Initial YakPanel commit

script/BT-FirewallServices.py

@@ -0,0 +1,134 @@
+# coding: utf-8
+# -------------------------------------------------------------------
+# yakpanel
+# -------------------------------------------------------------------
+# Copyright (c) 2014-2099 yakpanel(http://www.yakpanel.com) All rights reserved.
+# -------------------------------------------------------------------
+
+import os
+import subprocess
+import sys
+import threading
+
+
+
+def run_cmd(cmd):
+    try:
+        subprocess.run(cmd, shell=True, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+        return True
+    except:
+        return False
+
+
+def load_iptables():
+    """
+    恢复 iptables 规则
+    """
+    if run_cmd("iptables -C INPUT -j IN_BT"):
+        print("iptables existed")
+    else:
+        if run_cmd("iptables-restore --noflush < /www/server/panel/data/iptablesdata"):
+            print("iptables restored")
+
+
+def load_ipset():
+    """
+    恢复 ipset 规则
+    """
+    if run_cmd("ipset restore < /www/server/panel/data/ipsetdata"):
+        print("ipset restored")
+    else:
+        print("ipset existed")
+
+
+def save_iptables():
+    """
+    保存 iptables 规则
+    """
+    if run_cmd("iptables -C INPUT -j IN_BT"):
+        if run_cmd(
+                "iptables-save  | grep -E 'IN_BT|OUT_BT|FORWARD_BT|^\*|^COMMIT' | sed 's/^-A INPUT/-I INPUT/; s/^-A OUTPUT/-I OUTPUT/; s/^-A PREROUTING/-I PREROUTING/' > /www/server/panel/data/iptablesdata"):
+            print("iptables saved")
+
+
+def save_ipset():
+    """
+    保存 ipset 规则
+    """
+    if run_cmd("ipset save | grep -E '_bt_' > /www/server/panel/data/ipsetdata"):
+        print("ipset saved")
+
+
+def dbus_listener():
+    if not os.path.exists("/sbin/firewalld"):
+        print("is not Firewalld")
+        return
+
+    cmd = [
+        "dbus-monitor",
+        "--system",
+        "type='signal',path='/org/fedoraproject/FirewallD1',interface='org.fedoraproject.FirewallD1',member='Reloaded'",
+        "type='signal',interface='org.freedesktop.DBus',member='NameOwnerChanged',arg0='org.fedoraproject.FirewallD1',arg1=''"
+    ]
+    process = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+
+    while True:
+        line = process.stdout.readline().strip()
+
+        if not line:
+            break
+        if "signal" in line:
+            if "member=Reloaded" in line:
+                print("firewalld reload...")
+                load_iptables()
+            elif "member=NameOwnerChanged" in line:
+                print("firewalld restart...")
+                threading.Timer(3, load_iptables).start()
+
+
+def main():
+    import time
+    if len(sys.argv) < 2:
+        print("command：start|reload|stop|save")
+        sys.exit(1)
+
+    command = sys.argv[1]
+    if command == "start":
+        load_ipset()
+        load_iptables()
+        listener_thread = threading.Thread(target=dbus_listener)
+        listener_thread.daemon = True
+        listener_thread.start()
+        while True:
+            time.sleep(1)
+    elif command == "reload":
+        save_ipset()
+        save_iptables()
+        load_ipset()
+        load_iptables()
+    elif command == "stop":
+        save_ipset()
+        save_iptables()
+    elif command == "save":
+        save_ipset()
+        save_iptables()
+    elif command == "saveiptables":
+        save_iptables()
+    elif command == "saveipset":
+        save_ipset()
+    elif command == "loadiptables":
+        load_iptables()
+    elif command == "loadipset":
+        load_ipset()
+    elif command == "reloadiptables":
+        save_iptables()
+        load_iptables()
+    elif command == "reloadipset":
+        save_ipset()
+        load_ipset()
+    else:
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()