IptablesConf::updateFirewallRules() - Code Metrics - Inspection of "Рефакторинг. Расширение информации о ходе загрузки..." - mikopbx/Core - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — develop ( 96460f...afdd08 )

by Портнов

created 2021-08-03 10:49 UTC

IptablesConf::updateFirewallRules() A

↳ Parent: IptablesConf

Complexity

Conditions	2
Paths	2

Size

Total Lines	16
Code Lines	11

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

Metric	Value
eloc	11
c	1
b	0
f	0
dl	0
loc	16
rs	9.9
cc	2
nc	2
nop	0

<?php
/*
 * MikoPBX - free phone system for small business
 * Copyright (C) 2017-2020 Alexey Portnov and Nikolay Beketov
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along with this program.
 * If not, see <https://www.gnu.org/licenses/>.
 */

namespace MikoPBX\Core\System\Configs;

use MikoPBX\Common\Models\{FirewallRules, NetworkFilters, PbxSettings, Sip};
use MikoPBX\Core\Asterisk\Configs\SIPConf;
use MikoPBX\Core\System\Util;
use MikoPBX\Core\System\Processes;
use Phalcon\Di\Injectable;

class IptablesConf extends Injectable
{
    public const IP_TABLE_MIKO_CONF = '/etc/iptables/iptables.mikopbx';
    private bool $firewall_enable;
    private Fail2BanConf $fail2ban;
    private string $sipPort;
    private string $rtpPorts;
    private string $redisPort;
    private string $beanstalkPort;

    /**
     * Firewall constructor.
     */
    public function __construct()
    {
        $this->redisPort     = $this->getDI()->get('config')->redis->port;
        $this->beanstalkPort = $this->getDI()->get('config')->beanstalk->port;

        $firewall_enable       = PbxSettings::getValueByKey('PBXFirewallEnabled');
        $this->firewall_enable = ($firewall_enable === '1');

        $this->sipPort  = PbxSettings::getValueByKey('SIPPort');
        $defaultRTPFrom = PbxSettings::getValueByKey('RTPPortFrom');
        $defaultRTPTo   = PbxSettings::getValueByKey('RTPPortTo');
        $this->rtpPorts = "$defaultRTPFrom:$defaultRTPTo";

        $this->fail2ban = new Fail2BanConf();
    }

    /**
     * Applies iptables settings and restart firewall
     */
    public static function reloadFirewall(): void
    {
        $pid_file = '/var/run/service_reload_firewall.pid';
        if (file_exists($pid_file)) {
            $old_pid = file_get_contents($pid_file);
            $process = Processes::getPidOfProcess("^$old_pid");
            if ($process !== '') {
                return; // another restart process exists
            }
        }
        file_put_contents($pid_file, getmypid());

        $firewall = new self();
        $firewall->applyConfig();
        unlink($pid_file);
    }

    /**
     * Apples iptables settings
     **/
    public function applyConfig(): void
    {
        $this->fail2ban->fail2banStop();
        $this->dropAllRules();
        $this->fail2ban->fail2banMakeDirs();

        if ($this->firewall_enable) {
            $arr_command   = [];
            $arr_command[] = $this->getIptablesInputRule('', '-m conntrack --ctstate ESTABLISHED,RELATED');
            // Добавляем разрешения на сервисы.
            $this->addMainFirewallRules($arr_command);
            $this->addAdditionalFirewallRules($arr_command);
            // Кастомизация правил firewall.
            $arr_commands_custom = [];
            $out                 = [];
            Util::fileWriteContent('/etc/firewall_additional', '');

            $catPath     = Util::which('cat');
            $grepPath    = Util::which('grep');
            $busyboxPath = Util::which('busybox');
            $awkPath     = Util::which('awk');
            Processes::mwExec(
                "$catPath /etc/firewall_additional | $grepPath -v '|' | $grepPath -v '&'| $grepPath '^iptables' | $busyboxPath $awkPath -F ';' '{print $1}'",
                $arr_commands_custom
            );

            $dropCommand = $this->getIptablesInputRule('', '', 'DROP');
            if (Util::isSystemctl() && ! Util::isDocker()) {
                Util::mwMkdir('/etc/iptables');
                file_put_contents(self::IP_TABLE_MIKO_CONF, implode("\n", $arr_command));
                file_put_contents(
                    self::IP_TABLE_MIKO_CONF,
                    "\n" . implode("\n", $arr_commands_custom),
                    FILE_APPEND
                );
                file_put_contents(
                    self::IP_TABLE_MIKO_CONF,
                    "\n" . $dropCommand,
                    FILE_APPEND
                );
                $systemctlPath = Util::which('systemctl');
                Processes::mwExec("$systemctlPath restart mikopbx_iptables");
            } else {
                Processes::mwExecCommands($arr_command, $out, 'firewall');
                Processes::mwExecCommands($arr_commands_custom, $out, 'firewall_additional');
                // Все остальное запрещаем.
                Processes::mwExec($dropCommand);
            }
        }

        // Setup fail2ban
        if ($this->fail2ban->fail2ban_enable) {
            $this->fail2ban->writeConfig();
            $this->fail2ban->fail2banStart();
        } else {
            $this->fail2ban->fail2banStop();
        }
    }

    /**
     *  Flush all firewall rules
     */
    private function dropAllRules(): void
    {
        $iptablesPath = Util::which('iptables');
        Processes::mwExec("$iptablesPath -F");
        Processes::mwExec("$iptablesPath -X");
    }

    /**
     * Makes iptables rule string
     *
     * @param string $dport
     * @param string $other_data
     * @param string $action
     *
     * @return string
     */
    private function getIptablesInputRule(string $dport = '', string $other_data = '', string $action = 'ACCEPT'): string
    {
        $data_port = '';
        if (trim($dport) !== '') {
            $data_port = '--dport ' . $dport;
        }
        $other_data = trim($other_data);

        return "iptables -A INPUT $other_data $data_port -j $action";
    }

    /**
     * Makes iptables rules
     *
     * @param $arr_command
     */
    private function addAdditionalFirewallRules(&$arr_command): void
    {
        /** @var Sip $data */
        $db_data  = Sip::find("type = 'friend' AND ( disabled <> '1')");
        $sipHosts = SIPConf::getSipHosts();

        $hashArray = [];
        foreach ($db_data as $data) {
            $data = $sipHosts[$data->uniqid] ?? [];
            foreach ($data as $host) {
                if (in_array($host, $hashArray, true)) {
                    // Не допускаем повторения хост.
                    continue;
                }
                $hashArray[]   = $host;
                $arr_command[] = $this->getIptablesInputRule($this->sipPort, '-p tcp -s ' . $host . ' ');
                $arr_command[] = $this->getIptablesInputRule($this->sipPort, '-p udp -s ' . $host . ' ');
                $arr_command[] = $this->getIptablesInputRule($this->rtpPorts, '-p udp -s ' . $host . ' ');
            }
        }
        // Allow all local connections
        $arr_command[] = $this->getIptablesInputRule($this->redisPort, '-p tcp -s 127.0.0.1 ');
        $arr_command[] = $this->getIptablesInputRule($this->beanstalkPort, '-p tcp -s 127.0.0.1 ');
        $arr_command[] = $this->getIptablesInputRule('', '-s 127.0.0.1 ');
        unset($db_data, $sipHosts, $result, $hashArray);

    }

    /**
     * Формирование основных правил для iptables.
     * @param $arr_command
     */
    private function addMainFirewallRules(&$arr_command):void{
        /** @var FirewallRules $result */
        /** @var FirewallRules $rule */
        $result = FirewallRules::find('action="allow"');
        foreach ($result as $rule) {
            if ($rule->portfrom !== $rule->portto && trim($rule->portto) !== '') {
                $port = "$rule->portfrom:$rule->portto";
            } else {
                $port = $rule->portfrom;
            }
            /** @var NetworkFilters $network_filter */
            $network_filter = NetworkFilters::findFirst($rule->networkfilterid);
            if ($network_filter === null) {
                Util::sysLogMsg('Firewall', "network_filter_id not found $rule->networkfilterid", LOG_WARNING);
                continue;
            }
            if ('0.0.0.0/0' === $network_filter->permit && $rule->action !== 'allow') {
                continue;
            }
            $other_data = "-p $rule->protocol";
            $other_data .= ' -s ' . $network_filter->permit;
            if ($rule->protocol === 'icmp') {
                $port       = '';
                $other_data .= ' --icmp-type echo-request';
            }
            $action        = ($rule->action === 'allow') ? 'ACCEPT' : 'DROP';
            $arr_command[] = $this->getIptablesInputRule($port, $other_data, $action);
        }
    }

    /**
     * Updates firewall rules according to default template
     */
    public static function updateFirewallRules(): void
    {
        $portSet   = FirewallRules::getProtectedPortSet();
        $portNames = array_keys($portSet);

        $conditions = [
            'conditions' => 'portFromKey IN ({ids:array}) OR portToKey IN ({ids:array})',
            'bind'       => [
                'ids' => $portNames,
            ],
        ];
        $rules      = FirewallRules::find($conditions);
        foreach ($rules as $rule) {
            $rule->portfrom = $portSet[$rule->portFromKey]??'0';
            $rule->portto = $portSet[$rule->portToKey]??'0';
            $rule->update();
        }
    }

}


1			<?php
2			/*
3			* MikoPBX - free phone system for small business
4			* Copyright (C) 2017-2020 Alexey Portnov and Nikolay Beketov
5			*
6			* This program is free software: you can redistribute it and/or modify
7			* it under the terms of the GNU General Public License as published by
8			* the Free Software Foundation; either version 3 of the License, or
9			* (at your option) any later version.
10			*
11			* This program is distributed in the hope that it will be useful,
12			* but WITHOUT ANY WARRANTY; without even the implied warranty of
13			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14			* GNU General Public License for more details.
15			*
16			* You should have received a copy of the GNU General Public License along with this program.
17			* If not, see <https://www.gnu.org/licenses/>.
18			*/
19
20			namespace MikoPBX\Core\System\Configs;
21
22			use MikoPBX\Common\Models\{FirewallRules, NetworkFilters, PbxSettings, Sip};
23			use MikoPBX\Core\Asterisk\Configs\SIPConf;
24			use MikoPBX\Core\System\Util;
25			use MikoPBX\Core\System\Processes;
26			use Phalcon\Di\Injectable;
27
28			class IptablesConf extends Injectable
29			{
30			public const IP_TABLE_MIKO_CONF = '/etc/iptables/iptables.mikopbx';
31			private bool $firewall_enable;
32			private Fail2BanConf $fail2ban;
33			private string $sipPort;
34			private string $rtpPorts;
35			private string $redisPort;
36			private string $beanstalkPort;
37
38			/**
39			* Firewall constructor.
40			*/
41			public function __construct()
42			{
43			$this->redisPort = $this->getDI()->get('config')->redis->port;
44			$this->beanstalkPort = $this->getDI()->get('config')->beanstalk->port;
45
46			$firewall_enable = PbxSettings::getValueByKey('PBXFirewallEnabled');
47			$this->firewall_enable = ($firewall_enable === '1');
48
49			$this->sipPort = PbxSettings::getValueByKey('SIPPort');
50			$defaultRTPFrom = PbxSettings::getValueByKey('RTPPortFrom');
51			$defaultRTPTo = PbxSettings::getValueByKey('RTPPortTo');
52			$this->rtpPorts = "$defaultRTPFrom:$defaultRTPTo";
53
54			$this->fail2ban = new Fail2BanConf();
55			}
56
57			/**
58			* Applies iptables settings and restart firewall
59			*/
60			public static function reloadFirewall(): void
61			{
62			$pid_file = '/var/run/service_reload_firewall.pid';
63			if (file_exists($pid_file)) {
64			$old_pid = file_get_contents($pid_file);
65			$process = Processes::getPidOfProcess("^$old_pid");
66			if ($process !== '') {
67			return; // another restart process exists
68			}
69			}
70			file_put_contents($pid_file, getmypid());
71
72			$firewall = new self();
73			$firewall->applyConfig();
74			unlink($pid_file);
75			}
76
77			/**
78			* Apples iptables settings
79			**/
80			public function applyConfig(): void
81			{
82			$this->fail2ban->fail2banStop();
83			$this->dropAllRules();
84			$this->fail2ban->fail2banMakeDirs();
85
86			if ($this->firewall_enable) {
87			$arr_command = [];
88			$arr_command[] = $this->getIptablesInputRule('', '-m conntrack --ctstate ESTABLISHED,RELATED');
89			// Добавляем разрешения на сервисы.
90			$this->addMainFirewallRules($arr_command);
91			$this->addAdditionalFirewallRules($arr_command);
92			// Кастомизация правил firewall.
93			$arr_commands_custom = [];
94			$out = [];
95			Util::fileWriteContent('/etc/firewall_additional', '');
96
97			$catPath = Util::which('cat');
98			$grepPath = Util::which('grep');
99			$busyboxPath = Util::which('busybox');
100			$awkPath = Util::which('awk');
101			Processes::mwExec(
102			"$catPath /etc/firewall_additional \| $grepPath -v '\|' \| $grepPath -v '&'\| $grepPath '^iptables' \| $busyboxPath $awkPath -F ';' '{print $1}'",
103			$arr_commands_custom
104			);
105
106			$dropCommand = $this->getIptablesInputRule('', '', 'DROP');
107			if (Util::isSystemctl() && ! Util::isDocker()) {
108			Util::mwMkdir('/etc/iptables');
109			file_put_contents(self::IP_TABLE_MIKO_CONF, implode("\n", $arr_command));
110			file_put_contents(
111			self::IP_TABLE_MIKO_CONF,
112			"\n" . implode("\n", $arr_commands_custom),
113			FILE_APPEND
114			);
115			file_put_contents(
116			self::IP_TABLE_MIKO_CONF,
117			"\n" . $dropCommand,
118			FILE_APPEND
119			);
120			$systemctlPath = Util::which('systemctl');
121			Processes::mwExec("$systemctlPath restart mikopbx_iptables");
122			} else {
123			Processes::mwExecCommands($arr_command, $out, 'firewall');
124			Processes::mwExecCommands($arr_commands_custom, $out, 'firewall_additional');
125			// Все остальное запрещаем.
126			Processes::mwExec($dropCommand);
127			}
128			}
129
130			// Setup fail2ban
131			if ($this->fail2ban->fail2ban_enable) {
132			$this->fail2ban->writeConfig();
133			$this->fail2ban->fail2banStart();
134			} else {
135			$this->fail2ban->fail2banStop();
136			}
137			}
138
139			/**
140			* Flush all firewall rules
141			*/
142			private function dropAllRules(): void
143			{
144			$iptablesPath = Util::which('iptables');
145			Processes::mwExec("$iptablesPath -F");
146			Processes::mwExec("$iptablesPath -X");
147			}
148
149			/**
150			* Makes iptables rule string
151			*
152			* @param string $dport
153			* @param string $other_data
154			* @param string $action
155			*
156			* @return string
157			*/
158			private function getIptablesInputRule(string $dport = '', string $other_data = '', string $action = 'ACCEPT'): string
159			{
160			$data_port = '';
161			if (trim($dport) !== '') {
162			$data_port = '--dport ' . $dport;
163			}
164			$other_data = trim($other_data);
165
166			return "iptables -A INPUT $other_data $data_port -j $action";
167			}
168
169			/**
170			* Makes iptables rules
171			*
172			* @param $arr_command
173			*/
174			private function addAdditionalFirewallRules(&$arr_command): void
175			{
176			/** @var Sip $data */
177			$db_data = Sip::find("type = 'friend' AND ( disabled <> '1')");
178			$sipHosts = SIPConf::getSipHosts();
179
180			$hashArray = [];
181			foreach ($db_data as $data) {
182			$data = $sipHosts[$data->uniqid] ?? [];
183			foreach ($data as $host) {
184			if (in_array($host, $hashArray, true)) {
185			// Не допускаем повторения хост.
186			continue;
187			}
188			$hashArray[] = $host;
189			$arr_command[] = $this->getIptablesInputRule($this->sipPort, '-p tcp -s ' . $host . ' ');
190			$arr_command[] = $this->getIptablesInputRule($this->sipPort, '-p udp -s ' . $host . ' ');
191			$arr_command[] = $this->getIptablesInputRule($this->rtpPorts, '-p udp -s ' . $host . ' ');
192			}
193			}
194			// Allow all local connections
195			$arr_command[] = $this->getIptablesInputRule($this->redisPort, '-p tcp -s 127.0.0.1 ');
196			$arr_command[] = $this->getIptablesInputRule($this->beanstalkPort, '-p tcp -s 127.0.0.1 ');
197			$arr_command[] = $this->getIptablesInputRule('', '-s 127.0.0.1 ');
198			unset($db_data, $sipHosts, $result, $hashArray);
			0 ignored issues – show Comprehensibility Best Practice introduced 2021-08-03 10:53 UTC by Report Bug Copy Issue Report The variable `$result` seems to be never defined. Loading history...
199			}
200
201			/**
202			* Формирование основных правил для iptables.
203			* @param $arr_command
204			*/
205			private function addMainFirewallRules(&$arr_command):void{
206			/** @var FirewallRules $result */
207			/** @var FirewallRules $rule */
208			$result = FirewallRules::find('action="allow"');
209			foreach ($result as $rule) {
210			if ($rule->portfrom !== $rule->portto && trim($rule->portto) !== '') {
211			$port = "$rule->portfrom:$rule->portto";
212			} else {
213			$port = $rule->portfrom;
214			}
215			/** @var NetworkFilters $network_filter */
216			$network_filter = NetworkFilters::findFirst($rule->networkfilterid);
217			if ($network_filter === null) {
218			Util::sysLogMsg('Firewall', "network_filter_id not found $rule->networkfilterid", LOG_WARNING);
219			continue;
220			}
221			if ('0.0.0.0/0' === $network_filter->permit && $rule->action !== 'allow') {
222			continue;
223			}
224			$other_data = "-p $rule->protocol";
225			$other_data .= ' -s ' . $network_filter->permit;
226			if ($rule->protocol === 'icmp') {
227			$port = '';
228			$other_data .= ' --icmp-type echo-request';
229			}
230			$action = ($rule->action === 'allow') ? 'ACCEPT' : 'DROP';
231			$arr_command[] = $this->getIptablesInputRule($port, $other_data, $action);
232			}
233			}
234
235			/**
236			* Updates firewall rules according to default template
237			*/
238			public static function updateFirewallRules(): void
239			{
240			$portSet = FirewallRules::getProtectedPortSet();
241			$portNames = array_keys($portSet);
242
243			$conditions = [
244			'conditions' => 'portFromKey IN ({ids:array}) OR portToKey IN ({ids:array})',
245			'bind' => [
246			'ids' => $portNames,
247			],
248			];
249			$rules = FirewallRules::find($conditions);
250			foreach ($rules as $rule) {
251			$rule->portfrom = $portSet[$rule->portFromKey]??'0';
252			$rule->portto = $portSet[$rule->portToKey]??'0';
253			$rule->update();
254			}
255			}
256
257			}
258

mikopbx / Core

Push — develop ( 96460f...afdd08 )

IptablesConf::updateFirewallRules() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like