First version of libvirt firewalld patch
by Thomas Woerner
Hello,
here is the first version of the firewalld patch for nwfilter.
"firewall-cmd --direct --passthrough {ipv4|ipv6|eb} args" is used as a
replacement for iptables, ip6tables and ebtables.
The rules are passed through to netfilter without processing and saving
them. This means that the rules are gone if firewalld will be reloaded
or restarted. Therefore I'd like to add automatic firewalld activation,
deactivation and reactivation detection (using a dbus watch) in case of
firewalld start, stop and restart/reload.
Thomas
12 years, 1 month
[PATCH] firewall-cmd: --list=all
by Jiri Popelka
examples:
(list all info about zone "home")
firewall-cmd --zone=home --list=all
(list all info about default zone)
firewall-cmd --list=all
---
TODO | 1 -
src/firewall-cmd | 23 +++++++++++++++++++++--
2 files changed, 21 insertions(+), 3 deletions(-)
diff --git a/TODO b/TODO
index ad00efd..4280f15 100644
--- a/TODO
+++ b/TODO
@@ -1,3 +1,2 @@
-- firewall-cmd --list --zone=home
- add documentation about all config files
- add man pages
diff --git a/src/firewall-cmd b/src/firewall-cmd
index d7b1951..0aff6ed 100755
--- a/src/firewall-cmd
+++ b/src/firewall-cmd
@@ -51,7 +51,7 @@ def usage():
--enable [--timeout=<seconds>] <masquerade>
--disable <masquerade>
--query <action> | <masquerade>
- --list=<action>
+ --list=<action> | all
Action:
--service=<service>
--port=<port>[-<port>]/<protocol>
@@ -330,7 +330,7 @@ try:
elif mode == "query":
sys.exit(not fw.queryForwardPort(zone, port, protocol,
toport, toaddr))
-
+
# block icmp
elif action == "icmp-block":
if mode == "list":
@@ -345,6 +345,25 @@ try:
elif mode == "query":
sys.exit(not fw.queryIcmpBlock(zone, value))
+ elif (action == "all"):
+ if mode == "list":
+ print("zone: " + (zone if zone != "" else fw.getDefaultZone()))
+ l = fw.getInterfaces(zone)
+ if len(l) > 0:
+ print("interfaces: " + ", ".join(l))
+ l = fw.getServices(zone)
+ if len(l) > 0:
+ print("services: " + ", ".join(l))
+ l = fw.getPorts(zone)
+ if len(l) > 0:
+ print("ports: " + ", ".join(["%s/%s" % (port[0], port[1]) for port in l]))
+ l = fw.getForwardPorts(zone)
+ if len(l) > 0:
+ print("forward-ports: " + "\n".join(["port=%s:proto=%s:toport=%s:toaddr=%s" % (interface, port, protocol, toport, toaddr) for (port, protocol, toport, toaddr) in l]))
+ l = fw.getIcmpBlocks(zone)
+ if len(l) > 0:
+ print("icmp-blocks: " + ", ".join(l))
+
except dbus.DBusException, e:
if e._dbus_error_name == 'org.freedesktop.DBus.Error.ServiceUnknown':
print("FirewallD is probably not running.")
--
1.7.7.6
12 years, 1 month
[PATCH 1/2] add_interface() called with wrong number of parameters
by Jiri Popelka
In firewall/core/fw_zone.py we define add_interface as
add_interface(zone, interface, timeout=0, sender=None)
but we call it in server/firewalld.py:addInterface()
as zone.add_interface(zone, interface, sender)
which means that we pass the sender value into the timeout parameter.
I'm not sure how this is supposed to work so this patch is just a
suggestion.
---
src/firewall/core/fw_zone.py | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
index 89593dc..71d62d4 100644
--- a/src/firewall/core/fw_zone.py
+++ b/src/firewall/core/fw_zone.py
@@ -294,7 +294,7 @@ class FirewallZone:
if not enable:
self.remove_chain(zone, table, chain)
- def add_interface(self, zone, interface, timeout=0, sender=None):
+ def add_interface(self, zone, interface, sender=None):
self._fw.check_panic()
_zone = self._fw.check_zone(zone)
_obj = self._zones[_zone]
@@ -310,7 +310,7 @@ class FirewallZone:
_obj.interfaces.append(interface)
_obj.settings["interfaces"][interface_id] = \
- self.__gen_settings(timeout, sender)
+ self.__gen_settings(0, sender)
return _zone
--
1.7.7.6
12 years, 1 month
[PATCH] firewall-cmd: query mode returns reversed values
by Jiri Popelka
The query mode exits the program with exit status 1
when the query is true and with exit status 0 when
the query is false. This should be reversed
For example
firewall-cmd --zone=work --query --service=ssh; echo $?
returns 1 while it should return 0 because ssh service is
enabled (by default) in 'work' zone.
---
src/firewall-cmd | 16 ++++++++--------
1 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/src/firewall-cmd b/src/firewall-cmd
index 9163680..fb8ba80 100755
--- a/src/firewall-cmd
+++ b/src/firewall-cmd
@@ -225,7 +225,7 @@ try:
elif mode == "disable":
fw.disablePanicMode()
elif mode == "query":
- sy.exit(fw.queryPanicMode())
+ sys.exit(not fw.queryPanicMode())
# zone
elif action == "zone":
@@ -247,7 +247,7 @@ try:
elif mode == "remove":
fw.removeInterface(zone, value)
elif mode == "query":
- sys.exit(fw.queryInterface(zone, value))
+ sys.exit(not fw.queryInterface(zone, value))
# service
elif action == "service":
@@ -260,7 +260,7 @@ try:
elif mode == "remove":
fw.removeService(zone, value)
elif mode == "query":
- sys.exit(fw.queryService(zone, value))
+ sys.exit(not fw.queryService(zone, value))
# port
elif action == "port":
@@ -279,7 +279,7 @@ try:
elif mode == "remove":
fw.removePort(zone, port, proto)
elif mode == "query":
- sys.exit(fw.queryPort(zone, port, proto))
+ sys.exit(not fw.queryPort(zone, port, proto))
# masquerade
elif action == "masquerade":
@@ -288,7 +288,7 @@ try:
elif mode == "disable":
fw.disableMasquerade(zone)
elif mode == "query":
- sys.exit(fw.queryMasquerade(zone))
+ sys.exit(not fw.queryMasquerade(zone))
# forward port
elif action == "forward-port":
@@ -328,8 +328,8 @@ try:
elif mode == "remove":
fw.removeForwardPort(zone, port, protocol, toport, toaddr)
elif mode == "query":
- sys.exit(fw.queryForwardPort(zone, port, protocol, toport,
- toaddr))
+ sys.exit(not fw.queryForwardPort(zone, port, protocol,
+ toport, toaddr))
# block icmp
elif action == "icmp-block":
@@ -343,7 +343,7 @@ try:
elif mode == "remove":
fw.removeIcmpBlock(zone, value)
elif mode == "query":
- sys.exit(fw.queryIcmpBlock(zone, value))
+ sys.exit(not fw.queryIcmpBlock(zone, value))
except dbus.DBusException, e:
if e._dbus_error_name == 'org.freedesktop.DBus.Error.ServiceUnknown':
--
1.7.7.6
12 years, 1 month
