sync

[Pman.Admin] / Iptables.php

diff --git a/Iptables.php b/Iptables.php
index 2651271..a88c246 100644 (file)
--- a/Iptables.php
+++ b/Iptables.php
@@ -47,7 +47,7 @@ class Pman_Admin_Iptables extends Pman {
         return '/tmp/run_pman_admin_iptables-'.$db;
     }
     
-    function get($opt = '')
+    function get($opt = '', $opts = Array())
     {
         
         // monitor file
@@ -86,7 +86,7 @@ class Pman_Admin_Iptables extends Pman {
         */
         //DB_DataObject::debugLevel(1);
         
-        $p = DB_DataObject::Factory('Person');
+        $p = DB_DataObject::Factory('core_person');
         $p->autoJoin();
         $p->whereAdd("join_company_id_id.comptype = 'OWNER'");
         $p->selectAdd();
@@ -114,7 +114,7 @@ class Pman_Admin_Iptables extends Pman {
             max(event_when) + $interval as expires
                      
         ");
-        $e->person_table = DB_DataObject::factory('person')->tableName();
+        $e->person_table = DB_DataObject::factory('core_person')->tableName();
         $e->whereAddIn('person_id', $peps, 'int');
         $e->groupBy('ipaddr');
         $e->whereAdd("event_when > NOW() - $interval");
@@ -124,9 +124,9 @@ class Pman_Admin_Iptables extends Pman {
 
         require_once 'System.php';
         //inet addr:202.67.151.28  Bcast:202.67.151.255  Mask:255.255.255.0
-        $ifconfig = System::which('ifconfig');
+        $ifconfig = System::which('ifconfig','/sbin/ifconfig');
         
-        if (!$ifconfig) {
+        if (!$ifconfig || !file_exists($ifconfig)) {
             $this->jerr("ifconfig could not be found.");
         }
 
@@ -153,15 +153,19 @@ class Pman_Admin_Iptables extends Pman {
 
     }
     
-    function readTable($chain)
+    function readChain($chain)
     {
         
-         require_once 'System.php';
-        
-        $iptables = System::which('iptables');
+        static $iptables;
         
-         if (!$iptables) {
-            $this->jerr("iptables could not be found.");
+        if (!$iptables) {
+            require_once 'System.php';
+            
+            $iptables = System::which('iptables', '/sbin/iptables');
+            
+            if (!$iptables || !file_exists($iptables)) {
+                $this->jerr("iptables could not be found.");
+            }
         }
         // this should have been set up already..
         // in the base firewall code.
@@ -223,13 +227,16 @@ class Pman_Admin_Iptables extends Pman {
     
     function updateTables()
     {
-       
-        require_once 'System.php';
+        static $iptables;
         
-        $iptables = System::which('iptables');
-        
-         if (!$iptables) {
-            $this->jerr("iptables could not be found.");
+        if (!$iptables) {
+            require_once 'System.php';
+            
+            $iptables = System::which('iptables', '/sbin/iptables');
+            
+            if (!$iptables || !file_exists($iptables)) {
+                $this->jerr("iptables could not be found.");
+            }
         }
         // this should have been set up already..
         // in the base firewall code.
@@ -248,58 +255,26 @@ class Pman_Admin_Iptables extends Pman {
         }
         
         
-         $rows = $this->readChain('postgres');
-       
-        
-        // -A INPUT -p udp -m udp --dport 5432 -j postgres
-        // -A INPUT -p tcp -m tcp --dport 5432 -j postgres
-        
-        
-        // /sbin/iptables -L postgres -v -n --line-numbers
-        
-        $res = $this->exec("{$iptables} -L postgres -v -n --line-numbers");   
-       
-       
+        $rows = $this->readChain('postgres');
+        if ($rows === false) {
+            $this->createBase();
+            $rows = array();
+        }
+         
         $lastrulenum = 1;
        
         $remove = array();
         $cur = array();
-        $head = false;
-        
-        foreach(explode("\n", $res) as $i => $line) {
-            if ($i == 1) {
-                $head = preg_split('/\s+/', $line);
-                $head[10] = 'comments';
-            }
-            if ($i < 2) {
-                continue;
-            }
-            
-            $ar = preg_split('/\s+/', $line);
-            if (count($ar) < 3) {
-                continue;
-            }
-            $ar[10] = implode(' ',array_slice($ar, 10));
-            $row = array();
-            foreach($head as $k=>$v) {
-                $row[$v] = $ar[$k];
-            }
+         
+        foreach($rows as $row) {
+             
            // print_r($row);
             //var_dump($row['target']);
             if ($row['target'] != 'ACCEPT') {
                 continue;
             }
             
-            // got input rules now..
-            if (!empty($row['comments'])) {
-                
-                $row['comments'] = preg_replace('#^/\*#', '', trim($row['comments']) );
-                $row['comments'] = preg_replace('#\*/$#', '', $row['comments'] );
-                foreach((array)json_decode($row['comments']) as $k=>$v) {
-                    $row[$k] = $v;
-                }
-            }
-            
+             
             if (!empty($row['expires'])) {
                 if (strtotime($row['expires']) < time()) {
                     $remove[ $row['source'] ] = $row;
@@ -311,10 +286,7 @@ class Pman_Admin_Iptables extends Pman {
             $lastrulenum = $row['num'];
             
         }
-        if (empty($head)) {
-            // then there was no chain.
-            $this->createBase();
-        }
+         
         
         //print_r($cur);
         //--comment
@@ -357,7 +329,9 @@ class Pman_Admin_Iptables extends Pman {
         
         // remove rules that need deleting..
         foreach($remove as $ip => $r) {
-            $this->exec("{$iptables} -d postgres {$r['num']} ");
+            
+            $this->removeIp($ip);
+             
             
         }
         
@@ -367,12 +341,44 @@ class Pman_Admin_Iptables extends Pman {
         
     }
     
+    function removeIp($ip)
+    {
+        static $iptables;
+        
+        if (!$iptables) {
+            require_once 'System.php';
+            
+            $iptables = System::which('iptables', '/sbin/iptables');
+            
+            if (!$iptables || !file_exists($iptables)) {
+                $this->jerr("iptables could not be found.");
+            }
+        }    
+        // we need to scan the list each time, as the order get's renumbered when we remove wone...
+        $ar = $this->readChain('postgres');
+        foreach($ar as $row) {
+            if ($row['target'] != 'ACCEPT') {
+                continue;
+            }
+            
+            if ($row['source'] != $ip) {
+                continue;
+            }
+            $this->exec("{$iptables} -D postgres {$row['num']} ");
+            break;
+        }
+    }
+    
+    
     
     function createBase()
     {
         
-        $iptables = System::which('iptables');
-        if (!$iptables) {
+         require_once 'System.php';
+        
+        $iptables = System::which('iptables', '/sbin/iptables');
+        
+         if (!$iptables || !file_exists($iptables)) {
             $this->jerr("iptables could not be found.");
         }