11:02 a.m.
This function changes a zone the interface is part of.
Because when for example NetworkManager
wants to change the zone the interface belongs to it would otherwise
need to call removeInterface(old_zone, interface) followed by
addInterface(new_zone, interface).
---
src/firewall-cmd | 8 +++++---
src/firewall/client.py | 4 ++++
src/firewall/core/fw_zone.py | 17 +++++++++++++++++
src/firewall/server/firewalld.py | 21 +++++++++++++++++++++
4 files changed, 47 insertions(+), 3 deletions(-)
diff --git a/src/firewall-cmd b/src/firewall-cmd
index 5759508..9163680 100755
--- a/src/firewall-cmd
+++ b/src/firewall-cmd
@@ -71,7 +71,7 @@ try:
"get-zones", "get-active-zones",
"get-zone-of-interface=",
# modes (exactly one of those)
- "add", "remove","enable",
"disable", "query", "list=",
+ "add", "change",
"remove","enable", "disable", "query",
"list=",
# zone
"zone=",
# actions (exactly one of those)
@@ -133,7 +133,7 @@ for (opt, val) in opts:
__fail("Timeout not valid")
# mode
- elif opt in [ "--enable", "--disable", "--query",
"--add", "--remove" ]:
+ elif opt in [ "--enable", "--disable", "--query",
"--add", "--change", "--remove" ]:
if mode:
__fail()
mode = opt[2:]
@@ -174,7 +174,7 @@ if mode not in [ "version", "reload",
"complete-reload", "state",
__fail("No value.")
if action in [ "interface", "service", "port",
"forward-port", "icmp-block" ]:
- if mode not in [ "add", "remove", "query",
"list" ]:
+ if mode not in [ "add", "change", "remove",
"query", "list" ]:
__fail(_("Wrong action and mode combination"))
elif action == "masquerade" and mode not in [ "enable",
"disable", "query" ]:
__fail(_("Wrong action and mode combination"))
@@ -242,6 +242,8 @@ try:
print(", ".join(l))
elif mode == "add":
fw.addInterface(zone, value)
+ elif mode == "change":
+ fw.changeZoneOfInterface(zone, value)
elif mode == "remove":
fw.removeInterface(zone, value)
elif mode == "query":
diff --git a/src/firewall/client.py b/src/firewall/client.py
index f6ccc31..34398bc 100644
--- a/src/firewall/client.py
+++ b/src/firewall/client.py
@@ -112,6 +112,10 @@ class FirewallClient(object):
return dbus_to_python(self.fw_zone.addInterface(zone, interface))
@slip.dbus.polkit.enable_proxy
+ def changeZoneOfInterface(self, zone, interface):
+ return dbus_to_python(self.fw_zone.changeZoneOfInterface(zone, interface))
+
+ @slip.dbus.polkit.enable_proxy
def getInterfaces(self, zone):
return dbus_to_python(self.fw_zone.getInterfaces(zone))
diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
index 71d62d4..6778f75 100644
--- a/src/firewall/core/fw_zone.py
+++ b/src/firewall/core/fw_zone.py
@@ -314,6 +314,23 @@ class FirewallZone:
return _zone
+ def change_zone_of_interface(self, zone, interface, sender=None):
+ self._fw.check_panic()
+ _old_zone = self.get_zone_of_interface(interface)
+ _new_zone = self._fw.check_zone(zone)
+ _obj = self._zones[_new_zone]
+ interface_id = self.__interface_id(interface)
+
+ if _new_zone == _old_zone:
+ raise FirewallError(ZONE_ALREADY_SET)
+
+ if _old_zone != None:
+ self.remove_interface(_old_zone, interface)
+
+ self.add_interface(_new_zone, interface, sender)
+
+ return _new_zone
+
def remove_interface(self, zone, interface):
self._fw.check_panic()
_zone = self._fw.check_zone(zone)
diff --git a/src/firewall/server/firewalld.py b/src/firewall/server/firewalld.py
index 54e749f..2c59f3f 100644
--- a/src/firewall/server/firewalld.py
+++ b/src/firewall/server/firewalld.py
@@ -344,6 +344,21 @@ class FirewallD(dbus.service.Object):
@dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='s')
@dbus_handle_exceptions
+ def changeZoneOfInterface(self, zone, interface, sender=None):
+ """Change a zone an interface is part of.
+ If zone is empty, use default zone.
+ """
+ interface = str(interface)
+ log.debug1("zone.changeZoneOfInterface('%s', '%s')" %
(zone, interface))
+ _zone = self.fw.zone.change_zone_of_interface(zone, interface, sender)
+
+ self.ZoneOfInterfaceChanged(_zone, interface)
+ return _zone
+
+ @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG)
+ @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='ss',
+ out_signature='s')
+ @dbus_handle_exceptions
def removeInterface(self, zone, interface, sender=None):
"""Remove interface from a zone.
If zone is empty, use default zone.
@@ -386,6 +401,12 @@ class FirewallD(dbus.service.Object):
@dbus.service.signal(DBUS_INTERFACE_ZONE, signature='ss')
@dbus_handle_exceptions
+ def ZoneOfInterfaceChanged(self, zone, interface):
+ log.debug1("zone.ZoneOfInterfaceChanged('%s', '%s')" %
(zone, interface))
+ pass
+
+ @dbus.service.signal(DBUS_INTERFACE_ZONE, signature='ss')
+ @dbus_handle_exceptions
def InterfaceRemoved(self, zone, interface):
log.debug1("zone.InterfaceRemoved('%s', '%s')" % (zone,
interface))
pass
--
1.7.7.6