Project

General

Profile

Tâche #12416

Amon - Scénario #16041: EAD Amon : gérer le décalage de +2h sur les restrictions horaires

Groupe de machine : rectriction horaire, heure UTC prise en compte

Added by Vincent Febvre about 4 years ago. Updated about 3 years ago.

Status:
Fermé
Priority:
Normal
Assigned To:
Start date:
07/17/2015
Due date:
% Done:

100%

Estimated time:
3.00 h
Spent time:
Remaining (hours):
0.0

Description

Test effectué sur un amon 2.4.1

Lorsqu'on définit des plages horaires d'ouverture pour un groupe de machine en sélectionnant "web selon horaire", les horaires ne sont pas gérées correctement.
L'heure prise en compte est l'heure UTC ce qui fait qu'il y a un décallage de 2 h. Si on veut par exemple que la restriction commence à 18h, il faut indiqué 16h dans les rectrictions horaires des groupes de machine.

L'ajout de l'option --kerneltz dans TIME_RULE du fichier /usr/share/pyshared/amon/ipset/iptables_generator.py permet de corriger ce décalage.

Toutefois le man indique "using --kerneltz is highly discouraged"

Le plus propre serait de calculer l'heure en fonction de l'UTC.
Attention à la gestion du changement d'heure.

Associated revisions

Revision 52d1a419 (diff)
Added by Bruno Boiget about 3 years ago

Adaptation des plages horaires au format UTC (ipset)

  • vérification du décalage en fonction de la timezone (DST)
  • conversion des horaires et recalcul des nouvelles plages

ref #12416 @4h

Revision 9fd84767 (diff)
Added by Bruno Boiget about 3 years ago

ajout du paramètre time_zone dans amon.cfg

ref #12416 @10m

Revision 04948b15 (diff)
Added by Bruno Boiget about 3 years ago

ménage de fonction obsolète

ref #12416

Revision af91c819 (diff)
Added by Lionel Morin about 3 years ago

Correction mauvais nom de variable (ref #12416 @1h)

Revision f280f53c (diff)
Added by Lionel Morin about 3 years ago

Correction calcul jour_prev/jour_next (ref #12416 @1h)

History

#1 Updated by Fabrice Barconnière over 3 years ago

  • Tracker changed from Anomalie to Tâche
  • Description updated (diff)
  • Estimated time set to 3.00 h
  • Parent task set to #16041
  • Remaining (hours) set to 3.0

#3 Updated by Scrum Master about 3 years ago

  • Status changed from Nouveau to En cours

#4 Updated by Scrum Master about 3 years ago

  • Assigned To set to Bruno Boiget

#5 Updated by Bruno Boiget about 3 years ago

  • Remaining (hours) changed from 3.0 to 2.0

#6 Updated by Bruno Boiget about 3 years ago

règles activées dans ead : accès au groupe "puet" de 01:00 à 23:00 du lundi au vendredi

  • application sur un horaire d'hiver
    root@amon:~# date 01291600
    vendredi 29 janvier 2016, 16:00:00 (UTC+0100)
    
    root@amon:/usr/share/eole# service bastion restart
     * Réinitialisation du pare-feu                                                                                                                                                                                                               * Activation du mode forteresse sur eth0                                                                                                                                                                                                     * Activation du mode forteresse sur eth1                                                                                                                                                                                                     * Activation du mode forteresse sur eth2                                                                                                                                                                                                     * Activation du mode forteresse sur eth3                                                                                                                                                                                             [ OK ] 
     * Regénération des règles de pare-feu (modèle "4zones")                                                                                                                                                                              [ OK ]
     * Mise en cache des règles de pare-feu                                                                                                                                                                                               [ OK ] 
     * Restauration des règles de pare-feu en cache                                                                                                                                                                                       [ OK ] 
    Réseau Virtuel Privé Non Configuré
    root@amon:/usr/share/eole# iptables-save | grep puet
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --weekdays Sun --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --weekdays Sat --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --timestart 22:00:00 --timestop 23:59:59 --weekdays Fri --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --timestart 22:00:00 --timestop 23:59:59 --weekdays Thu --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --timestart 22:00:00 --timestop 23:59:59 --weekdays Wed --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --timestart 22:00:00 --timestop 23:59:59 --weekdays Tue --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --timestart 22:00:00 --timestop 23:59:59 --weekdays Mon --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --weekdays Sun --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --weekdays Sat --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --timestart 22:00:00 --timestop 23:59:59 --weekdays Fri --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --timestart 22:00:00 --timestop 23:59:59 --weekdays Thu --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --timestart 22:00:00 --timestop 23:59:59 --weekdays Wed --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --timestart 22:00:00 --timestop 23:59:59 --weekdays Tue --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --timestart 22:00:00 --timestop 23:59:59 --weekdays Mon --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    
  • application sur un horaire d'été
    root@amon:/usr/share/eole# date 06291600
    mercredi 29 juin 2016, 16:00:00 (UTC+0200)
    root@amon:/usr/share/eole# service bastion restart
     * Réinitialisation du pare-feu                                                                                                                                                                                                               * Activation du mode forteresse sur eth0                                                                                                                                                                                                     * Activation du mode forteresse sur eth1                                                                                                                                                                                                     * Activation du mode forteresse sur eth2                                                                                                                                                                                                     * Activation du mode forteresse sur eth3                                                                                                                                                                                             [ OK ] 
     * Regénération des règles de pare-feu (modèle "4zones")                                                                                                                                                                              [ OK ]
     * Mise en cache des règles de pare-feu                                                                                                                                                                                               [ OK ] 
     * Restauration des règles de pare-feu en cache                                                                                                                                                                                       [ OK ] 
    Réseau Virtuel Privé Non Configuré
    root@amon:/usr/share/eole# iptables-save | grep puet
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --timestart 00:00:00 --timestop 23:00:00 --weekdays Sun --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --weekdays Sat --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --timestart 21:00:00 --timestop 23:59:59 --weekdays Fri --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --timestart 21:00:00 --timestop 23:00:00 --weekdays Thu --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --timestart 21:00:00 --timestop 23:00:00 --weekdays Wed --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --timestart 21:00:00 --timestop 23:00:00 --weekdays Tue --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -i eth1 -p tcp -m set --match-set puet src,dst -m time --timestart 21:00:00 --timestop 23:00:00 --weekdays Mon --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --timestart 00:00:00 --timestop 23:00:00 --weekdays Sun --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --weekdays Sat --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --timestart 21:00:00 --timestop 23:59:59 --weekdays Fri --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --timestart 21:00:00 --timestop 23:00:00 --weekdays Thu --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --timestart 21:00:00 --timestop 23:00:00 --weekdays Wed --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --timestart 21:00:00 --timestop 23:00:00 --weekdays Tue --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,3128,8080 -m set --match-set puet src -m time --timestart 21:00:00 --timestop 23:00:00 --weekdays Mon --datestop 2038-01-19T03:14:07 -j REJECT --reject-with icmp-port-unreachable
    

#7 Updated by Bruno Boiget about 3 years ago

  • % Done changed from 0 to 100
  • Remaining (hours) changed from 2.0 to 0.5

#8 Updated by Scrum Master about 3 years ago

  • Status changed from En cours to Résolu

#9 Updated by Lionel Morin about 3 years ago

  • Remaining (hours) changed from 0.5 to 0.0

#10 Updated by Lionel Morin about 3 years ago

  • Status changed from Résolu to Fermé

Also available in: Atom PDF