python networkregulations

use python to get help on iptables and to generate ip6tables

Transcript

1. python networkstuff . . . Johannes Hubertz pycologne.de OpenChaos – Köln, 30. Mai 2013 Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 1 / 20
2. Übersicht my personel python history iptables-converter.py iptables-optimizer.py adm6: ip6tables generated by python hints to python networking stuff Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 2 / 20
3. Me and Python 2009: first peer review, snmp2modbus, phantastic experience 2010: first own experiments, adm6 startup 2011: first github python snipplet: findcnt.py, doctest 2011: iptables-converter, unittest, 88% coverage 2012: iptables-optimizer, nose, 94% coverage 2013: adm6, nose, 99.75% coverage 2013: iptables-converter setup.py, tox, debianization started https://github.com/sl0 Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 3 / 20
4. iptables ⇒ iptables-save What? Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 4 / 20
5. iptables ⇒ iptables-save assume: shell-script with more than 8k lines of iptables commands loadingtime about 18 minutes on an Intel™Celeron™ thats poor . . . iptables-save > file takes 2.5 seconds iptables-restore < file takes 2.5 seconds What’s the difference? Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 5 / 20
6. iptables ⇒ iptables-save you already know: Here python comes into the game . . . iptables comes in groups: filter, nat, mangle and raw every group has chains: INPUT, OUTPUT, FORWARD, userdefined stuff two python objects: Chain and Tables simple constructions: Chain has 2 methods, Tables 4 methods main: chains=Tables(sourcefile=“rules“) main: chains.table_printout() thats all https://github.com/sl0/conv 222 lines of code, +260 lines and 20 tests Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 6 / 20
7. iptables ⇒ iptables-save 1 #!/usr/bin/env python 2 # 3 # -*- coding: utf-8 -*- 4 # 5 """ 6 iptables-converter.py 7 License: GPLv3+ 8 Have fun! 9 """ 10 11 from UserDict import UserDict 12 from optparse import OptionParser 13 import re 14 import sys 15 16 17 class Chains(UserDict): 18 """this is for one type of tables""" 19 20 def __init__(self, name, tables): 21 """init Chains object""" 22 UserDict.__init__(self) 23 self.name = name 24 self.tables = tables 25 self.predef = tables 26 self.reset() # name, tables) 27 28 ... Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 7 / 20
8. iptables ⇒ iptables-save 119 ... 120 121 def reset(self): # name, tables): 122 """name is one of filter, nat, raw, mangle, 123 tables is a list of tables in that table-class 124 """ 125 self.poli = {} # empty dict 126 self.length = 0 127 self.policy = "-" 128 for tabular in self.tables: 129 self.data[tabular] = [] # print "# init:", name, tabular 130 self.poli[tabular] = "ACCEPT" Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 8 / 20
9. iptables ⇒ iptables-save 40 def put_into_fgr(self, content): 41 """fill this line into this tabular""" 42 # print "put_into_fgr:", self.name, action, content 43 self.length += 1 44 cha = "filter" 45 # act = "" 46 liste = content.split() 47 action = liste[0] 48 if "-t" in action: 49 liste.pop(0) # remove 1st: -t 50 fname = liste.pop(0) 51 legals = ["filter", "nat", "raw", "mangle"] 52 if fname not in legals: 53 msg = "Valid is one of %s, got: %s" % (legals, fname) 54 raise ValueError(msg) 55 action = liste[0] 56 content = "" # rebuild content from here 57 for elem in liste: 58 content = content + elem + " " 59 if len(liste) > 1: 60 chain_name = liste[1] 61 if "-F" in action: 62 self.reset() 63 return 64 if "-P" in action: 65 liste.pop(0) 66 cha = liste.pop(0) 67 new = liste.pop(0) 68 if not new in ["ACCEPT", "DROP", "REJECT"]: 69 msg = "Illegal policy: % s" % (new) 70 raise ValueError(msg) 71 self.poli[cha] = new 72 return 73 if "-X" in action: 74 ... Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 9 / 20
10. iptables ⇒ iptables sorted by usage What? Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 10 / 20
11. iptables ⇒ iptables sorted by usage assume: shell-script with more than 8k lines of iptables commands having more than one machine in the chain to the internet ⇒ latency thats poor . . . have a close look into the chains: mostly unused . . . have a close look into the chains: mostly unused, but all needed! Think! Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 11 / 20
12. iptables ⇒ iptables sorted by usage sequence of the different rules in every chain is important blocks of accept, drops or others, each having one policy in common see a chain as a set, and make partitions from policies inside every partition, rules may be exchanged freely goal is to have as few blocks as possible ⇒ administrators artwork sorting each partition on behalf of the paket-counters how to do it? python is our friend, iptables-optimizer.py is the result https://github.com/sl0/opti 221 lines of code, +270 lines in 17 tests Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 12 / 20
13. iptables ⇒ iptables sorted by usage It’s a long way from simple via complex to genious startup with subprocess: iptables-save -c, iptables -I, iptables -D. . . partitioning: easy doing with loop over chain subprocess: difficulties with errorchecking, python-versions: complex subprocess: slow convergence to sorted partitions endless loop, interruptable by ctrl-c or SIGTERM ⇒ to much risk! redesign, refactoring, no longer use of subprocess now: read from file, build and sort the partitions, save all as a file addon: testable without any relation to the kernel this is much quicker, only one iptables-save and iptables-restore / cycle Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 13 / 20
14. iptables ⇒ iptables sorted by usage Lessons learned 1 untested lines of code ⇒ Software is broken by design, unittest helps! 2 Software shall run with different python-versionsa ⇒ use tox! aDebian etch, lenny, sarge, wheezy Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 14 / 20
15. adm6: ⇒ ip6tables generated by python What? Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 15 / 20
16. adm6: ⇒ ip6tables generated by python IPv6: netilter is ready for usage ip6tables are as simple as iptables adm6: generates ip6tables for many machines from a single ruleset adm6: ready for production use. adm6: no setup.py, tox.ini, . . . , still some work to be done adm6: future: database config, f.e. in zeo or postgres adm6: future: OpenBSD pf.conf generated from same ruleset adm6: future: windows™advfirewall scripts as well adm6: past: was presented in OpenChaos, Feb 24th, 2011 Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 16 / 20
17. adm6: ⇒ ip6tables generated by python documentation: http://sl0.github.com/adm6 repository: https://github.com/sl0/adm6 1501 lines of code, +4049 lines in 106 tests Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 17 / 20
18. stuff ⇔ whats where and other useless info What’s up? Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 18 / 20
19. stuff ⇔ whats where and other useless info 1 Python 2.7.3 (default, Jan 2 2013, 16:53:07) 2 [GCC 4.7.2] on linux2 3 Type "help", "copyright", "credits" or "license" for more information. 4 >>> import this 5 The Zen of Python, by Tim Peters 6 7 Beautiful is better than ugly. 8 Explicit is better than implicit. 9 Simple is better than complex. 10 Complex is better than complicated. 11 Flat is better than nested. 12 Sparse is better than dense. 13 Readability counts. 14 ... python modules: ipaddr, scapy, pythonwifi, socket, urllib, . . . on the net: https://github.com/gregmalcolm/python_koans/wiki https://github.com/openstack https://github.com/mininet https://github.com/horms/openvswitch https://www.google.com/search?q=python+network http://datenterrorist.de (balle) . . . books: (d) Bastian Ballmann, Network Hacks, Springer Vieweg, 2012 (e) Brandon Rhodes & John Goerzen, Foundations of Python Network Programming, Apress, 2010 (e) Noah Gift & Jeremy M.Jones, Python for Unix and Linux System Administration, O’Reilly, 2008 (e) Greg L. Turnquist, Python Testing Cookbook, PACKT publishing, 2011 Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 19 / 20
20. thank you for listening Questions? As shown, the following is featured with python as well: reliable networks for trustworthy communications happy working Johannes Hubertz sl0.self_at_googlemail dot com powered by L ATEX2ε and PSTricks Johannes Hubertz (pycologne.de) python networkstuff . . . OpenChaos – Köln, 30. Mai 2013 20 / 20