135 lines
3.6 KiB
Python
135 lines
3.6 KiB
Python
|
# coding: utf-8
|
|||
|
|
# -------------------------------------------------------------------
|
|||
|
|
# yakpanel
|
|||
|
|
# -------------------------------------------------------------------
|
|||
|
|
# Copyright (c) 2014-2099 yakpanel(http://www.yakpanel.com) All rights reserved.
|
|||
|
|
# -------------------------------------------------------------------
|
|||
|
|
|
|||
|
|
import os
|
|||
|
|
import subprocess
|
|||
|
|
import sys
|
|||
|
|
import threading
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
def run_cmd(cmd):
|
|||
|
|
try:
|
|||
|
|
subprocess.run(cmd, shell=True, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|||
|
|
return True
|
|||
|
|
except:
|
|||
|
|
return False
|
|||
|
|
|
|||
|
|
|
|||
|
|
def load_iptables():
|
|||
|
|
"""
|
|||
|
|
恢复 iptables 规则
|
|||
|
|
"""
|
|||
|
|
if run_cmd("iptables -C INPUT -j IN_BT"):
|
|||
|
|
print("iptables existed")
|
|||
|
|
else:
|
|||
|
|
if run_cmd("iptables-restore --noflush < /www/server/panel/data/iptablesdata"):
|
|||
|
|
print("iptables restored")
|
|||
|
|
|
|||
|
|
|
|||
|
|
def load_ipset():
|
|||
|
|
"""
|
|||
|
|
恢复 ipset 规则
|
|||
|
|
"""
|
|||
|
|
if run_cmd("ipset restore < /www/server/panel/data/ipsetdata"):
|
|||
|
|
print("ipset restored")
|
|||
|
|
else:
|
|||
|
|
print("ipset existed")
|
|||
|
|
|
|||
|
|
|
|||
|
|
def save_iptables():
|
|||
|
|
"""
|
|||
|
|
保存 iptables 规则
|
|||
|
|
"""
|
|||
|
|
if run_cmd("iptables -C INPUT -j IN_BT"):
|
|||
|
|
if run_cmd(
|
|||
|
|
"iptables-save | grep -E 'IN_BT|OUT_BT|FORWARD_BT|^\*|^COMMIT' | sed 's/^-A INPUT/-I INPUT/; s/^-A OUTPUT/-I OUTPUT/; s/^-A PREROUTING/-I PREROUTING/' > /www/server/panel/data/iptablesdata"):
|
|||
|
|
print("iptables saved")
|
|||
|
|
|
|||
|
|
|
|||
|
|
def save_ipset():
|
|||
|
|
"""
|
|||
|
|
保存 ipset 规则
|
|||
|
|
"""
|
|||
|
|
if run_cmd("ipset save | grep -E '_bt_' > /www/server/panel/data/ipsetdata"):
|
|||
|
|
print("ipset saved")
|
|||
|
|
|
|||
|
|
|
|||
|
|
def dbus_listener():
|
|||
|
|
if not os.path.exists("/sbin/firewalld"):
|
|||
|
|
print("is not Firewalld")
|
|||
|
|
return
|
|||
|
|
|
|||
|
|
cmd = [
|
|||
|
|
"dbus-monitor",
|
|||
|
|
"--system",
|
|||
|
|
"type='signal',path='/org/fedoraproject/FirewallD1',interface='org.fedoraproject.FirewallD1',member='Reloaded'",
|
|||
|
|
"type='signal',interface='org.freedesktop.DBus',member='NameOwnerChanged',arg0='org.fedoraproject.FirewallD1',arg1=''"
|
|||
|
|
]
|
|||
|
|
process = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
|
|||
|
|
|
|||
|
|
while True:
|
|||
|
|
line = process.stdout.readline().strip()
|
|||
|
|
|
|||
|
|
if not line:
|
|||
|
|
break
|
|||
|
|
if "signal" in line:
|
|||
|
|
if "member=Reloaded" in line:
|
|||
|
|
print("firewalld reload...")
|
|||
|
|
load_iptables()
|
|||
|
|
elif "member=NameOwnerChanged" in line:
|
|||
|
|
print("firewalld restart...")
|
|||
|
|
threading.Timer(3, load_iptables).start()
|
|||
|
|
|
|||
|
|
|
|||
|
|
def main():
|
|||
|
|
import time
|
|||
|
|
if len(sys.argv) < 2:
|
|||
|
|
print("command：start|reload|stop|save")
|
|||
|
|
sys.exit(1)
|
|||
|
|
|
|||
|
|
command = sys.argv[1]
|
|||
|
|
if command == "start":
|
|||
|
|
load_ipset()
|
|||
|
|
load_iptables()
|
|||
|
|
listener_thread = threading.Thread(target=dbus_listener)
|
|||
|
|
listener_thread.daemon = True
|
|||
|
|
listener_thread.start()
|
|||
|
|
while True:
|
|||
|
|
time.sleep(1)
|
|||
|
|
elif command == "reload":
|
|||
|
|
save_ipset()
|
|||
|
|
save_iptables()
|
|||
|
|
load_ipset()
|
|||
|
|
load_iptables()
|
|||
|
|
elif command == "stop":
|
|||
|
|
save_ipset()
|
|||
|
|
save_iptables()
|
|||
|
|
elif command == "save":
|
|||
|
|
save_ipset()
|
|||
|
|
save_iptables()
|
|||
|
|
elif command == "saveiptables":
|
|||
|
|
save_iptables()
|
|||
|
|
elif command == "saveipset":
|
|||
|
|
save_ipset()
|
|||
|
|
elif command == "loadiptables":
|
|||
|
|
load_iptables()
|
|||
|
|
elif command == "loadipset":
|
|||
|
|
load_ipset()
|
|||
|
|
elif command == "reloadiptables":
|
|||
|
|
save_iptables()
|
|||
|
|
load_iptables()
|
|||
|
|
elif command == "reloadipset":
|
|||
|
|
save_ipset()
|
|||
|
|
load_ipset()
|
|||
|
|
else:
|
|||
|
|
sys.exit(1)
|
|||
|
|
|
|||
|
|
|
|||
|
|
if __name__ == "__main__":
|
|||
|
|
main()
|