2023-03-24 15:19:17 +00:00
|
|
|
package client
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"strings"
|
|
|
|
|
2023-07-17 08:34:29 +00:00
|
|
|
"github.com/1Panel-dev/1Panel/backend/buserr"
|
|
|
|
"github.com/1Panel-dev/1Panel/backend/constant"
|
2023-03-30 10:03:21 +00:00
|
|
|
"github.com/1Panel-dev/1Panel/backend/utils/cmd"
|
2023-03-24 15:19:17 +00:00
|
|
|
)
|
|
|
|
|
2023-04-20 10:44:17 +00:00
|
|
|
type Ufw struct {
|
|
|
|
CmdStr string
|
|
|
|
}
|
2023-03-24 15:19:17 +00:00
|
|
|
|
|
|
|
func NewUfw() (*Ufw, error) {
|
2023-04-20 10:44:17 +00:00
|
|
|
var ufw Ufw
|
2023-04-20 15:10:17 +00:00
|
|
|
if cmd.HasNoPasswordSudo() {
|
2023-04-20 10:44:17 +00:00
|
|
|
ufw.CmdStr = "sudo ufw"
|
|
|
|
} else {
|
|
|
|
ufw.CmdStr = "ufw"
|
|
|
|
}
|
|
|
|
return &ufw, nil
|
2023-03-24 15:19:17 +00:00
|
|
|
}
|
|
|
|
|
2023-03-28 07:17:13 +00:00
|
|
|
func (f *Ufw) Name() string {
|
|
|
|
return "ufw"
|
|
|
|
}
|
|
|
|
|
2023-03-24 15:19:17 +00:00
|
|
|
func (f *Ufw) Status() (string, error) {
|
2023-04-20 10:51:18 +00:00
|
|
|
stdout, _ := cmd.Execf("%s status | grep Status", f.CmdStr)
|
2023-03-30 08:07:28 +00:00
|
|
|
if stdout == "Status: active\n" {
|
2023-03-24 15:19:17 +00:00
|
|
|
return "running", nil
|
|
|
|
}
|
2023-04-20 10:51:18 +00:00
|
|
|
stdout1, _ := cmd.Execf("%s status | grep 状态", f.CmdStr)
|
|
|
|
if stdout1 == "状态: 激活\n" {
|
|
|
|
return "running", nil
|
|
|
|
}
|
2023-03-24 15:19:17 +00:00
|
|
|
return "not running", nil
|
|
|
|
}
|
|
|
|
|
2023-03-30 08:07:28 +00:00
|
|
|
func (f *Ufw) Version() (string, error) {
|
2023-04-21 04:28:11 +00:00
|
|
|
stdout, err := cmd.Execf("%s version | grep ufw", f.CmdStr)
|
2023-03-30 08:07:28 +00:00
|
|
|
if err != nil {
|
|
|
|
return "", fmt.Errorf("load the firewall status failed, err: %s", stdout)
|
|
|
|
}
|
|
|
|
info := strings.ReplaceAll(stdout, "\n", "")
|
|
|
|
return strings.ReplaceAll(info, "ufw ", ""), nil
|
|
|
|
}
|
|
|
|
|
2023-03-24 15:19:17 +00:00
|
|
|
func (f *Ufw) Start() error {
|
2023-04-20 10:44:17 +00:00
|
|
|
stdout, err := cmd.Execf("echo y | %s enable", f.CmdStr)
|
2023-03-24 15:19:17 +00:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("enable the firewall failed, err: %s", stdout)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (f *Ufw) Stop() error {
|
2023-04-20 10:44:17 +00:00
|
|
|
stdout, err := cmd.Execf("%s disable", f.CmdStr)
|
2023-03-24 15:19:17 +00:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("stop the firewall failed, err: %s", stdout)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (f *Ufw) Reload() error {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (f *Ufw) ListPort() ([]FireInfo, error) {
|
2023-04-20 10:44:17 +00:00
|
|
|
stdout, err := cmd.Execf("%s status verbose", f.CmdStr)
|
2023-03-24 15:19:17 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2023-03-27 15:29:46 +00:00
|
|
|
portInfos := strings.Split(stdout, "\n")
|
2023-03-24 15:19:17 +00:00
|
|
|
var datas []FireInfo
|
2023-03-27 11:02:36 +00:00
|
|
|
isStart := false
|
|
|
|
for _, line := range portInfos {
|
2023-04-21 08:45:22 +00:00
|
|
|
if strings.HasPrefix(line, "-") {
|
2023-03-27 11:02:36 +00:00
|
|
|
isStart = true
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
if !isStart {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
itemFire := f.loadInfo(line, "port")
|
2023-03-28 07:17:13 +00:00
|
|
|
if len(itemFire.Port) != 0 && itemFire.Port != "Anywhere" && !strings.Contains(itemFire.Port, ".") {
|
|
|
|
itemFire.Port = strings.ReplaceAll(itemFire.Port, ":", "-")
|
2023-03-27 11:02:36 +00:00
|
|
|
datas = append(datas, itemFire)
|
2023-03-24 15:19:17 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return datas, nil
|
|
|
|
}
|
|
|
|
|
2023-03-27 11:02:36 +00:00
|
|
|
func (f *Ufw) ListAddress() ([]FireInfo, error) {
|
2023-04-20 10:44:17 +00:00
|
|
|
stdout, err := cmd.Execf("%s status verbose", f.CmdStr)
|
2023-03-24 15:19:17 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2023-03-27 15:29:46 +00:00
|
|
|
portInfos := strings.Split(stdout, "\n")
|
2023-03-24 15:19:17 +00:00
|
|
|
var datas []FireInfo
|
2023-03-27 11:02:36 +00:00
|
|
|
isStart := false
|
|
|
|
for _, line := range portInfos {
|
2023-04-21 08:45:22 +00:00
|
|
|
if strings.HasPrefix(line, "-") {
|
2023-03-27 11:02:36 +00:00
|
|
|
isStart = true
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
if !isStart {
|
2023-03-24 15:19:17 +00:00
|
|
|
continue
|
|
|
|
}
|
2023-03-27 15:29:46 +00:00
|
|
|
if !strings.Contains(line, " IN") {
|
|
|
|
continue
|
|
|
|
}
|
2023-03-27 11:02:36 +00:00
|
|
|
itemFire := f.loadInfo(line, "address")
|
2023-03-28 07:17:13 +00:00
|
|
|
if strings.Contains(itemFire.Port, ".") {
|
|
|
|
itemFire.Address += ("-" + itemFire.Port)
|
|
|
|
itemFire.Port = ""
|
|
|
|
}
|
|
|
|
if len(itemFire.Port) == 0 && len(itemFire.Address) != 0 {
|
2023-03-27 11:02:36 +00:00
|
|
|
datas = append(datas, itemFire)
|
2023-03-24 15:19:17 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return datas, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (f *Ufw) Port(port FireInfo, operation string) error {
|
2023-03-28 07:17:13 +00:00
|
|
|
switch port.Strategy {
|
|
|
|
case "accept":
|
|
|
|
port.Strategy = "allow"
|
|
|
|
case "drop":
|
|
|
|
port.Strategy = "deny"
|
2023-03-24 15:19:17 +00:00
|
|
|
default:
|
2023-03-28 07:17:13 +00:00
|
|
|
return fmt.Errorf("unsupport strategy %s", port.Strategy)
|
2023-03-24 15:19:17 +00:00
|
|
|
}
|
2023-07-17 08:34:29 +00:00
|
|
|
if cmd.CheckIllegal(port.Protocol, port.Port) {
|
|
|
|
return buserr.New(constant.ErrCmdIllegal)
|
|
|
|
}
|
2023-03-24 15:19:17 +00:00
|
|
|
|
2023-04-20 10:44:17 +00:00
|
|
|
command := fmt.Sprintf("%s %s %s", f.CmdStr, port.Strategy, port.Port)
|
2023-03-28 07:17:13 +00:00
|
|
|
if operation == "remove" {
|
2023-04-20 10:44:17 +00:00
|
|
|
command = fmt.Sprintf("%s delete %s %s", f.CmdStr, port.Strategy, port.Port)
|
2023-03-28 07:17:13 +00:00
|
|
|
}
|
2023-03-24 15:19:17 +00:00
|
|
|
if len(port.Protocol) != 0 {
|
|
|
|
command += fmt.Sprintf("/%s", port.Protocol)
|
|
|
|
}
|
2023-03-30 10:03:21 +00:00
|
|
|
stdout, err := cmd.Exec(command)
|
2023-03-24 15:19:17 +00:00
|
|
|
if err != nil {
|
2023-11-03 06:38:13 +00:00
|
|
|
return fmt.Errorf("%s (%s) failed, err: %s", operation, command, stdout)
|
2023-03-24 15:19:17 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (f *Ufw) RichRules(rule FireInfo, operation string) error {
|
2023-03-28 07:17:13 +00:00
|
|
|
switch rule.Strategy {
|
|
|
|
case "accept":
|
|
|
|
rule.Strategy = "allow"
|
|
|
|
case "drop":
|
|
|
|
rule.Strategy = "deny"
|
|
|
|
default:
|
|
|
|
return fmt.Errorf("unsupport strategy %s", rule.Strategy)
|
|
|
|
}
|
|
|
|
|
2023-07-17 08:34:29 +00:00
|
|
|
if cmd.CheckIllegal(operation, rule.Protocol, rule.Address, rule.Port) {
|
|
|
|
return buserr.New(constant.ErrCmdIllegal)
|
|
|
|
}
|
|
|
|
|
2023-10-11 09:12:34 +00:00
|
|
|
ruleStr := fmt.Sprintf("%s insert 1 %s ", f.CmdStr, rule.Strategy)
|
2023-03-28 07:17:13 +00:00
|
|
|
if operation == "remove" {
|
2023-04-20 10:44:17 +00:00
|
|
|
ruleStr = fmt.Sprintf("%s delete %s ", f.CmdStr, rule.Strategy)
|
2023-03-28 07:17:13 +00:00
|
|
|
}
|
2023-03-27 11:02:36 +00:00
|
|
|
if len(rule.Protocol) != 0 {
|
|
|
|
ruleStr += fmt.Sprintf("proto %s ", rule.Protocol)
|
|
|
|
}
|
2023-03-28 07:17:13 +00:00
|
|
|
if strings.Contains(rule.Address, "-") {
|
|
|
|
ruleStr += fmt.Sprintf("from %s to %s ", strings.Split(rule.Address, "-")[0], strings.Split(rule.Address, "-")[1])
|
|
|
|
} else {
|
2023-03-27 11:02:36 +00:00
|
|
|
ruleStr += fmt.Sprintf("from %s ", rule.Address)
|
2023-03-24 15:19:17 +00:00
|
|
|
}
|
|
|
|
if len(rule.Port) != 0 {
|
2023-03-27 11:02:36 +00:00
|
|
|
ruleStr += fmt.Sprintf("to any port %s ", rule.Port)
|
2023-03-24 15:19:17 +00:00
|
|
|
}
|
|
|
|
|
2023-03-30 10:03:21 +00:00
|
|
|
stdout, err := cmd.Exec(ruleStr)
|
2023-03-24 15:19:17 +00:00
|
|
|
if err != nil {
|
2023-11-06 02:54:39 +00:00
|
|
|
if strings.Contains(stdout, "ERROR: Invalid position") {
|
|
|
|
stdout, err := cmd.Exec(strings.ReplaceAll(ruleStr, "insert 1 ", ""))
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("%s rich rules (%s), failed, err: %s", operation, ruleStr, stdout)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
2023-11-03 06:38:13 +00:00
|
|
|
return fmt.Errorf("%s rich rules (%s), failed, err: %s", operation, ruleStr, stdout)
|
2023-03-24 15:19:17 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (f *Ufw) PortForward(info Forward, operation string) error {
|
|
|
|
ruleStr := fmt.Sprintf("firewall-cmd --%s-forward-port=port=%s:proto=%s:toport=%s --permanent", operation, info.Port, info.Protocol, info.Target)
|
|
|
|
if len(info.Address) != 0 {
|
|
|
|
ruleStr = fmt.Sprintf("firewall-cmd --%s-forward-port=port=%s:proto=%s:toaddr=%s:toport=%s --permanent", operation, info.Port, info.Protocol, info.Address, info.Target)
|
|
|
|
}
|
|
|
|
|
2023-03-30 10:03:21 +00:00
|
|
|
stdout, err := cmd.Exec(ruleStr)
|
2023-03-24 15:19:17 +00:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("%s port forward failed, err: %s", operation, stdout)
|
|
|
|
}
|
|
|
|
if err := f.Reload(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
2023-03-27 11:02:36 +00:00
|
|
|
|
|
|
|
func (f *Ufw) loadInfo(line string, fireType string) FireInfo {
|
|
|
|
fields := strings.Fields(line)
|
|
|
|
var itemInfo FireInfo
|
2023-10-21 14:44:52 +00:00
|
|
|
if strings.Contains(line, "LIMIT") || strings.Contains(line, "ALLOW FWD") {
|
|
|
|
return itemInfo
|
|
|
|
}
|
2023-03-27 11:02:36 +00:00
|
|
|
if len(fields) < 4 {
|
|
|
|
return itemInfo
|
|
|
|
}
|
2023-03-28 07:17:13 +00:00
|
|
|
if fields[1] == "(v6)" {
|
|
|
|
return itemInfo
|
|
|
|
}
|
2023-03-27 15:29:46 +00:00
|
|
|
if fields[0] == "Anywhere" && fireType != "port" {
|
2023-03-27 11:02:36 +00:00
|
|
|
itemInfo.Strategy = "drop"
|
2023-03-28 07:17:13 +00:00
|
|
|
if fields[1] == "ALLOW" {
|
2023-03-27 11:02:36 +00:00
|
|
|
itemInfo.Strategy = "accept"
|
|
|
|
}
|
|
|
|
itemInfo.Address = fields[3]
|
|
|
|
return itemInfo
|
|
|
|
}
|
|
|
|
if strings.Contains(fields[0], "/") {
|
|
|
|
itemInfo.Port = strings.Split(fields[0], "/")[0]
|
|
|
|
itemInfo.Protocol = strings.Split(fields[0], "/")[1]
|
|
|
|
} else {
|
|
|
|
itemInfo.Port = fields[0]
|
|
|
|
itemInfo.Protocol = "tcp/udp"
|
|
|
|
}
|
2023-03-28 07:17:13 +00:00
|
|
|
itemInfo.Family = "ipv4"
|
|
|
|
if fields[1] == "ALLOW" {
|
|
|
|
itemInfo.Strategy = "accept"
|
2023-03-27 11:02:36 +00:00
|
|
|
} else {
|
2023-03-28 07:17:13 +00:00
|
|
|
itemInfo.Strategy = "drop"
|
2023-03-27 11:02:36 +00:00
|
|
|
}
|
2023-03-28 07:17:13 +00:00
|
|
|
itemInfo.Address = fields[3]
|
2023-03-27 11:02:36 +00:00
|
|
|
|
|
|
|
return itemInfo
|
|
|
|
}
|