InPanel 1.2.1__py3-none-any.whl

inpanel/mod/firewall.py

@@ -0,0 +1,199 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright (c) 2020-2026 Jackson Dou
+# All rights reserved.
+#
+# InPanel is distributed under the terms of The New BSD License.
+# The full license can be found in 'LICENSE'.
+'''Module for Firewall Manager Integration'''
+
+from typing import Dict, Optional
+
+from .firewall_base import FirewallManager
+from .firewall_firewalld import FirewalldPM
+from .firewall_iptables import IptablesPM
+from .firewall_ufw import UfwPM
+from .firewall_macos import MacosFirewallPM
+
+
+def get_firewall_manager() -> Optional[FirewallManager]:
+    """工厂函数：根据系统返回对应的防火墙管理器实例"""
+    managers = [FirewalldPM(), UfwPM(), IptablesPM(), MacosFirewallPM()]
+    for mgr in managers:
+        if mgr.detect():
+            return mgr
+    return None
+
+
+def get_firewall_type() -> str:
+    """获取当前系统的防火墙类型"""
+    mgr = get_firewall_manager()
+    if isinstance(mgr, FirewalldPM):
+        return 'firewalld'
+    elif isinstance(mgr, UfwPM):
+        return 'ufw'
+    elif isinstance(mgr, IptablesPM):
+        return 'iptables'
+    elif isinstance(mgr, MacosFirewallPM):
+        return 'macos'
+    return 'unknown'
+
+
+def web_handler(context: Dict) -> Dict:
+    """Handle web requests for Firewall management"""
+    action = context.get('action', '')
+    mgr = get_firewall_manager()
+    
+    if mgr is None:
+        return {'code': -1, 'msg': '未检测到支持的防火墙类型！', 'data': {'type': 'unknown'}}
+    
+    firewall_type = get_firewall_type()
+    
+    if action == 'detect':
+        return {'code': 0, 'msg': '', 'data': {'type': firewall_type}}
+    
+    elif action == 'status':
+        success, output = mgr.status()
+        is_running = mgr.is_running()
+        return {'code': 0, 'msg': '', 'data': {
+            'type': firewall_type,
+            'status': output,
+            'running': is_running
+        }}
+    
+    elif action == 'start':
+        success, output = mgr.start()
+        if success:
+            return {'code': 0, 'msg': '防火墙已启动！', 'data': {'output': output}}
+        else:
+            return {'code': -1, 'msg': f'启动失败：{output}', 'data': {'output': output}}
+    
+    elif action == 'stop':
+        success, output = mgr.stop()
+        if success:
+            return {'code': 0, 'msg': '防火墙已停止！', 'data': {'output': output}}
+        else:
+            return {'code': -1, 'msg': f'停止失败：{output}', 'data': {'output': output}}
+    
+    elif action == 'restart':
+        success, output = mgr.restart()
+        if success:
+            return {'code': 0, 'msg': '防火墙已重启！', 'data': {'output': output}}
+        else:
+            return {'code': -1, 'msg': f'重启失败：{output}', 'data': {'output': output}}
+    
+    elif action == 'enable':
+        success, output = mgr.enable()
+        if success:
+            return {'code': 0, 'msg': '防火墙已设置开机自启！', 'data': {'output': output}}
+        else:
+            return {'code': -1, 'msg': f'设置失败：{output}', 'data': {'output': output}}
+    
+    elif action == 'disable':
+        success, output = mgr.disable()
+        if success:
+            return {'code': 0, 'msg': '防火墙已关闭开机自启！', 'data': {'output': output}}
+        else:
+            return {'code': -1, 'msg': f'设置失败：{output}', 'data': {'output': output}}
+    
+    elif action == 'list_rules':
+        rules = mgr.parse_rules()
+        return {'code': 0, 'msg': '', 'data': {
+            'type': firewall_type,
+            'rules': rules
+        }}
+    
+    elif action == 'add_port_rule':
+        port = context.get('port', '')
+        protocol = context.get('protocol', 'tcp')
+        zone = context.get('zone', '')
+        
+        if not port:
+            return {'code': -1, 'msg': '端口号不能为空！'}
+        
+        try:
+            port_num = int(port)
+        except ValueError:
+            return {'code': -1, 'msg': '端口号必须是数字！'}
+        
+        success, output = mgr.add_rule(port_num, protocol, zone)
+        if success:
+            return {'code': 0, 'msg': f'已添加端口规则：{port}/{protocol}', 'data': {'output': output}}
+        else:
+            return {'code': -1, 'msg': f'添加失败：{output}', 'data': {'output': output}}
+    
+    elif action == 'remove_port_rule':
+        port = context.get('port', '')
+        protocol = context.get('protocol', 'tcp')
+        zone = context.get('zone', '')
+        
+        if not port:
+            return {'code': -1, 'msg': '端口号不能为空！'}
+        
+        try:
+            port_num = int(port)
+        except ValueError:
+            return {'code': -1, 'msg': '端口号必须是数字！'}
+        
+        success, output = mgr.remove_rule(port_num, protocol, zone)
+        if success:
+            return {'code': 0, 'msg': f'已移除端口规则：{port}/{protocol}', 'data': {'output': output}}
+        else:
+            return {'code': -1, 'msg': f'移除失败：{output}', 'data': {'output': output}}
+    
+    elif action == 'add_ip_rule':
+        ip = context.get('ip', '')
+        action_type = context.get('action_type', 'allow')
+        
+        if not ip:
+            return {'code': -1, 'msg': 'IP地址不能为空！'}
+        
+        success, output = mgr.add_ip_rule(ip, action_type)
+        if success:
+            return {'code': 0, 'msg': f'已添加IP规则：{action_type} {ip}', 'data': {'output': output}}
+        else:
+            return {'code': -1, 'msg': f'添加失败：{output}', 'data': {'output': output}}
+    
+    elif action == 'remove_ip_rule':
+        ip = context.get('ip', '')
+        
+        if not ip:
+            return {'code': -1, 'msg': 'IP地址不能为空！'}
+        
+        success, output = mgr.remove_ip_rule(ip)
+        if success:
+            return {'code': 0, 'msg': f'已移除IP规则：{ip}', 'data': {'output': output}}
+        else:
+            return {'code': -1, 'msg': f'移除失败：{output}', 'data': {'output': output}}
+    
+    elif action == 'remove_app_rule':
+        app_path = context.get('app_path', '')
+        
+        if not app_path:
+            return {'code': -1, 'msg': '应用路径不能为空！'}
+        
+        if hasattr(mgr, 'remove_app_rule'):
+            success, output = mgr.remove_app_rule(app_path)
+            if success:
+                return {'code': 0, 'msg': f'已移除应用规则：{app_path}', 'data': {'output': output}}
+            else:
+                return {'code': -1, 'msg': f'移除失败：{output}', 'data': {'output': output}}
+        else:
+            return {'code': -1, 'msg': '当前防火墙类型不支持应用规则管理'}
+    
+    elif action == 'list_zones':
+        success, zones = mgr.list_zones()
+        if success:
+            return {'code': 0, 'msg': '', 'data': {'zones': zones}}
+        else:
+            return {'code': -1, 'msg': '不支持区域管理', 'data': {'zones': []}}
+    
+    elif action == 'get_default_zone':
+        success, zone = mgr.get_default_zone()
+        if success:
+            return {'code': 0, 'msg': '', 'data': {'zone': zone}}
+        else:
+            return {'code': -1, 'msg': '不支持区域管理', 'data': {'zone': ''}}
+    
+    else:
+        return {'code': -1, 'msg': '未定义的操作！'}

inpanel/mod/firewall_base.py

@@ -0,0 +1,137 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright (c) 2020-2026 Jackson Dou
+# All rights reserved.
+#
+# InPanel is distributed under the terms of The New BSD License.
+# The full license can be found in 'LICENSE'.
+'''Module for Firewall Manager Base Class'''
+
+import subprocess
+from abc import ABC, abstractmethod
+from typing import Tuple, List, Dict
+
+
+class FirewallManager(ABC):
+    """防火墙管理器抽象基类"""
+    
+    @abstractmethod
+    def detect(self) -> bool:
+        """检测当前系统是否匹配该防火墙管理器"""
+        pass
+    
+    @abstractmethod
+    def status(self) -> Tuple[bool, str]:
+        """获取防火墙状态（运行中/已停止）"""
+        pass
+    
+    @abstractmethod
+    def enable(self) -> Tuple[bool, str]:
+        """启用防火墙（开机自启）"""
+        pass
+    
+    @abstractmethod
+    def disable(self) -> Tuple[bool, str]:
+        """禁用防火墙（关闭开机自启）"""
+        pass
+    
+    @abstractmethod
+    def start(self) -> Tuple[bool, str]:
+        """启动防火墙服务"""
+        pass
+    
+    @abstractmethod
+    def stop(self) -> Tuple[bool, str]:
+        """停止防火墙服务"""
+        pass
+    
+    @abstractmethod
+    def restart(self) -> Tuple[bool, str]:
+        """重启防火墙服务"""
+        pass
+    
+    @abstractmethod
+    def add_rule(self, port: int, protocol: str = 'tcp', zone: str = '') -> Tuple[bool, str]:
+        """
+        添加端口规则
+        :param port: 端口号
+        :param protocol: 协议（tcp/udp）
+        :param zone: 区域（firewalld专用）
+        :return: (成功?, 输出日志)
+        """
+        pass
+    
+    @abstractmethod
+    def remove_rule(self, port: int, protocol: str = 'tcp', zone: str = '') -> Tuple[bool, str]:
+        """移除端口规则"""
+        pass
+    
+    @abstractmethod
+    def add_ip_rule(self, ip: str, action: str = 'allow') -> Tuple[bool, str]:
+        """
+        添加IP规则
+        :param ip: IP地址
+        :param action: allow/deny
+        :return: (成功?, 输出日志)
+        """
+        pass
+    
+    @abstractmethod
+    def remove_ip_rule(self, ip: str) -> Tuple[bool, str]:
+        """移除IP规则"""
+        pass
+    
+    @abstractmethod
+    def list_rules(self) -> Tuple[bool, str]:
+        """列出所有规则"""
+        pass
+    
+    @abstractmethod
+    def list_zones(self) -> Tuple[bool, List[str]]:
+        """列出所有区域（firewalld专用）"""
+        pass
+    
+    @abstractmethod
+    def get_default_zone(self) -> Tuple[bool, str]:
+        """获取默认区域（firewalld专用）"""
+        pass
+    
+    @abstractmethod
+    def parse_rules(self) -> List[Dict]:
+        """解析规则列表为结构化数据
+        
+        返回格式示例：
+        [
+            {
+                'type': 'port',  # 'port' 或 'ip'
+                'port': 80,      # 端口号
+                'protocol': 'tcp',  # 'tcp' 或 'udp'
+                'action': 'allow',  # 'allow' 或 'deny'
+                'ip': '',        # IP地址（type='ip'时使用）
+                'zone': '',      # 区域（firewalld专用）
+                'description': ''  # 规则描述
+            }
+        ]
+        """
+        pass
+    
+    def is_running(self) -> bool:
+        """检查防火墙是否正在运行"""
+        success, output = self.status()
+        return success and 'running' in output.lower()
+    
+    @staticmethod
+    def _run_cmd(cmd: List[str]) -> Tuple[bool, str]:
+        """执行 shell 命令并返回结果"""
+        try:
+            result = subprocess.run(
+                cmd,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+                check=False
+            )
+            output = result.stdout + result.stderr
+            return (result.returncode == 0, output.strip())
+        except Exception as e:
+            return (False, str(e))

inpanel/mod/firewall_firewalld.py

@@ -0,0 +1,170 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright (c) 2020-2026 Jackson Dou
+# All rights reserved.
+#
+# InPanel is distributed under the terms of The New BSD License.
+# The full license can be found in 'LICENSE'.
+'''Module for Firewalld Management'''
+
+import shutil
+from typing import Tuple, List, Dict
+
+from .firewall_base import FirewallManager
+from .system import is_rhel_family, get_os_version_major
+
+
+class FirewalldPM(FirewallManager):
+    """Alma 8-10 / Rocky 8-10 / CentOS 8+ / RHEL 8+：firewalld"""
+    
+    def detect(self) -> bool:
+        if not shutil.which("firewall-cmd"):
+            return False
+        if not is_rhel_family():
+            return False
+        version_major = get_os_version_major()
+        return version_major >= 8
+    
+    def status(self) -> Tuple[bool, str]:
+        return self._run_cmd(["firewall-cmd", "--state"])
+    
+    def enable(self) -> Tuple[bool, str]:
+        return self._run_cmd(["systemctl", "enable", "firewalld"])
+    
+    def disable(self) -> Tuple[bool, str]:
+        return self._run_cmd(["systemctl", "disable", "firewalld"])
+    
+    def start(self) -> Tuple[bool, str]:
+        return self._run_cmd(["systemctl", "start", "firewalld"])
+    
+    def stop(self) -> Tuple[bool, str]:
+        return self._run_cmd(["systemctl", "stop", "firewalld"])
+    
+    def restart(self) -> Tuple[bool, str]:
+        return self._run_cmd(["systemctl", "restart", "firewalld"])
+    
+    def add_rule(self, port: int, protocol: str = 'tcp', zone: str = '') -> Tuple[bool, str]:
+        cmd = ["firewall-cmd", "--permanent"]
+        if zone:
+            cmd.extend(["--zone", zone])
+        cmd.extend(["--add-port", f"{port}/{protocol}"])
+        success, output = self._run_cmd(cmd)
+        if success:
+            self._run_cmd(["firewall-cmd", "--reload"])
+        return (success, output)
+    
+    def remove_rule(self, port: int, protocol: str = 'tcp', zone: str = '') -> Tuple[bool, str]:
+        cmd = ["firewall-cmd", "--permanent"]
+        if zone:
+            cmd.extend(["--zone", zone])
+        cmd.extend(["--remove-port", f"{port}/{protocol}"])
+        success, output = self._run_cmd(cmd)
+        if success:
+            self._run_cmd(["firewall-cmd", "--reload"])
+        return (success, output)
+    
+    def add_ip_rule(self, ip: str, action: str = 'allow') -> Tuple[bool, str]:
+        cmd = ["firewall-cmd", "--permanent"]
+        if action == 'allow':
+            cmd.extend(["--add-source", ip])
+        else:
+            cmd.extend(["--add-rich-rule", f'rule family="ipv4" source address="{ip}" reject'])
+        success, output = self._run_cmd(cmd)
+        if success:
+            self._run_cmd(["firewall-cmd", "--reload"])
+        return (success, output)
+    
+    def remove_ip_rule(self, ip: str) -> Tuple[bool, str]:
+        cmd = ["firewall-cmd", "--permanent", "--remove-source", ip]
+        success, output = self._run_cmd(cmd)
+        if success:
+            self._run_cmd(["firewall-cmd", "--reload"])
+        return (success, output)
+    
+    def list_rules(self) -> Tuple[bool, str]:
+        return self._run_cmd(["firewall-cmd", "--list-all"])
+    
+    def list_zones(self) -> Tuple[bool, List[str]]:
+        success, output = self._run_cmd(["firewall-cmd", "--get-zones"])
+        if success:
+            zones = output.split()
+            return (True, zones)
+        return (False, [])
+    
+    def get_default_zone(self) -> Tuple[bool, str]:
+        return self._run_cmd(["firewall-cmd", "--get-default-zone"])
+    
+    def parse_rules(self) -> List[Dict]:
+        rules = []
+        success, output = self._run_cmd(["firewall-cmd", "--list-all"])
+        if not success:
+            return rules
+        
+        zone = ""
+        lines = output.split('\n')
+        for line in lines:
+            if line and not line.startswith(' '):
+                zone = line.split(' ')[0]
+                continue
+            
+            line = line.strip()
+            if line.startswith('services:'):
+                services = line.replace('services:', '').strip()
+                if services and services != '-':
+                    for svc in services.split():
+                        rules.append({
+                            'type': 'service',
+                            'service': svc,
+                            'port': '',
+                            'protocol': '',
+                            'action': 'allow',
+                            'ip': '',
+                            'zone': zone,
+                            'description': f"服务: {svc}"
+                        })
+            elif line.startswith('ports:'):
+                ports = line.replace('ports:', '').strip()
+                if ports and ports != '-':
+                    for port in ports.split():
+                        parts = port.split('/')
+                        p = parts[0]
+                        proto = parts[1] if len(parts) > 1 else 'tcp'
+                        rules.append({
+                            'type': 'port',
+                            'service': '',
+                            'port': int(p) if p.isdigit() else p,
+                            'protocol': proto,
+                            'action': 'allow',
+                            'ip': '',
+                            'zone': zone,
+                            'description': f"端口: {p}/{proto}"
+                        })
+            elif line.startswith('sources:'):
+                sources = line.replace('sources:', '').strip()
+                if sources and sources != '-':
+                    for source in sources.split():
+                        rules.append({
+                            'type': 'ip',
+                            'service': '',
+                            'port': '',
+                            'protocol': '',
+                            'action': 'allow',
+                            'ip': source,
+                            'zone': zone,
+                            'description': f"允许IP: {source}"
+                        })
+            elif line.startswith('rich rules:'):
+                rich_rules = line.replace('rich rules:', '').strip()
+                if rich_rules and rich_rules != '-':
+                    rules.append({
+                        'type': 'rich',
+                        'service': '',
+                        'port': '',
+                        'protocol': '',
+                        'action': 'allow',
+                        'ip': '',
+                        'zone': zone,
+                        'description': f"富规则: {rich_rules}"
+                    })
+        
+        return rules

inpanel/mod/firewall_iptables.py

@@ -0,0 +1,176 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright (c) 2020-2026 Jackson Dou
+# All rights reserved.
+#
+# InPanel is distributed under the terms of The New BSD License.
+# The full license can be found in 'LICENSE'.
+'''Module for iptables Management'''
+
+import shutil
+from typing import Tuple, List, Dict
+
+from .firewall_base import FirewallManager
+from .system import is_rhel_family, get_os_version_major
+
+
+class IptablesPM(FirewallManager):
+    """CentOS 7 及以下 / RHEL 7 及以下：iptables"""
+    
+    def detect(self) -> bool:
+        if not shutil.which("iptables"):
+            return False
+        if not is_rhel_family():
+            return False
+        version_major = get_os_version_major()
+        return version_major <= 7 or version_major == 0
+    
+    def status(self) -> Tuple[bool, str]:
+        success, output = self._run_cmd(["systemctl", "status", "iptables"])
+        if not success:
+            success, output = self._run_cmd(["service", "iptables", "status"])
+        return (success, output)
+    
+    def enable(self) -> Tuple[bool, str]:
+        success, output = self._run_cmd(["systemctl", "enable", "iptables"])
+        if not success:
+            success, output = self._run_cmd(["chkconfig", "iptables", "on"])
+        return (success, output)
+    
+    def disable(self) -> Tuple[bool, str]:
+        success, output = self._run_cmd(["systemctl", "disable", "iptables"])
+        if not success:
+            success, output = self._run_cmd(["chkconfig", "iptables", "off"])
+        return (success, output)
+    
+    def start(self) -> Tuple[bool, str]:
+        success, output = self._run_cmd(["systemctl", "start", "iptables"])
+        if not success:
+            success, output = self._run_cmd(["service", "iptables", "start"])
+        return (success, output)
+    
+    def stop(self) -> Tuple[bool, str]:
+        success, output = self._run_cmd(["systemctl", "stop", "iptables"])
+        if not success:
+            success, output = self._run_cmd(["service", "iptables", "stop"])
+        return (success, output)
+    
+    def restart(self) -> Tuple[bool, str]:
+        success, output = self._run_cmd(["systemctl", "restart", "iptables"])
+        if not success:
+            success, output = self._run_cmd(["service", "iptables", "restart"])
+        return (success, output)
+    
+    def add_rule(self, port: int, protocol: str = 'tcp', zone: str = '') -> Tuple[bool, str]:
+        cmd = ["iptables", "-A", "INPUT", "-p", protocol, "--dport", str(port), "-j", "ACCEPT"]
+        success, output = self._run_cmd(cmd)
+        if success:
+            self._run_cmd(["service", "iptables", "save"])
+        return (success, output)
+    
+    def remove_rule(self, port: int, protocol: str = 'tcp', zone: str = '') -> Tuple[bool, str]:
+        cmd = ["iptables", "-D", "INPUT", "-p", protocol, "--dport", str(port), "-j", "ACCEPT"]
+        success, output = self._run_cmd(cmd)
+        if success:
+            self._run_cmd(["service", "iptables", "save"])
+        return (success, output)
+    
+    def add_ip_rule(self, ip: str, action: str = 'allow') -> Tuple[bool, str]:
+        chain = "ACCEPT" if action == 'allow' else "DROP"
+        cmd = ["iptables", "-A", "INPUT", "-s", ip, "-j", chain]
+        success, output = self._run_cmd(cmd)
+        if success:
+            self._run_cmd(["service", "iptables", "save"])
+        return (success, output)
+    
+    def remove_ip_rule(self, ip: str) -> Tuple[bool, str]:
+        cmd = ["iptables", "-D", "INPUT", "-s", ip, "-j", "ACCEPT"]
+        success1, output1 = self._run_cmd(cmd)
+        cmd = ["iptables", "-D", "INPUT", "-s", ip, "-j", "DROP"]
+        success2, output2 = self._run_cmd(cmd)
+        if success1 or success2:
+            self._run_cmd(["service", "iptables", "save"])
+            return (True, output1 + output2)
+        return (False, output1 + output2)
+    
+    def list_rules(self) -> Tuple[bool, str]:
+        return self._run_cmd(["iptables", "-L", "-n"])
+    
+    def list_zones(self) -> Tuple[bool, List[str]]:
+        return (False, [])
+    
+    def get_default_zone(self) -> Tuple[bool, str]:
+        return (False, "Not supported")
+    
+    def parse_rules(self) -> List[Dict]:
+        rules = []
+        success, output = self._run_cmd(["iptables", "-L", "-n", "-v"])
+        if not success:
+            return rules
+        
+        current_chain = ""
+        lines = output.split('\n')
+        for line in lines:
+            line = line.strip()
+            if not line:
+                continue
+            
+            if line.startswith('Chain '):
+                current_chain = line.split()[1]
+                continue
+            
+            parts = line.split()
+            if len(parts) < 10:
+                continue
+            
+            pkts = parts[0]
+            bytes = parts[1]
+            target = parts[2]
+            prot = parts[3]
+            opt = parts[4]
+            in_iface = parts[5]
+            out_iface = parts[6]
+            source = parts[7]
+            destination = parts[8]
+            
+            action = 'allow' if target == 'ACCEPT' else ('deny' if target == 'DROP' or target == 'REJECT' else target.lower())
+            
+            port = ''
+            ip = ''
+            
+            for i in range(9, len(parts)):
+                if parts[i].startswith('dpt:'):
+                    port = parts[i].replace('dpt:', '')
+                elif parts[i].startswith('spt:'):
+                    port = parts[i].replace('spt:', '')
+            
+            if source != '0.0.0.0/0' and '/' not in source:
+                ip = source
+            elif source != '0.0.0.0/0':
+                ip = source
+            
+            if port or ip or source != '0.0.0.0/0':
+                if port:
+                    rules.append({
+                        'type': 'port',
+                        'service': '',
+                        'port': int(port) if port.isdigit() else port,
+                        'protocol': prot,
+                        'action': action,
+                        'ip': '',
+                        'zone': '',
+                        'description': f"{action.upper()}: {prot} dpt:{port} from {source}"
+                    })
+                elif ip:
+                    rules.append({
+                        'type': 'ip',
+                        'service': '',
+                        'port': '',
+                        'protocol': '',
+                        'action': action,
+                        'ip': ip,
+                        'zone': '',
+                        'description': f"{action.upper()}: {source}"
+                    })
+        
+        return rules