def add_general_rule(ports, ip_type, chain, subtable, subnet, protocol, direction):
            """Règles générales, fonction de factorisation"""
            if ip_type == '4':
                self.add_in_subtable(chain, subtable, """-m iprange --%s-range %s-%s -p %s -m multiport --dports %s -j RETURN""" % (direction, subnet["domaine_ip_start"], subnet["domaine_ip_stop"], protocol, ports))
            if ip_type == '6':
                self.add_in_subtable(chain, subtable, """-%s %s -p %s -m multiport --dports %s -j RETURN""" % (direction[0], subnet["complete_prefixv6"], protocol, ports))

        #Ajout des règles générales
        for subnet in self.subnet_ports:
            if subnet["ouverture_ports"]:
                if subnet["ouverture_ports"]["tcp_ports_in"]:
                    ports = ','.join(rule["show_port"] for rule in subnet["ouverture_ports"]["tcp_ports_in"])
                    add_general_rule(ports, ip_type, chain, subtable, subnet, 'tcp', 'dst')
                if subnet["ouverture_ports"]["tcp_ports_out"]:
                    ports = ','.join(rule["show_port"] for rule in subnet["ouverture_ports"]["tcp_ports_out"])
                    add_general_rule(ports, ip_type, chain, subtable, subnet, 'tcp', 'src')
                if subnet["ouverture_ports"]["udp_ports_in"]:
                    ports = ','.join(rule["show_port"] for rule in subnet["ouverture_ports"]["udp_ports_in"])
                    add_general_rule(ports, ip_type, chain, subtable, subnt, 'udp', 'dst')
                if subnet["ouverture_ports"]["udp_ports_out"]:
                    ports = ','.join(rule["show_port"] for rule in subnet["ouverture_ports"]["udp_ports_out"])
                    add_general_rule(ports, ip_type, chain, subtable, subnet, 'udp', 'src')

        def add_specific_rule(ports, ip_type, chain, interface, subnet, protocol, direction):
            """Règles spécifique, fonction de factorisation"""
            if ip_type == '4':
                if interface['ipv4']:
                    self.add_in_subtable(chain, subtable, """-%s %s -p %s -m multiport --dports %s -j RETURN""" % (direction[0], interface['ipv4'], protocol, ports))
            if ip_type == '6':
                for ipv6_addr in interface['ipv6']:
                    self.add_in_subtable(chain, subtable, """-%s %s -p %s -m multiport --dports %s -j RETURN""" % (direction[0], ipv6_addr['ipv6'], protocol, ports))

        for interface in self.interface_ports:
            ports = ','.join([port_list['show_port'] for dict_ports in interface["port_lists"] for port_list in dict_ports["tcp_ports_in"]])
            if ports:
                add_specific_rule(ports, ip_type, chain, interface, subnet, 'tcp', 'dst')
            ports = ','.join([port_list['show_port'] for dict_ports in interface["port_lists"] for port_list in dict_ports["tcp_ports_out"]])
            if ports:
                add_specific_rule(ports, ip_type, chain, interface, subnet, 'tcp', 'src')
            ports = ','.join([port_list['show_port'] for dict_ports in interface["port_lists"] for port_list in dict_ports["udp_ports_in"]])
            if ports:
                add_specific_rule(ports, ip_type, chain, interface, subnet, 'udp', 'dst')
            ports = ','.join([port_list['show_port'] for dict_ports in interface["port_lists"] for port_list in dict_ports["udp_ports_out"]])
            if ports:
                add_specific_rule(ports, ip_type, chain, interface, subnet, 'udp', 'src')


        #Rejet du reste
        self.add_in_subtable(chain, subtable, """-j REJECT""")

    def accept_freerad_from_server(self, subtable='RADIUS-SERVER'):
        """Accepte uniquement le trafique venant des serveurs radius federez"""
        self.init_filter(subtable, decision="-")
        for interface in self.interfaces_settings['sortie']:
            self.jump_traficfrom("filter", interface, "INPUT", subtable)
        for server in self.config_firewall.radius_server:
            self.add_in_subtable("filter4", subtable, """-s %s -p %s -m multiport --dports %s -j ACCEPT""" % (server['ipaddr'], server['protocol'], ','.join(server['port'])))
            self.add_in_subtable("filter6", subtable, """-s %s -p %s -m multiport --dports %s -j ACCEPT""" % (server['ip6addr'], server['protocol'], ','.join(server['port'])))
        self.add_in_subtable("filter", subtable, """-j REJECT""")

    def reseaux_non_routables(self, subtable='ADM-NETWORK'):
        """Bloc le trafic vers les réseaux non routables"""
        self.init_filter(subtable, decision="-")
        for interface in self.interfaces_settings['admin']:
            self.jump_traficto("filter", interface, "FORWARD", subtable)
        self.add_in_subtable("filter", subtable, """-j REJECT""")

    def captif_autorized_ip(self, subtable='FILTRE-IP-PORTAIL'):
        """Autorise les ip whitelistées sur le portail captif accueil"""
        self.init_filter(subtable, decision="-")
        self.jump_all_trafic("filter", "FORWARD", subtable, mode='4')

        for protocol in self.portail_settings['autorized_hosts']:
            for ip, ports in self.portail_settings['autorized_hosts'][protocol].items():
                self.add_in_subtable("filter4", subtable, """-p %s -d %s -m multiport --dports %s -j ACCEPT""" % (protocol, ip, ','.join(ports)))
        self.add_in_subtable("filter4", subtable, """-j REJECT""")


    def capture_connexion_portail(self, subtable="PORTAIL-CAPTIF-REDIRECT"):
        """Redirige les connexion 80 et 443 vers l'ip cible"""
        self.init_nat(subtable, decision="-")
        for interface in self.interfaces_settings['routable']:
            self.jump_traficfrom("nat", interface, "PREROUTING", subtable, mode='4')

        for protocol in self.portail_settings['autorized_hosts']:
            for ip, ports in self.portail_settings['autorized_hosts'][protocol].items():
                self.add_in_subtable("nat4", subtable, """-p %s -d %s -m multiport --dports %s -j RETURN""" % (protocol, ip, ','.join(ports)))
        for ip_range, destination in self.portail_settings['ip_redirect'].items():
            for protocol, ip in destination.items():
                for ip_dest, ports in ip.items():
                    self.add_in_subtable("nat4", subtable, """-p %s -s %s -m multiport --dports %s -j DNAT --to %s""" % (protocol, ip_range, ','.join(ports), ip_dest))

    def nat_connexion_portail(self, subtable="PORTAIL-CAPTIF-NAT"):
        """Nat les connexions derrière l'ip de la machine du portail"""
        self.init_nat(subtable, decision="-")
        for interface in self.interfaces_settings['sortie']:
            self.jump_traficto("nat", interface, "POSTROUTING", subtable, mode='4')

        for protocol in self.portail_settings['autorized_hosts']:
            for ip, ports in self.portail_settings['autorized_hosts'][protocol].items():
                self.add_in_subtable("nat4", subtable, """-p %s -d %s -m multiport --dports %s -j MASQUERADE""" % (protocol, ip, ','.join(ports)))

    def accept_established(self, subtable='ESTABLISHED-CONN'):
        """Accepte les connexions déjà établies"""
        self.init_filter(subtable, decision="-")
        self.jump_all_trafic("filter", "FORWARD", subtable)
        self.jump_all_trafic("filter", "INPUT", subtable)
        self.add_in_subtable("filter", subtable, """-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT""")

    def filter_icmpv6(self, subtable='ICMPV6'):
        self.init_filter(subtable, decision="-", mode='6')
        self.jump_all_trafic("filter", "INPUT", subtable, mode='6')
        self.jump_all_trafic("filter", "FORWARD", subtable, mode='6')
        self.jump_all_trafic("filter", "OUTPUT", subtable, mode='6')
        self.add_in_subtable("filter6", subtable, """-p icmpv6 -m icmp6 --icmpv6-type echo-request -j ACCEPT""")
        self.add_in_subtable("filter6", subtable, """-p icmpv6 -m icmp6 --icmpv6-type echo-reply -j ACCEPT""")
        self.add_in_subtable("filter6", subtable, """-p icmpv6 -m icmp6 --icmpv6-type destination-unreachable -j ACCEPT""")
        self.add_in_subtable("filter6", subtable, """-p icmpv6 -m icmp6 --icmpv6-type packet-too-big -j ACCEPT""")
        self.add_in_subtable("filter6", subtable, """-p icmpv6 -m icmp6 --icmpv6-type ttl-zero-during-transit -j ACCEPT""")
        self.add_in_subtable("filter6", subtable, """-p icmpv6 -m icmp6 --icmpv6-type parameter-problem -j ACCEPT""")

    def filter_icmp(self, subtable='ICMP'):
        self.init_filter(subtable, decision="-", mode='4')
        self.jump_all_trafic("filter", "FORWARD", subtable, mode='4')
        self.jump_all_trafic("filter", "OUTPUT", subtable, mode='4')
        self.jump_all_trafic("filter", "INPUT", subtable, mode='4')
        self.add_in_subtable("filter4", subtable, """-p icmp -j ACCEPT""")

    def limit_ssh_connexion_input(self, subtable='LIMIT-SSH-INPUT'):
        self.init_filter(subtable, decision="-")
        for interface in self.interfaces_settings['routable']:
            self.jump_traficfrom("filter", interface, "INPUT", subtable)

        self.add_in_subtable("filter", subtable, """-p tcp --dport ssh -m state --state NEW -m recent --name SSH-INPUT --set""")
        self.add_in_subtable("filter", subtable, """-p tcp --dport ssh -m state --state NEW -m recent --name SSH-INPUT --update --seconds 120 --hitcount 10 --rttl -j DROP""")

    def limit_ssh_connexion_forward(self, subtable='LIMIT-SSH-FORWARD'):
        self.init_filter(subtable, decision="-")
        for interface in self.interfaces_settings['sortie']:
            self.jump_traficfrom("filter", interface, "FORWARD", subtable)

        self.add_in_subtable("filter", subtable, """-p tcp --dport ssh -m state --state NEW -m recent --name SSH-FORWARD --set""")
        self.add_in_subtable("filter", subtable, """-p tcp --dport ssh -m state --state NEW -m recent --name SSH-FORWARD --update --seconds 30 --hitcount 10 --rttl -j DROP""")

    def limit_connexion_srcip(self, subtable='LIMIT-CONNEXION-SRCIP'):
        self.init_filter(subtable, decision="-")
        for interface in self.interfaces_settings['sortie']:
            self.jump_traficto("filter", interface, "FORWARD", subtable)

        self.add_in_subtable("filter", subtable, """-p udp -m hashlimit --hashlimit-upto 400/sec --hashlimit-burst 800 --hashlimit-mode srcip --hashlimit-name LIMIT_UDP_SRCIP_CONNEXION -j RETURN""")
        self.add_in_subtable("filter", subtable, """-p udp -m hashlimit --hashlimit-upto 5/hour --hashlimit-burst 5 --hashlimit-mode srcip --hashlimit-name LIMIT_UDP_SRCIP_CONNEXION_LOG -j LOG --log-prefix "CONNEXION_LIMIT_UDP" """)
        self.add_in_subtable("filter", subtable, """-p udp -j REJECT""")
        self.add_in_subtable("filter", subtable, """-p tcp -m hashlimit --hashlimit-upto 2000/min --hashlimit-burst 4000 --hashlimit-mode srcip --hashlimit-name LIMIT_TCP_SRCIP_CONNEXION -m state --state NEW -j RETURN""")
        self.add_in_subtable("filter", subtable, """-p tcp -m hashlimit --hashlimit-upto 5/hour --hashlimit-burst 5 --hashlimit-mode srcip --hashlimit-name LIMIT_TCP_SRCIP_CONNEXION_LOG -m state --state NEW -j LOG --log-prefix "CONNEXION_LIMIT_TCP_SRCIP " """)
        self.add_in_subtable("filter", subtable, """-p tcp -m state --state NEW -j REJECT""")
        self.add_in_subtable("filter", subtable, """-m hashlimit --hashlimit-upto 400/sec --hashlimit-burst 800 --hashlimit-mode srcip --hashlimit-name LIMIT_OTHER_SRCIP_CONNEXION -j RETURN""")
        self.add_in_subtable("filter", subtable, """-m hashlimit --hashlimit-upto 5/hour --hashlimit-burst 5 --hashlimit-mode srcip --hashlimit-name LIMIT_OTHER_SRCIP_CONNEXION_LOG -j LOG --log-prefix "CONNEXION_LIMIT " """)
        self.add_in_subtable("filter", subtable, """-j REJECT""")

    def limit_connexion_dstip(self, subtable='LIMIT-CONNEXION-DSTIP', cible='INPUT'):
        self.init_filter(subtable, decision="-")
        for interface in self.interfaces_settings['sortie']:
            self.jump_traficfrom("filter", interface, "FORWARD", subtable)
        for interface in self.interfaces_settings['routable']:
            self.jump_traficfrom("filter", interface, "INPUT", subtable)

        self.add_in_subtable("filter", subtable, """-p udp -m hashlimit --hashlimit-upto 400/sec --hashlimit-burst 800 --hashlimit-mode srcip --hashlimit-name LIMIT_UDP_DSTIP_CONNEXION -j RETURN""")
        self.add_in_subtable("filter", subtable, """-p udp -m hashlimit --hashlimit-upto 5/hour --hashlimit-burst 5 --hashlimit-mode srcip --hashlimit-name LIMIT_UDP_DSTIP_CONNEXION_LOG -j LOG --log-prefix "CONNEXION_LIMIT_UDP" """)
        self.add_in_subtable("filter", subtable, """-p udp -j REJECT""")
        self.add_in_subtable("filter", subtable, """-p tcp -m hashlimit --hashlimit-upto 2000/min --hashlimit-burst 4000 --hashlimit-mode srcip --hashlimit-name LIMIT_TCP_DSTIP_CONNEXION -m state --state NEW -j RETURN""")
        self.add_in_subtable("filter", subtable, """-p tcp -m hashlimit --hashlimit-upto 5/hour --hashlimit-burst 5 --hashlimit-mode srcip --hashlimit-name LIMIT_TCP_DSTIP_CONNEXION_LOG -m state --state NEW -j LOG --log-prefix "CONNEXION_LIMIT_TCP_DSTIP " """)
        self.add_in_subtable("filter", subtable, """-p tcp -m state --state NEW -j REJECT""")
        self.add_in_subtable("filter", subtable, """-m hashlimit --hashlimit-upto 400/sec --hashlimit-burst 800 --hashlimit-mode srcip --hashlimit-name LIMIT_OTHER_DSTIP_CONNEXION -j RETURN""")
        self.add_in_subtable("filter", subtable, """-m hashlimit --hashlimit-upto 5/hour --hashlimit-burst 5 --hashlimit-mode srcip --hashlimit-name LIMIT_OTHER_DSTIP_CONNEXION_LOG -j LOG --log-prefix "CONNEXION_LIMIT " """)
        self.add_in_subtable("filter", subtable, """-j REJECT""")

    def forbid_adm(self, subtable='ADMIN-VLAN'):
        """Interdit aux users non admin de parler sur les vlans admin"""
        self.init_filter(subtable, decision="-")
        for interface in self.interfaces_settings['admin']:
            self.jump_traficto("filter", interface, "OUTPUT", subtable)

        for user in self.normal_users:
            self.add_in_subtable("filter", subtable, """-m owner --uid-owner %s -j REJECT""" % user['uid'])

    def gen_nat(self, empty=False):
        """Génération de la chaine nat"""
        self.init_nat("PREROUTING")
        self.init_nat("INPUT")
        self.init_nat("OUTPUT")
        self.init_nat("POSTROUTING")
        if not empty:
            for role in self.role:
                if hasattr(self, role):
                    getattr(self, role)('nat')
        self.commit_nat()

    def log(self, subtable='LOGALL'):
        """Logage des packet sur les interfaces choisies"""
        self.init_mangle(subtable, decision="-")
        self.jump_all_trafic("mangle", "PREROUTING", subtable)
        self.add_in_subtable("mangle", subtable, '-m state --state NEW -j LOG --log-prefix "LOG_ALL " ')

    def mss(self, subtable='MSS'):
        """Reglage correct du MSS pour éviter les problèmes de MTU"""
        self.init_mangle(subtable, decision="-")
        self.jump_all_trafic("mangle", "POSTROUTING", subtable)

        self.add_in_subtable("mangle", subtable, '-p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu')

    def nat_prive_ip(self, nat_type):
        """Nat filaire en v4"""
        subtable = "CONNEXION-NAT-" + nat_type['name'].upper()
        self.init_nat(subtable, decision="-")
        self.jump_all_trafic("nat", "POSTROUTING", subtable, mode='4')

        if 'interfaces_ip_to_nat' in nat_type and 'ip_sources' in nat_type:
            nat_prive_ip_plage = nat_type['ip_sources']
            for nat_ip_range in range(1, 11):
                range_name = 'nat' + nat_prive_ip_plage.split('.')[1] + '_' + str("%02d" % nat_ip_range )
                self.init_nat(range_name, decision="-")
                self.add_in_subtable("nat4", subtable, '-s ' + '.'.join(nat_prive_ip_plage.split('.')[:2]) + '.' + str(nat_ip_range) + '.0/24 -j ' + range_name)
            for nat_ip_range in range(1, 11):
                range_name = 'nat' + nat_prive_ip_plage.split('.')[1] + '_' + str("%02d" % nat_ip_range)
                nat_rule_tcp = ""
                nat_rule_udp = ""
                for nat_ip_subrange in range(16):
                    subrange_name = range_name + '_' + str(hex(nat_ip_subrange)[2:])
                    self.init_nat(subrange_name, decision="-")
                    self.add_in_subtable("nat4", range_name, '-s ' + '.'.join(nat_prive_ip_plage.split('.')[:2]) + '.' + str(nat_ip_range) + '.' + str(nat_ip_subrange*16) + '/28 -j ' + subrange_name)
                for nat_private_ip in range(256):
                    ip_src = '.'.join(nat_prive_ip_plage.split('.')[:2]) + '.' + str(nat_ip_range) + '.' + str(nat_private_ip) + '/32'

                    port_low = 1000 + 1000*(nat_private_ip%64)
                    port_high = port_low + 999

                    subrange_name = range_name + '_' + str(hex(nat_private_ip//16)[2:])

                    # On nat

                    for interface, pub_ip_range in nat_type['interfaces_ip_to_nat'].items():
                        ip_nat = '.'.join(pub_ip_range.split('.')[:3]) + '.' + str((int(nat_prive_ip_plage.split('.')[1][0]) - 1)*40 + 4*(nat_ip_range - 1) + nat_private_ip//64)
                        nat_rule_tcp += '\n-A %s -s %s -o %s -p tcp -j SNAT --to-source %s' % (subrange_name, ip_src, interface, ip_nat + ':' + str(port_low) + '-' + str(port_high))
                        nat_rule_udp += '\n-A %s -s %s -o %s -p udp -j SNAT --to-source %s' % (subrange_name, ip_src, interface, ip_nat + ':' + str(port_low) + '-' + str(port_high))
                self.add("nat4", nat_rule_tcp)
                self.add("nat4", nat_rule_udp)

            # On nat tout ce qui match dans les règles et qui n'est pas du tcp/udp derrière la première ip publique unused (25*10) + 1
            # Ne pas oublier de loguer ce qui sort de cette ip
            for interface, pub_ip_range in nat_type['interfaces_ip_to_nat'].items():
                self.add_in_subtable("nat4", subtable, '-s ' + nat_prive_ip_plage + ' -o %s -j SNAT --to-source ' % (interface,)  + '.'.join(pub_ip_range.split('.')[:3]) + '.' + str(250 + int(nat_prive_ip_plage.split('.')[1][0])))

        if 'extra_nat' in nat_type:
            ### Extra-nat (ex : Pour que le routeur ait accès à internet)
            for ip_source, ip_to_nat in nat_type['extra_nat'].items():
                self.add_in_subtable("nat4", subtable, '-s ' + ip_source + ' -j SNAT --to-source ' + ip_to_nat)

    def gen_mangle(self, empty=False):
        """Génération de la chaine mangle"""
        self.init_mangle("PREROUTING")
        self.init_mangle("INPUT")
        self.init_mangle("FORWARD")
        self.init_mangle("OUTPUT")
        self.init_mangle("POSTROUTING")
        if not empty:
            for role in self.role:
                if hasattr(self, role):
                    getattr(self, role)('mangle')
        self.commit_mangle()

    def gen_firewall(self, empty=False):
        """Assemblage des chaines et export si il y a lieu"""
        self.gen_mangle(empty=empty)
        self.gen_nat(empty=empty)
        self.gen_filter(empty=empty)
        self.global_chain4 = self.nat4 + self.filter4 + self.mangle4
        self.global_chain6 = self.nat6 + self.filter6 + self.mangle6
        if self.export or self.export4:
            print(self.global_chain4)
        if self.export or self.export6:
            print(self.global_chain6)

    def restore_iptables(self, mode='4'):
        """Restoration de l'iptable générée"""
        if mode == '6':
            global_chain = self.global_chain6
            command_to_execute = ["sudo","-n","/sbin/ip6tables-restore"]
        else:
            global_chain = self.global_chain4 
            command_to_execute = ["sudo","-n","/sbin/iptables-restore"]
        process = subprocess.Popen(command_to_execute, stdin=subprocess.PIPE, stdout=subprocess.PIPE)
        process.communicate(input=global_chain.encode('utf-8'))


    def complete_flush_iptables(self, mode='4'):
        """Insère un parefeuv6 vide, appellé par l'arrét du parefeu"""
        self.restore_iptables(mode=mode)

    def do_action(self):
        """Effectue l'action demandée"""
        if self.action == "start" or self.action == "restart":
            self.gen_firewall()
            if not self.dry:
                self.reload()
        elif self.action == "stop":
            self.gen_firewall(empty=True)
            if not self.dry:
                self.flush()
        else:
            raise NotImplementedError("Action non reconnu, actions valides : start, stop ou restart")

    def reload(self):
        """Recharge le parefeu"""
        if any('6' in role for role in self.role):
            self.restore_iptables(mode='6')
            return
        if any('4' in role for role in self.role):
            self.restore_iptables(mode='4')
            return
        self.restore_iptables(mode='6')
        self.restore_iptables(mode='4')

    def flush(self):
        """Vide la chaine iptables, ou ip6tables suivant le role du serveur"""
        if any('6' in role for role in self.role):
            return
            self.complete_flush_iptables(mode='6')
        if any('4' in role for role in self.role):
            self.complete_flush_iptables(mode='4')
            return
        self.restore_iptables(mode='6')
        self.restore_iptables(mode='4')

    def add_port(self, ports, ip_cible, sens, protocole, subtable='FILTRAGE-PORTS', mode='4'):
        """Ajout atomique d'une ouverture de port
        ports : liste des ports à ouvrir
        sens : source ou destination
        protocole : tcp ou udp
        ip cible : ip où s'applique l'ouverture"""
        if sens == "source":
            self.atomic_add("filter", subtable, """-%s %s -p %s -m multiport --dports %s -j RETURN""" % ('s', ip_cible, protocole, ','.join(self.format_port(port) for port in ports)), mode=mode)
        if sens == "destination":
            self.atomic_add("filter", subtable, """-%s %s -p %s -m multiport --dports %s -j RETURN""" % ('d', ip_cible, protocole, ','.join(self.format_port(port) for port  in ports)), mode=mode)


def run(args):
    table = iptables()
    if args.verbose:
        table.verbose = True
    table.action = args.action
    table.export = args.export
    table.dry = args.dry
    table.export4 = args.export4
    table.export6 = args.export6
    table.do_action()


if __name__ == '__main__':
    parser = argparse.ArgumentParser()
    parser.add_argument("-v", "--verbose", help="increase output verbosity", action="store_true")
    parser.add_argument("-e", "--export", help="export le contenu des parefeus", action="store_true")
    parser.add_argument("-e4", "--export4", help="export le contenu du parefeu v4", action="store_true")
    parser.add_argument("-e6", "--export6", help="export le contenu du parefeu v6", action="store_true")
    parser.add_argument("action", help="Mode reconnus : start, stop ou restart", default="restart", nargs="?")
    parser.add_argument("--force", help="Force l'action", action="store_true")
    parser.add_argument("--dry", help="Ne pas effectuer de modification sur le pare-feu", default=False, action="store_true")
    args = parser.parse_args()

    if args.force:
        run(args)

    for service in api_client.list("services/regen/"):
        if service['hostname'] == client_hostname and \
            service['service_name'] == 'firewall' and \
            service['need_regen']:
            run(args)
            if not args.dry:
                api_client.patch(service['api_url'], data={'need_regen': False})