def _clear_ip_tables(self):
expired_hosts = System.ips_passively_blocked(
block_length=self.IPS.block_length)
if (not expired_hosts):
return
with IPTablesManager() as iptables:
for host, timestamp in expired_hosts:
iptables.proxy_del_rule(host,
timestamp,
table='raw',
chain='IPS')
# removing host from ips tracker/ suppression dictionary
self.IPS.fw_rules.pop(IPv4Address(host),
None) # should never return None
def _load_passive_blocking(self):
self.IPS.fw_rules = dict(System.ips_passively_blocked())
def load_page(form):
ips = load_configuration('ips.json')
passive_block_ttl = ips['passive_block_ttl']
ids_mode = ips['ids_mode']
# ddos settings
ddos_enabled = ips['ddos']['enabled']
tcp_src_limit = ips['ddos']['limits']['source']['tcp']
udp_src_limit = ips['ddos']['limits']['source']['udp']
icmp_src_limit = ips['ddos']['limits']['source']['icmp']
ddos_settings = {
'enabled': ddos_enabled,
'tcp': tcp_src_limit,
'udp': udp_src_limit,
'icmp': icmp_src_limit
}
# converting standard timestamp to front end readable string format
passively_blocked_hosts = []
pbh = System.ips_passively_blocked()
for host, timestamp in pbh:
passively_blocked_hosts.append(
(host, timestamp, System.offset_and_format(timestamp)))
# portscan settings
portscan_prevention = ips['port_scan']['enabled']
portscan_reject = ips['port_scan']['reject']
portscan_settings = {
'enabled': portscan_prevention,
'reject': portscan_reject
}
# ips host/ configured dns server whitelist
ip_whitelist = ips['whitelist']['ip_whitelist']
dns_server_whitelist = ips['whitelist']['dns_servers']
ips_enabled = ddos_enabled or portscan_prevention
# TODO: clean this shit up.
tcp_nat = ips['open_protocols']['tcp']
udp_nat = ips['open_protocols']['udp']
nats_configured = tcp_nat or udp_nat
ddos_notify = False if ddos_enabled or nats_configured else True
ps_notify = False if portscan_prevention or nats_configured else True
ips_settings = {
'enabled': ips_enabled,
'length': passive_block_ttl,
'ids_mode': ids_mode,
'ddos': ddos_settings,
'port_scan': portscan_settings,
'ddos_notify': ddos_notify,
'ps_notify': ps_notify,
'ip_whitelist': ip_whitelist,
'dns_server_whitelist': dns_server_whitelist,
'passively_blocked_hosts': passively_blocked_hosts
}
return ips_settings