sync

[Pman.Admin] / Iptables.php

diff --git a/Iptables.php b/Iptables.php
index df11c2c..a88c246 100644 (file)
--- a/Iptables.php
+++ b/Iptables.php
@@ -47,7 +47,7 @@ class Pman_Admin_Iptables extends Pman {
         return '/tmp/run_pman_admin_iptables-'.$db;
     }
     
-    function get($opt = '')
+    function get($opt = '', $opts = Array())
     {
         
         // monitor file
@@ -84,9 +84,9 @@ class Pman_Admin_Iptables extends Pman {
         
         
         */
-        DB_DataObject::debugLevel(1);
+        //DB_DataObject::debugLevel(1);
         
-        $p = DB_DataObject::Factory('Person');
+        $p = DB_DataObject::Factory('core_person');
         $p->autoJoin();
         $p->whereAdd("join_company_id_id.comptype = 'OWNER'");
         $p->selectAdd();
@@ -114,7 +114,7 @@ class Pman_Admin_Iptables extends Pman {
             max(event_when) + $interval as expires
                      
         ");
-        $e->person_table = DB_DataObject::factory('person')->tableName();
+        $e->person_table = DB_DataObject::factory('core_person')->tableName();
         $e->whereAddIn('person_id', $peps, 'int');
         $e->groupBy('ipaddr');
         $e->whereAdd("event_when > NOW() - $interval");
@@ -124,9 +124,9 @@ class Pman_Admin_Iptables extends Pman {
 
         require_once 'System.php';
         //inet addr:202.67.151.28  Bcast:202.67.151.255  Mask:255.255.255.0
-        $ifconfig = System::which('ifconfig');
+        $ifconfig = System::which('ifconfig','/sbin/ifconfig');
         
-        if (!$ifconfig) {
+        if (!$ifconfig || !file_exists($ifconfig)) {
             $this->jerr("ifconfig could not be found.");
         }
 
@@ -152,29 +152,28 @@ class Pman_Admin_Iptables extends Pman {
         exit;
 
     }
-    function updateTables()
+    
+    function readChain($chain)
     {
-       
-        require_once 'System.php';
         
-        $iptables = System::which('iptables');
+        static $iptables;
         
-         if (!$iptables) {
-            $this->jerr("iptables could not be found.");
+        if (!$iptables) {
+            require_once 'System.php';
+            
+            $iptables = System::which('iptables', '/sbin/iptables');
+            
+            if (!$iptables || !file_exists($iptables)) {
+                $this->jerr("iptables could not be found.");
+            }
         }
         // this should have been set up already..
         // in the base firewall code.
        
-        
-        // -A INPUT -p udp -m udp --dport 5432 -j postgres
-        // -A INPUT -p tcp -m tcp --dport 5432 -j postgres
+        $res = $this->exec("{$iptables} -L {$chain} -v -n --line-numbers");   
         
         
-        // /sbin/iptables -L postgres -v -n --line-numbers
         
-        $res = $this->exec("{$iptables} -L postgres -v -n --line-numbers");   
-       
-       
         $lastrulenum = 1;
        
         $remove = array();
@@ -201,17 +200,81 @@ class Pman_Admin_Iptables extends Pman {
             }
            // print_r($row);
             //var_dump($row['target']);
-            if ($row['target'] != 'ACCEPT') {
-                continue;
-            }
+             
             
             // got input rules now..
-            if (!empty($row['comment'])) {
-                foreach((array)json_decode($row['comment']) as $k=>$v) {
+            if (!empty($row['comments'])) {
+                
+                $row['comments'] = preg_replace('#^/\*#', '', trim($row['comments']) );
+                $row['comments'] = preg_replace('#\*/$#', '', $row['comments'] );
+                foreach((array)json_decode($row['comments']) as $k=>$v) {
                     $row[$k] = $v;
                 }
             }
+            $rows[] = $row;
+                          
+             
+        }
+        if (empty($head)) {
+            return false;
+        }
+        
+        return  $rows;
+    
+    }
+    
+    
+    
+    function updateTables()
+    {
+        static $iptables;
+        
+        if (!$iptables) {
+            require_once 'System.php';
+            
+            $iptables = System::which('iptables', '/sbin/iptables');
+            
+            if (!$iptables || !file_exists($iptables)) {
+                $this->jerr("iptables could not be found.");
+            }
+        }
+        // this should have been set up already..
+        // in the base firewall code.
+       
+       
+        $rows = $this->readChain('INPUT');
+        $gotpg = false;
+        foreach($rows as $r) {
+            if ($r['target'] == 'postgres') {
+                $gotpg = true;
+            }
+        }
+        if (!$gotpg) {
+            $this->exec("{$iptables} -A INPUT -p udp -m udp --dport 5432 -j postgres");
+            $this->exec("{$iptables} -A INPUT -p tcp -m udp --dport 5432 -j postgres");
+        }
+        
+        
+        $rows = $this->readChain('postgres');
+        if ($rows === false) {
+            $this->createBase();
+            $rows = array();
+        }
+         
+        $lastrulenum = 1;
+       
+        $remove = array();
+        $cur = array();
+         
+        foreach($rows as $row) {
+             
+           // print_r($row);
+            //var_dump($row['target']);
+            if ($row['target'] != 'ACCEPT') {
+                continue;
+            }
             
+             
             if (!empty($row['expires'])) {
                 if (strtotime($row['expires']) < time()) {
                     $remove[ $row['source'] ] = $row;
@@ -223,19 +286,16 @@ class Pman_Admin_Iptables extends Pman {
             $lastrulenum = $row['num'];
             
         }
-        if (empty($head)) {
-            // then there was no chain.
-            $this->createBase();
-        }
+         
         
-        print_r($cur);
+        //print_r($cur);
         //--comment
         
           
          
         foreach($this->ips as $ip=>$expires) {
             $comment = strlen($expires) ?
-                    ('--comment ' . escapeshellarg(json_encode(array('expires'=>$expires))) ) :
+                    ('-m comment --comment ' . escapeshellarg(json_encode(array('expires'=>$expires))) ) :
                     '';
 
             
@@ -269,21 +329,56 @@ class Pman_Admin_Iptables extends Pman {
         
         // remove rules that need deleting..
         foreach($remove as $ip => $r) {
-            $this->exec("{$iptables} -d postgres {$r['num']} ");
+            
+            $this->removeIp($ip);
+             
             
         }
         
-        
+        $this->exec("{$iptables} -L postgres -v -n --line-numbers");   
+       
   
         
     }
     
+    function removeIp($ip)
+    {
+        static $iptables;
+        
+        if (!$iptables) {
+            require_once 'System.php';
+            
+            $iptables = System::which('iptables', '/sbin/iptables');
+            
+            if (!$iptables || !file_exists($iptables)) {
+                $this->jerr("iptables could not be found.");
+            }
+        }    
+        // we need to scan the list each time, as the order get's renumbered when we remove wone...
+        $ar = $this->readChain('postgres');
+        foreach($ar as $row) {
+            if ($row['target'] != 'ACCEPT') {
+                continue;
+            }
+            
+            if ($row['source'] != $ip) {
+                continue;
+            }
+            $this->exec("{$iptables} -D postgres {$row['num']} ");
+            break;
+        }
+    }
+    
+    
     
     function createBase()
     {
         
-        $iptables = System::which('iptables');
-        if (!$iptables) {
+         require_once 'System.php';
+        
+        $iptables = System::which('iptables', '/sbin/iptables');
+        
+         if (!$iptables || !file_exists($iptables)) {
             $this->jerr("iptables could not be found.");
         }