firewalld-recode January 2015

firewalld-recode@lists.stg.fedorahosted.org

3 participants
14 discussions

[firewalld-recode] master: Further teets in test.py, output fixes (006e250)
by Thomas Woerner 28 Jan '15

28 Jan '15

Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git On branch : master >--------------------------------------------------------------- commit 006e250af841c95d9bfb3bccdc110cb575face83 Author: Thomas Woerner <twoerner(a)redhat.com> Date: Wed Jan 28 16:22:31 2015 +0100 Further teets in test.py, output fixes - New tests for getServiceSettings and getIcmpTypeSettings - Reenabled authorizeAll - output changes >--------------------------------------------------------------- libfirewall/src/test.py | 207 +++++++++++++++++++++++++++------------------- 1 files changed, 121 insertions(+), 86 deletions(-) diff --git a/libfirewall/src/test.py b/libfirewall/src/test.py index fe7c8eb..d157b47 100755 --- a/libfirewall/src/test.py +++ b/libfirewall/src/test.py @@ -4,123 +4,155 @@ from gi.repository import firewall fw = firewall.Client() -#fw.authorizeAll() +print("Authorize All") +fw.authorizeAll() +print("\n-------------------------------------------------------------------------------\n") + +#print("Reload") #fw.reload() +#print("Complete Reload") #fw.completeReload() +#print("\n-------------------------------------------------------------------------------\n") + +#print("Runtime To Permanent") #fw.runtimeToPermanent() +#print("\n-------------------------------------------------------------------------------\n") + print("panic mode: %s" % fw.queryPanicMode()) #fw.enablePanicMode() #print(fw.queryPanicMode()) #fw.disablePanicMode() #print(fw.queryPanicMode()) -print("-------------------------------------------------------------------------------\n") -print("default zone: '%s'" % fw.getDefaultZone()) +print("\n-------------------------------------------------------------------------------\n") + +default_zone = fw.getDefaultZone() +print("default zone: '%s'" % default_zone) #fw.setDefaultZone("work") #print(fw.getDefaultZone()) +#fw.setDefaultZone(default_zone) +#print(fw.getDefaultZone()) -print(fw.listServices()) print("-------------------------------------------------------------------------------\n") -settings = fw.getZoneSettings("public") -print(settings) -settings.print_str() +fw.getZoneSettings("public").print_str() + +print("\n-------------------------------------------------------------------------------\n") + +print(fw.listServices()) + +print("\n-------------------------------------------------------------------------------\n") + +fw.getServiceSettings("mdns").print_str() + +fw.getServiceSettings("tftp").print_str() + +print("\n-------------------------------------------------------------------------------\n") print(fw.listIcmpTypes()) -print("-------------------------------------------------------------------------------\n") + +print("\n-------------------------------------------------------------------------------\n") + +fw.getIcmpTypeSettings("source-quench").print_str() + +print("\n-------------------------------------------------------------------------------\n") print(fw.getZones()) -print("-------------------------------------------------------------------------------\n") + +print("\n-------------------------------------------------------------------------------\n") active_zones = fw.getActiveZones() for zone in active_zones: print("%s:" % zone) print(" 'interfaces': %s" % active_zones[zone].getInterfaces()) print(" 'sources': %s" % active_zones[zone].getSources()) -print("-------------------------------------------------------------------------------\n") -#print(fw.getZoneOfInterface("em1")) -#print(fw.getZoneOfSource("192.168.254.253")) +print("\n-------------------------------------------------------------------------------\n") -#print("-------------------------------------------------------------------------------\n") +interface="em1" +print("Zone Of Interface '%s': '%s'" % (interface, fw.getZoneOfInterface(interface))) +source = "192.168.254.253" +print("Zone Of Source '%s': '%s'" % (source, fw.getZoneOfSource(source))) -#zone = "" -#item = "foobar" -#print("add interface '%s' to zone '%s': '%s'" % (item, zone, -# fw.addInterface(zone, item))) +print("\n-------------------------------------------------------------------------------\n") -#zone = "work" -#print("change zone of interface '%s' to zone '%s': '%s'" % (item, zone, -# fw.changeZoneOfInterface(zone, item))) +zone = "" +item = "foobar" +print("add interface '%s' to zone '%s': '%s'" % (item, zone, + fw.addInterface(zone, item))) -#print("is interface '%s' bound to zone '%s'? %s" % (item, zone, -# "yes" if fw.queryInterface(zone, item) else "no")) +zone = "work" +print("change zone of interface '%s' to zone '%s': '%s'" % (item, zone, + fw.changeZoneOfInterface(zone, item))) + +print("is interface '%s' bound to zone '%s'? %s" % (item, zone, + "yes" if fw.queryInterface(zone, item) else "no")) -#print("interfaces in zone '%s': %s" % (zone, fw.getInterfaces(zone))) +print("interfaces in zone '%s': %s" % (zone, fw.getInterfaces(zone))) -#print("remove interface '%s' from zone '%s': '%s'" % (item, zone, -# fw.removeInterface(zone, item))) +print("remove interface '%s' from zone '%s': '%s'" % (item, zone, + fw.removeInterface(zone, item))) -#print("interfaces in zone '%s' %s: " % (zone, fw.getInterfaces(zone))) +print("interfaces in zone '%s' %s: " % (zone, fw.getInterfaces(zone))) -#print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") -#zone = "" -#item = "192.168.254.252" -#print("add source '%s' to zone '%s': '%s'" % (item, zone, -# fw.addSource(zone, item))) +zone = "" +item = "192.168.254.252" +print("add source '%s' to zone '%s': '%s'" % (item, zone, + fw.addSource(zone, item))) -#zone = "work" -#print("change zone of source '%s' to zone '%s': '%s'" % (item, zone, -# fw.changeZoneOfSource(zone, item))) +zone = "work" +print("change zone of source '%s' to zone '%s': '%s'" % (item, zone, + fw.changeZoneOfSource(zone, item))) -#print("is source '%s' bound to zone '%s'? %s" % (item, zone, -# "yes" if fw.querySource(zone, item) else "no")) +print("is source '%s' bound to zone '%s'? %s" % (item, zone, + "yes" if fw.querySource(zone, item) else "no")) -#print("sources in zone '%s': %s" % (zone, fw.getSources(zone))) +print("sources in zone '%s': %s" % (zone, fw.getSources(zone))) -#print("remove source '%s' from zone '%s': '%s'" % (item, zone, -# fw.removeSource(zone, item))) +print("remove source '%s' from zone '%s': '%s'" % (item, zone, + fw.removeSource(zone, item))) -#print("sources in zone '%s' %s: " % (zone, fw.getSources(zone))) +print("sources in zone '%s' %s: " % (zone, fw.getSources(zone))) -#print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") -#zone = "work" -#item = "rule service name=ftp audit limit value='1/m' accept" -#print("add rich rule '%s' to zone '%s': '%s'" % (item, zone, -# fw.addRichRule(zone, item, 0))) +zone = "work" +item = "rule service name=ftp audit limit value='1/m' accept" +print("add rich rule '%s' to zone '%s': '%s'" % (item, zone, + fw.addRichRule(zone, item, 0))) -#print("is rich rule '%s' in zone '%s'? %s\n" % (item, zone, -# "yes" if fw.queryRichRule(zone, item) else "no")) +print("is rich rule '%s' in zone '%s'? %s\n" % (item, zone, + "yes" if fw.queryRichRule(zone, item) else "no")) -#print("rich rules in zone '%s': %s" % (zone, fw.getRichRules(zone))) +print("rich rules in zone '%s': %s" % (zone, fw.getRichRules(zone))) -#print("remove rich rule '%s' from zone '%s': '%s'\n" % (item, zone, -# fw.removeRichRule(zone, item))) +print("remove rich rule '%s' from zone '%s': '%s'\n" % (item, zone, + fw.removeRichRule(zone, item))) -#print("rich rules in zone '%s': %s" % (zone, fw.getRichRules(zone))) +print("rich rules in zone '%s': %s" % (zone, fw.getRichRules(zone))) -#print("-------------------------------------------------------------------------------\n") +print("-------------------------------------------------------------------------------\n") -#zone = "work" -#item = "tftp" -#print("add service '%s' to zone '%s': '%s'\n" % (item, zone, -# fw.addService(zone, item, 0))) +zone = "work" +item = "tftp" +print("add service '%s' to zone '%s': '%s'\n" % (item, zone, + fw.addService(zone, item, 0))) -#print("is service '%s' in zone '%s'? %s\n" % (item, zone, -# "yes" if fw.queryService(zone, item) else "no")) +print("is service '%s' in zone '%s'? %s\n" % (item, zone, + "yes" if fw.queryService(zone, item) else "no")) -#print("services in zone '%s': %s" % (zone, fw.getServices(zone))) +print("services in zone '%s': %s" % (zone, fw.getServices(zone))) -#print("remove service '%s' from zone '%s': '%s'\n" % (item, zone, fw.removeService(zone, item))) +print("remove service '%s' from zone '%s': '%s'\n" % (item, zone, fw.removeService(zone, item))) -#print("services in zone '%s': %s" % (zone, fw.getServices(zone))) +print("services in zone '%s': %s" % (zone, fw.getServices(zone))) -#print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") zone = "work" item = "70" @@ -136,9 +168,9 @@ print("ports in zone '%s': [%s]" % (zone, ", ".join(z.getStr() for z in fw.getP print("remove port '%s' from zone '%s': '%s'" % (item, zone, fw.removePort(zone, item, item2))) -print("ports in zone '%s': [%s]\n" % (zone, ", ".join(z.getStr() for z in fw.getPorts(zone)))) +print("ports in zone '%s': [%s]" % (zone, ", ".join(z.getStr() for z in fw.getPorts(zone)))) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") print("add masquerade zone '%s': '%s'" % (zone, fw.addMasquerade(zone, 0))) @@ -148,10 +180,10 @@ print("is masquerade enabled in zone '%s'? %s" % (zone, print("remove masquerade from zone '%s': '%s'" % (zone, fw.removeMasquerade(zone))) -print("is masquerade enabled in zone '%s'? %s\n" % (zone, +print("is masquerade enabled in zone '%s'? %s" % (zone, "yes" if fw.queryMasquerade(zone) else "no")) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") zone = "work" item = "70" @@ -169,9 +201,9 @@ print("forward ports in zone '%s': [%s]" % (zone, ", ".join(z.getStr() for z in print("remove forward port '%s' from zone '%s': '%s'" % (item, zone, fw.removeForwardPort(zone, item, item2, item3, item4))) -print("forward ports in zone '%s': [%s]\n" % (zone, ", ".join(z.getStr() for z in fw.getForwardPorts(zone)))) +print("forward ports in zone '%s': [%s]" % (zone, ", ".join(z.getStr() for z in fw.getForwardPorts(zone)))) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") zone = "work" item = "time-exceeded" @@ -203,9 +235,9 @@ print("chains in ipv '%s' and table '%s': %s" % (ipv, table, fw.getChains(ipv, t print("remove chain '%s' from ipv '%s' and table '%s'" % (chain, ipv, table)) fw.removeChain(ipv, table, chain) -print("chains in ipv '%s' and table '%s': %s\n" % (ipv, table, fw.getChains(ipv, table))) +print("chains in ipv '%s' and table '%s': %s" % (ipv, table, fw.getChains(ipv, table))) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") ipv = "ipv4" table = "filter" @@ -221,9 +253,9 @@ print("chains in ipv '%s' and table '%s': %s" % (ipv, table, fw.getChains(ipv, t print("remove chain '%s' from ipv '%s' and table '%s'" % (chain, ipv, table)) fw.removeChain(ipv, table, chain) -print("chains in ipv '%s' and table '%s': %s\n" % (ipv, table, fw.getChains(ipv, table))) +print("chains in ipv '%s' and table '%s': %s" % (ipv, table, fw.getChains(ipv, table))) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") ipv = "ipv4" table = "filter" @@ -246,18 +278,18 @@ print("query if rule %s is in ipv '%s', table '%s', chain '%s' and priority %d: print("rules in ipv '%s', table '%s', chain '%s': %s" % (ipv, table, chain, fw.getRules(ipv, table, chain))) -print("all rules: %s\n" % ([ (rule.getIpv(), rule.getTable(), rule.getChain(), rule.getPriority(), rule.getArgs()) for rule in fw.getAllRules()] )) +print("all rules: %s" % ([ (rule.getIpv(), rule.getTable(), rule.getChain(), rule.getPriority(), rule.getArgs()) for rule in fw.getAllRules()] )) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") ipv = "ipv4" args = [ "-A", "INPUT", "-s", "1.2.3.4", "-j", "DROP" ] print("passthrough rule %s to ipv '%s': %s" % (args, ipv, fw.passthrough(ipv, args))) args = [ "-D", "INPUT", "-s", "1.2.3.4", "-j", "DROP" ] -print("passthrough rule %s to ipv '%s': %s\n" % (args, ipv, fw.passthrough(ipv, args))) +print("passthrough rule %s to ipv '%s': %s" % (args, ipv, fw.passthrough(ipv, args))) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") ipv = "ipv4" args = [ "-A", "INPUT", "-s", "1.2.3.4", "-j", "DROP" ] @@ -295,7 +327,7 @@ fw.removeAllPassthroughs() print("get all passthrough rules: %s" % ([ [ p.getIpv(), p.getArgs() ] for p in fw.getAllPassthroughs() ])) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") print("enable lockdown") fw.enableLockdown() @@ -305,9 +337,9 @@ print("query lockdown: %s" % fw.queryLockdown()) print("disable lockdown") fw.disableLockdown() -print("query lockdown: %s\n" % fw.queryLockdown()) +print("query lockdown: %s" % fw.queryLockdown()) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") print("get lockdown whitelist commands: %s" % fw.getLockdownWhitelistCommands()) command = "/usr/bin/foobar" @@ -323,9 +355,9 @@ fw.removeLockdownWhitelistCommand(command) print("query lockdown whitelist command '%s': %s" % (command, fw.queryLockdownWhitelistCommand(command))) -print("get lockdown whitelist commands: %s\n" % fw.getLockdownWhitelistCommands()) +print("get lockdown whitelist commands: %s" % fw.getLockdownWhitelistCommands()) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") print("get lockdown whitelist contexts: %s" % fw.getLockdownWhitelistContexts()) context = "system_u:system_r:MadDaemon_t:s0" @@ -341,9 +373,9 @@ fw.removeLockdownWhitelistContext(context) print("query lockdown whitelist context '%s': %s" % (context, fw.queryLockdownWhitelistContext(context))) -print("get lockdown whitelist contexts: %s\n" % fw.getLockdownWhitelistContexts()) +print("get lockdown whitelist contexts: %s" % fw.getLockdownWhitelistContexts()) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") print("get lockdown whitelist uids: %s" % fw.getLockdownWhitelistUids()) uid = 6666 @@ -359,9 +391,9 @@ fw.removeLockdownWhitelistUid(uid) print("query lockdown whitelist uid '%s': %s" % (uid, fw.queryLockdownWhitelistUid(uid))) -print("get lockdown whitelist uids: %s\n" % fw.getLockdownWhitelistUids()) +print("get lockdown whitelist uids: %s" % fw.getLockdownWhitelistUids()) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") print("get lockdown whitelist users: %s" % fw.getLockdownWhitelistUsers()) user = "theboss" @@ -377,4 +409,7 @@ fw.removeLockdownWhitelistUser(user) print("query lockdown whitelist user '%s': %s" % (user, fw.queryLockdownWhitelistUser(user))) -print("get lockdown whitelist users: %s\n" % fw.getLockdownWhitelistUsers()) +print("get lockdown whitelist users: %s" % fw.getLockdownWhitelistUsers()) + +print("\n-------------------------------------------------------------------------------\n") +

1 0

[firewalld-recode] master: New functional fw_client_getServiceSettings and fw_client_getIcmpTypeSettings methods (5aa812a)
by Thomas Woerner 28 Jan '15

28 Jan '15

Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git On branch : master >--------------------------------------------------------------- commit 5aa812a3268164c196d9bbc159cddb346605ab14 Author: Thomas Woerner <twoerner(a)redhat.com> Date: Wed Jan 28 16:21:01 2015 +0100 New functional fw_client_getServiceSettings and fw_client_getIcmpTypeSettings methods >--------------------------------------------------------------- libfirewall/src/fw_client.c | 168 ++++++++++++++++++++++++++++++++++++++++-- libfirewall/src/fw_client.h | 6 +- 2 files changed, 164 insertions(+), 10 deletions(-) diff --git a/libfirewall/src/fw_client.c b/libfirewall/src/fw_client.c index 9878231..8daf3c7 100644 --- a/libfirewall/src/fw_client.c +++ b/libfirewall/src/fw_client.c @@ -696,15 +696,116 @@ fw_client_listServices(FWClient *obj) /** * fw_client_getServiceSettings: * - * Returns: (transfer none) (allow-none) (type FWServiceSettings*) + * Returns: (transfer none) (allow-none) (type FWService*) */ -/* -FWServiceSettings * +FWService * fw_client_getServiceSettings(FWClient *obj, const gchar *service) { + FWClientPrivate *fw = FW_CLIENT_GET_PRIVATE(obj); + GVariant *variant; + FWService *srvc = NULL; + GVariant *item; + gchar *str; + GVariantIter iter; + + variant = _fw_client_proxy_call_sync(fw, fw->proxy, + "getServiceSettings", + g_variant_new("(s)", service)); + + if (fw->error != NULL) { + return srvc; + } + + if (strncmp(g_variant_get_type_string(variant), + "((sssa(ss)asa{ss}))", 19) != 0) + { + return srvc; + } + + /* get sssa(ss)asa{ss} from (sssa(ss)asa{ss}) */ + variant = g_variant_get_child_value(variant, 0); + + srvc = fw_service_new(); + + /* 0: version */ + item = g_variant_get_child_value(variant, 0); + g_variant_get(item, "s", &str); + fw_service_setVersion(srvc, str); + g_variant_unref(item); + + /* 1: short */ + item = g_variant_get_child_value(variant, 1); + g_variant_get(item, "s", &str); + fw_service_setShort(srvc, str); + g_variant_unref(item); + + /* 2: description */ + item = g_variant_get_child_value(variant, 2); + g_variant_get(item, "s", &str); + fw_service_setDescription(srvc, str); + g_variant_unref(item); + + /* 3: ports */ + item = g_variant_get_child_value(variant, 3); + if (g_variant_iter_init(&iter, item)) { + GVariant *element; + + while ((element = g_variant_iter_next_value(&iter)) != NULL) { + FWPort *prt = fw_port_new(); + GVariant *item2=NULL; + + item2 = g_variant_get_child_value(element, 0); + g_variant_get(item2, "s", &str); + fw_port_setPort(prt, g_strdup(str)); + g_variant_unref(item2); + + item2 = g_variant_get_child_value(element, 1); + g_variant_get(item2, "s", &str); + fw_port_setProtocol(prt, g_strdup(str)); + g_variant_unref(item2); + + fw_service_addPort(srvc, prt); + g_variant_unref(element); + } + } + g_variant_unref(item); + + /* 4: modules */ + item = g_variant_get_child_value(variant, 4); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_service_addModule(srvc, g_strdup(str)); + } + } + g_variant_unref(item); + + /* 5: destinations */ + item = g_variant_get_child_value(variant, 5); + if (g_variant_iter_init(&iter, item)) { + GVariant *element; + + while ((element = g_variant_iter_next_value(&iter)) != NULL) { + gchar *key, *value; + GVariant *item2=NULL; + + item2 = g_variant_get_child_value(element, 0); + g_variant_get(item2, "s", &key); + g_variant_unref(item2); + + item2 = g_variant_get_child_value(element, 1); + g_variant_get(item2, "s", &value); + g_variant_unref(item2); + + fw_service_setDestination(srvc, g_strdup(key), g_strdup(value)); + g_variant_unref(element); + } + } + + g_variant_unref(item); + + return srvc; } -*/ /** * fw_client_listIcmpTypes: @@ -723,15 +824,66 @@ fw_client_listIcmpTypes(FWClient *obj) /** * fw_client_getIcmpTypeSettings: * - * Returns: (transfer none) (allow-none) (type FWIcmpTypeSettings*) + * Returns: (transfer none) (allow-none) (type FWIcmpType*) */ -/* -FWIcmpTypeSettings * +FWIcmpType * fw_client_getIcmpTypeSettings(FWClient *obj, const gchar *icmptype) { + FWClientPrivate *fw = FW_CLIENT_GET_PRIVATE(obj); + GVariant *variant; + FWIcmpType *icmp = NULL; + GVariant *item; + gchar *str; + GVariantIter iter; + + variant = _fw_client_proxy_call_sync(fw, fw->proxy, + "getIcmpTypeSettings", + g_variant_new("(s)", icmptype)); + + if (fw->error != NULL) { + return icmp; + } + + if (strncmp(g_variant_get_type_string(variant), "((sssas))", 9) != 0) + { + return icmp; + } + + /* get sssas from (sssas) */ + variant = g_variant_get_child_value(variant, 0); + + icmp = fw_icmptype_new(); + + /* 0: version */ + item = g_variant_get_child_value(variant, 0); + g_variant_get(item, "s", &str); + fw_icmptype_setVersion(icmp, str); + g_variant_unref(item); + + /* 1: short */ + item = g_variant_get_child_value(variant, 1); + g_variant_get(item, "s", &str); + fw_icmptype_setShort(icmp, str); + g_variant_unref(item); + + /* 2: description */ + item = g_variant_get_child_value(variant, 2); + g_variant_get(item, "s", &str); + fw_icmptype_setDescription(icmp, str); + g_variant_unref(item); + + /* 3: destinations */ + item = g_variant_get_child_value(variant, 3); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_icmptype_addDestination(icmp, g_strdup(str)); + } + } + g_variant_unref(item); + + return icmp; } -*/ /* default zone */ diff --git a/libfirewall/src/fw_client.h b/libfirewall/src/fw_client.h index d792415..412771c 100644 --- a/libfirewall/src/fw_client.h +++ b/libfirewall/src/fw_client.h @@ -26,6 +26,8 @@ #include <gio/gio.h> #include "firewall.h" #include "fw_zone.h" +#include "fw_service.h" +#include "fw_icmptype.h" #define FW_CLIENT_TYPE (fw_client_get_type()) #define FW_CLIENT(obj) (G_TYPE_CHECK_INSTANCE_CAST((obj), FW_CLIENT_TYPE, FWClient)) @@ -80,9 +82,9 @@ gboolean fw_client_queryPanicMode(FWClient *obj); FWZone *fw_client_getZoneSettings(FWClient *obj, const gchar *zone); GList *fw_client_listServices(FWClient *obj); -/* FWServiceSettings *fw_client_getServiceSettings(FWClient *obj, const gchar *service); */ +FWService *fw_client_getServiceSettings(FWClient *obj, const gchar *service); GList *fw_client_listIcmpTypes(FWClient *obj); -/* FWIcmpTypeSettings *fw_client_getIcmpTypeSettings(FWClient *obj, const gchar *icmptype); */ +FWIcmpType *fw_client_getIcmpTypeSettings(FWClient *obj, const gchar *icmptype); /* default zone */

1 0

[firewalld-recode] master: Do not use g_variant_get for iter initialization, unref variants with g_variant_unref (862932d)
by Thomas Woerner 28 Jan '15

28 Jan '15

Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git On branch : master >--------------------------------------------------------------- commit 862932d5e57a8957e96025247d9bde74a646a062 Author: Thomas Woerner <twoerner(a)redhat.com> Date: Wed Jan 28 14:42:56 2015 +0100 Do not use g_variant_get for iter initialization, unref variants with g_variant_unref >--------------------------------------------------------------- libfirewall/src/fw_client.c | 119 ++++++++++++++++++++++++++++++------------- 1 files changed, 83 insertions(+), 36 deletions(-) diff --git a/libfirewall/src/fw_client.c b/libfirewall/src/fw_client.c index 7a9fcf5..9878231 100644 --- a/libfirewall/src/fw_client.c +++ b/libfirewall/src/fw_client.c @@ -366,8 +366,8 @@ _fw_client_proxy_call_sync_get_str_list(FWClientPrivate *fw, const gchar *method_name, GVariant *parameters) { - GVariant *variant; - GVariantIter *iter; + GVariant *variant, *element; + GVariantIter iter; GList *list = NULL; gchar *str; @@ -377,9 +377,20 @@ _fw_client_proxy_call_sync_get_str_list(FWClientPrivate *fw, return list; } - g_variant_get(variant, "(as)", &iter); - while (g_variant_iter_loop(iter, "s", &str)) { - list = g_list_append(list, g_strdup(str)); + if (strncmp(g_variant_get_type_string(variant), "(as)", 4) != 0) + { + return list; + } + + /* get as from (as) */ + variant = g_variant_get_child_value(variant, 0); + + if (g_variant_iter_init(&iter, variant)) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { + g_variant_get(element, "s", &str); + list = g_list_append(list, g_strdup(str)); + g_variant_unref(element); + } } g_variant_unref(variant); @@ -392,8 +403,8 @@ _fw_client_proxy_call_sync_get_gint32_list(FWClientPrivate *fw, const gchar *method_name, GVariant *parameters) { - GVariant *variant; - GVariantIter *iter; + GVariant *variant, *element; + GVariantIter iter; GList *list = NULL; gint32 *i; @@ -403,9 +414,20 @@ _fw_client_proxy_call_sync_get_gint32_list(FWClientPrivate *fw, return list; } - g_variant_get(variant, "(ai)", &iter); - while (g_variant_iter_loop(iter, "i", &i)) { - list = g_list_append(list, i); + if (strncmp(g_variant_get_type_string(variant), "(ai)", 4) != 0) + { + return list; + } + + /* get ai from (ai) */ + variant = g_variant_get_child_value(variant, 0); + + if (g_variant_iter_init(&iter, variant)) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { + g_variant_get(element, "i", &i); + list = g_list_append(list, i); + g_variant_unref(element); + } } g_variant_unref(variant); @@ -502,7 +524,7 @@ fw_client_getZoneSettings(FWClient *obj, GVariant *item; gchar *str; gboolean bool; - GVariantIter *iter; + GVariantIter iter; variant = _fw_client_proxy_call_sync(fw, fw->proxy, "getZoneSettings", @@ -527,16 +549,19 @@ fw_client_getZoneSettings(FWClient *obj, item = g_variant_get_child_value(variant, 0); g_variant_get(item, "s", &str); fw_zone_setVersion(zne, str); + g_variant_unref(item); /* 1: short */ item = g_variant_get_child_value(variant, 1); g_variant_get(item, "s", &str); fw_zone_setShort(zne, str); + g_variant_unref(item); /* 2: description */ item = g_variant_get_child_value(variant, 2); g_variant_get(item, "s", &str); fw_zone_setDescription(zne, str); + g_variant_unref(item); /* 3: unused */ @@ -544,20 +569,23 @@ fw_client_getZoneSettings(FWClient *obj, item = g_variant_get_child_value(variant, 4); g_variant_get(item, "s", &str); fw_zone_setTarget(zne, str); + g_variant_unref(item); /* 5: services */ item = g_variant_get_child_value(variant, 5); - g_variant_get(item, "as", &iter); - while (g_variant_iter_loop(iter, "s", &str)) { - fw_zone_addService(zne, g_strdup(str)); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_zone_addService(zne, g_strdup(str)); + } } + g_variant_unref(item); /* 6: ports */ item = g_variant_get_child_value(variant, 6); - if (g_variant_iter_init(iter, item)) { + if (g_variant_iter_init(&iter, item)) { GVariant *element; - while ((element = g_variant_iter_next_value(iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { FWPort *prt = fw_port_new(); GVariant *item2=NULL; @@ -570,27 +598,32 @@ fw_client_getZoneSettings(FWClient *obj, fw_port_setProtocol(prt, g_strdup(str)); fw_zone_addPort(zne, prt); + g_variant_unref(element); } } + g_variant_unref(item); /* 7: icmp_blocks */ item = g_variant_get_child_value(variant, 7); - g_variant_get(item, "as", &iter); - while (g_variant_iter_loop(iter, "s", &str)) { - fw_zone_addIcmpBlock(zne, g_strdup(str)); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_zone_addIcmpBlock(zne, g_strdup(str)); + } } + g_variant_unref(item); /* 8: masquerade */ item = g_variant_get_child_value(variant, 8); g_variant_get(item, "b", &bool); fw_zone_setMasquerade(zne, bool); + g_variant_unref(item); /* 9: forward_ports */ item = g_variant_get_child_value(variant, 9); - if (g_variant_iter_init(iter, item)) { + if (g_variant_iter_init(&iter, item)) { GVariant *element; - while ((element = g_variant_iter_next_value(iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { FWForwardPort *prt = fw_forward_port_new(); GVariant *item2=NULL; @@ -611,29 +644,37 @@ fw_client_getZoneSettings(FWClient *obj, fw_forward_port_setToAddr(prt, g_strdup(str)); fw_zone_addForwardPort(zne, prt); + g_variant_unref(element); } } + g_variant_unref(item); /* 10: interfaces */ item = g_variant_get_child_value(variant, 10); - g_variant_get(item, "as", &iter); - while (g_variant_iter_loop(iter, "s", &str)) { - fw_zone_addInterface(zne, g_strdup(str)); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_zone_addInterface(zne, g_strdup(str)); + } } + g_variant_unref(item); /* 11: sources */ item = g_variant_get_child_value(variant, 11); - g_variant_get(item, "as", &iter); - while (g_variant_iter_loop(iter, "s", &str)) { - fw_zone_addSource(zne, g_strdup(str)); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_zone_addSource(zne, g_strdup(str)); + } } + g_variant_unref(item); /* 12: rich_rules */ item = g_variant_get_child_value(variant, 12); - g_variant_get(item, "as", &iter); - while (g_variant_iter_loop(iter, "s", &str)) { - fw_zone_addRichRule(zne, g_strdup(str)); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_zone_addRichRule(zne, g_strdup(str)); + } } + g_variant_unref(item); return zne; } @@ -1233,7 +1274,7 @@ fw_client_getPorts(FWClient *obj, if (g_variant_iter_init(&iter, variant)) { GVariant *element; - while ((element = g_variant_iter_next_value(&iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { gsize length; const gchar **strv = g_variant_get_strv(element, &length); @@ -1244,6 +1285,7 @@ fw_client_getPorts(FWClient *obj, list = g_list_append(list, prt); } g_free(strv); + g_variant_unref(element); } } @@ -1377,7 +1419,7 @@ fw_client_getForwardPorts(FWClient *obj, if (g_variant_iter_init(&iter, variant)) { GVariant *element; - while ((element = g_variant_iter_next_value(&iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { gsize length; const gchar **strv = g_variant_get_strv(element, &length); @@ -1390,6 +1432,7 @@ fw_client_getForwardPorts(FWClient *obj, list = g_list_append(list, prt); } g_free(strv); + g_variant_unref(element); } } @@ -1608,7 +1651,7 @@ fw_client_getRules(FWClient *obj, if (g_variant_iter_init(&iter, child)) { GVariant *element; - while ((element = g_variant_iter_next_value(&iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { GVariant *item; gint32 priority; GVariantIter iter2; @@ -1633,6 +1676,7 @@ fw_client_getRules(FWClient *obj, fw_simplerule_setPriority(rule, priority); fw_simplerule_setArgs(rule, args); list = g_list_append(list, rule); + g_variant_unref(element); } } @@ -1750,7 +1794,7 @@ fw_client_getAllRules(FWClient *obj) if (g_variant_iter_init(&iter, child)) { GVariant *element; - while ((element = g_variant_iter_next_value(&iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { GVariant *item; gchar *ipv, *table, *chain; gint32 priority; @@ -1788,6 +1832,7 @@ fw_client_getAllRules(FWClient *obj) fw_rule_setPriority(rule, priority); fw_rule_setArgs(rule, args); list = g_list_append(list, rule); + g_variant_unref(element); } } @@ -1970,7 +2015,7 @@ fw_client_getPassthroughs(FWClient *obj, if (g_variant_iter_init(&iter, variant)) { GVariant *element; - while ((element = g_variant_iter_next_value(&iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { FWArgs *args = fw_args_new(); gsize length, i; const gchar **strv = g_variant_get_strv(element, &length); @@ -1981,6 +2026,7 @@ fw_client_getPassthroughs(FWClient *obj, g_free(strv); list = g_list_append(list, args); + g_variant_unref(element); } } @@ -2025,7 +2071,7 @@ fw_client_getAllPassthroughs(FWClient *obj) if (g_variant_iter_init(&iter, variant)) { GVariant *element; - while ((element = g_variant_iter_next_value(&iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { GVariant *item; gchar *ipv; GVariantIter iter2; @@ -2050,6 +2096,7 @@ fw_client_getAllPassthroughs(FWClient *obj) fw_passthrough_setIpv(pthru, ipv); fw_passthrough_setArgs(pthru, args); list = g_list_append(list, pthru); + g_variant_unref(element); } }

1 0

[firewalld-recode] master: Whitespace changes (f081701)
by Thomas Woerner 28 Jan '15

28 Jan '15

Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git On branch : master >--------------------------------------------------------------- commit f0817014f2fd364298d78271d643736802657ca7 Author: Thomas Woerner <twoerner(a)redhat.com> Date: Wed Jan 28 14:40:09 2015 +0100 Whitespace changes >--------------------------------------------------------------- libfirewall/src/fw_client.c | 39 +++++++++++++++++++-------------------- 1 files changed, 19 insertions(+), 20 deletions(-) diff --git a/libfirewall/src/fw_client.c b/libfirewall/src/fw_client.c index 1e3a673..7a9fcf5 100644 --- a/libfirewall/src/fw_client.c +++ b/libfirewall/src/fw_client.c @@ -117,10 +117,10 @@ _fw_client_reset_error(FWClientPrivate *fw) static void _fw_client_signal_receiver(GDBusProxy *proxy, - gchar *sender_name, - gchar *signal_name, - GVariant *parameters, - gpointer user_data) + gchar *sender_name, + gchar *signal_name, + GVariant *parameters, + gpointer user_data) { /* print received signals */ gchar *str; @@ -233,9 +233,9 @@ fw_client_set_property(GObject *obj, } static void -fw_client_get_property(GObject *obj, - guint property_id, - GValue *value, +fw_client_get_property(GObject *obj, + guint property_id, + GValue *value, GParamSpec *pspec) { FWClientPrivate *fw = FW_CLIENT_GET_PRIVATE(obj); @@ -296,9 +296,9 @@ fw_client_class_init(FWClientClass *fw_client_class) GVariant * _fw_client_proxy_call_sync(FWClientPrivate *fw, - GDBusProxy *proxy, - const gchar *method_name, - GVariant *parameters) + GDBusProxy *proxy, + const gchar *method_name, + GVariant *parameters) { GVariant *result; @@ -320,9 +320,9 @@ _fw_client_proxy_call_sync(FWClientPrivate *fw, const gchar * _fw_client_proxy_call_sync_get_str(FWClientPrivate *fw, - GDBusProxy *proxy, - const gchar *method_name, - GVariant *parameters) + GDBusProxy *proxy, + const gchar *method_name, + GVariant *parameters) { GVariant *variant; gchar *value_str; @@ -362,9 +362,9 @@ _fw_client_proxy_call_sync_get_bool(FWClientPrivate *fw, GList * _fw_client_proxy_call_sync_get_str_list(FWClientPrivate *fw, - GDBusProxy *proxy, - const gchar *method_name, - GVariant *parameters) + GDBusProxy *proxy, + const gchar *method_name, + GVariant *parameters) { GVariant *variant; GVariantIter *iter; @@ -388,9 +388,9 @@ _fw_client_proxy_call_sync_get_str_list(FWClientPrivate *fw, GList * _fw_client_proxy_call_sync_get_gint32_list(FWClientPrivate *fw, - GDBusProxy *proxy, - const gchar *method_name, - GVariant *parameters) + GDBusProxy *proxy, + const gchar *method_name, + GVariant *parameters) { GVariant *variant; GVariantIter *iter; @@ -788,7 +788,6 @@ fw_client_getActiveZones(FWClient *obj) g_variant_unref(entry2); g_variant_get(value2, "as", &iter3); - while (g_variant_iter_loop(iter3, "s", &str)) { list = g_list_append(list, g_strdup(str)); }

1 0

[firewalld-recode] master: New FWService and FWIcmpType types to handle service and icmptype settings (7a9a5b8)
by Thomas Woerner 28 Jan '15

28 Jan '15

Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git On branch : master >--------------------------------------------------------------- commit 7a9a5b8e491f935bc42b6f8b55002fbc4e750304 Author: Thomas Woerner <twoerner(a)redhat.com> Date: Wed Jan 28 14:51:54 2015 +0100 New FWService and FWIcmpType types to handle service and icmptype settings >--------------------------------------------------------------- libfirewall/src/Makefile | 2 +- libfirewall/src/fw_icmptype.c | 226 +++++++++++++++++++++++++ libfirewall/src/fw_icmptype.h | 64 +++++++ libfirewall/src/fw_service.c | 376 +++++++++++++++++++++++++++++++++++++++++ libfirewall/src/fw_service.h | 76 +++++++++ 5 files changed, 743 insertions(+), 1 deletions(-) diff --git a/libfirewall/src/Makefile b/libfirewall/src/Makefile index 44efaf3..66e89aa 100644 --- a/libfirewall/src/Makefile +++ b/libfirewall/src/Makefile @@ -18,7 +18,7 @@ # along with this program. If not, see <http://www.gnu.org/licenses/>. # -SOURCES = fw_client.c fw_zone.c fw_active_zone.c fw_port.c fw_forward_port.c fw_simplerule.c fw_rule.c fw_args.c fw_passthrough.c fw_functions.c +SOURCES = fw_client.c fw_zone.c fw_service.c fw_icmptype.c fw_active_zone.c fw_port.c fw_forward_port.c fw_simplerule.c fw_rule.c fw_args.c fw_passthrough.c fw_functions.c OBJECTS = $(SOURCES:.c=.lo) HEADERS = $(SOURCES:.c=.h) firewall.h diff --git a/libfirewall/src/fw_icmptype.c b/libfirewall/src/fw_icmptype.c new file mode 100644 index 0000000..4f7c466 --- /dev/null +++ b/libfirewall/src/fw_icmptype.c @@ -0,0 +1,226 @@ +/* + * Copyright (C) 2015 Red Hat, Inc. + * + * Authors: + * Thomas Woerner <twoerner(a)redhat.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#include "fw_icmptype.h" +#include <string.h> + +G_DEFINE_TYPE(FWIcmpType, fw_icmptype, G_TYPE_OBJECT); + +#define FW_ICMPTYPE_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE((o), FW_ICMPTYPE_TYPE, FWIcmpTypePrivate)) + +typedef struct { + gchar *version; /* string */ + gchar *short_description; /* string */ + gchar *description; /* string */ + GList *destinations; /* list of strings */ +} FWIcmpTypePrivate; + +FWIcmpType * +fw_icmptype_new() +{ + return g_object_new(FW_ICMPTYPE_TYPE, NULL); +} + +static void +fw_icmptype_init(FWIcmpType *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + /* init vars */ + priv->version = NULL; + priv->short_description = NULL; + priv->description = NULL; + priv->destinations = NULL; +} + +static void +fw_icmptype_finalize(GObject *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + if (priv->version != NULL) { + g_free(priv->version); + } + if (priv->short_description != NULL) { + g_free(priv->short_description); + } + if (priv->description != NULL) { + g_free(priv->description); + } + if (priv->destinations != NULL) { + g_free(priv->destinations); + } + + G_OBJECT_CLASS(fw_icmptype_parent_class)->finalize(obj); +} + +static void +fw_icmptype_class_init(FWIcmpTypeClass *fw_icmptype_class) +{ + GObjectClass *obj_class = G_OBJECT_CLASS(fw_icmptype_class); + + obj_class->finalize = fw_icmptype_finalize; + + g_type_class_add_private(obj_class, sizeof(FWIcmpTypePrivate)); +} + +/* methods */ + +/** + * fw_icmptype_getStr: + * + */ +void +fw_icmptype_print_str(FWIcmpType *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + g_print("( '%s', '%s', '%s', ", + priv->version, priv->short_description, priv->description); + + g_list_print_str(priv->destinations); + + g_print(" )\n"); +} + +/** + * fw_icmptype_getVersion: + * + * Returns: (transfer none) (allow-none) (type gchar*) + */ +gchar * +fw_icmptype_getVersion(FWIcmpType *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + return priv->version; +} + +void +fw_icmptype_setVersion(FWIcmpType *obj, + gchar *version) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + priv->version = version; +} + +/** + * fw_icmptype_getShort: + * + * Returns: (transfer none) (allow-none) (type gchar*) + */ +gchar * +fw_icmptype_getShort(FWIcmpType *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + return priv->short_description; +} + +void +fw_icmptype_setShort(FWIcmpType *obj, + gchar *short_description) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + priv->short_description = short_description; +} + +/** + * fw_icmptype_getDescription: + * + * Returns: (transfer none) (allow-none) (type gchar*) + */ +gchar * +fw_icmptype_getDescription(FWIcmpType *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + return priv->description; +} + +void +fw_icmptype_setDescription(FWIcmpType *obj, + gchar *description) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + priv->description = description; +} + +/** + * fw_icmptype_getDestinations: + * @obj: (type FWIcmpType*): a FWIcmpType instance + * + * Returns: (transfer none) (allow-none) (type GList*) (element-type gchar*) + */ +GList * +fw_icmptype_getDestinations(FWIcmpType *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + return priv->destinations; +} + +/** + * fw_icmptype_setDestinations: + * @obj: (type FWIcmpType*): a FWIcmpType instance + * @destinations: (type GList*) (element-type gchar*) + */ +void +fw_icmptype_setDestinations(FWIcmpType *obj, + GList *destinations) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + priv->destinations = destinations; +} + +void +fw_icmptype_addDestination(FWIcmpType *obj, + gchar *destination) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + priv->destinations = g_list_append(priv->destinations, destination); +} + +void +fw_icmptype_removeDestination(FWIcmpType *obj, + gchar *destination) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + priv->destinations = g_list_remove(priv->destinations, destination); +} + +gboolean +fw_icmptype_queryDestination(FWIcmpType *obj, + gchar *destination) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + GList *list; + + list = g_list_find(priv->destinations, destination); + if (list == NULL) + return FALSE; + return TRUE; +} diff --git a/libfirewall/src/fw_icmptype.h b/libfirewall/src/fw_icmptype.h new file mode 100644 index 0000000..c9b112b --- /dev/null +++ b/libfirewall/src/fw_icmptype.h @@ -0,0 +1,64 @@ +/* + * Copyright (C) 2015 Red Hat, Inc. + * + * Authors: + * Thomas Woerner <twoerner(a)redhat.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#ifndef __FW_ICMPTYPE_H__ +#define __FW_ICMPTYPE_H__ + +#include <glib.h> +#include <glib-object.h> +#include "firewall.h" +#include "fw_functions.h" +#include "fw_port.h" + +#define FW_ICMPTYPE_TYPE (fw_icmptype_get_type()) +#define FW_ICMPTYPE(obj) (G_TYPE_CHECK_INSTANCE_CAST((obj), FW_ICMPTYPE_TYPE, FWIcmpType)) +#define FW_ICMPTYPE_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST((klass), FW_ICMPTYPE_TYPE, FWIcmpTypeClass)) +#define FW_IS_ICMPTYPE(klass) (G_TYPE_CHECK_INSTANCE_CLASS((klass), FW_ICMPTYPE_TYPE, FWIcmpTypeClass)) +#define FW_ICMPTYPE_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS((obj), FW_ICMPTYPE_TYPE, FWIcmpTypeClass)) + +typedef struct { + GObject parent; +} FWIcmpType; + +typedef struct { + GObjectClass parent; +} FWIcmpTypeClass; + +GType fw_icmptype_get_type(void); +FWIcmpType *fw_icmptype_new(void); + +void fw_icmptype_print_str(FWIcmpType *obj); + +gchar *fw_icmptype_getVersion(FWIcmpType *obj); +void fw_icmptype_setVersion(FWIcmpType *obj, gchar *version); + +gchar *fw_icmptype_getShort(FWIcmpType *obj); +void fw_icmptype_setShort(FWIcmpType *obj, gchar *short_description); + +gchar *fw_icmptype_getDescription(FWIcmpType *obj); +void fw_icmptype_setDescription(FWIcmpType *obj, gchar *description); + +GList *fw_icmptype_getDestinations(FWIcmpType *obj); +void fw_icmptype_setDestinations(FWIcmpType *obj, GList *destinations); +void fw_icmptype_addDestination(FWIcmpType *obj, gchar *destination); +void fw_icmptype_removeDestination(FWIcmpType *obj, gchar *destination); +gboolean fw_icmptype_queryDestination(FWIcmpType *obj, gchar *destination); + +#endif /* __FW_ICMPTYPE_H__ */ diff --git a/libfirewall/src/fw_service.c b/libfirewall/src/fw_service.c new file mode 100644 index 0000000..9e2ec19 --- /dev/null +++ b/libfirewall/src/fw_service.c @@ -0,0 +1,376 @@ +/* + * Copyright (C) 2015 Red Hat, Inc. + * + * Authors: + * Thomas Woerner <twoerner(a)redhat.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#include "fw_service.h" +#include <string.h> + +G_DEFINE_TYPE(FWService, fw_service, G_TYPE_OBJECT); + +#define FW_SERVICE_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE((o), FW_SERVICE_TYPE, FWServicePrivate)) + +typedef struct { + gchar *version; /* string */ + gchar *short_description; /* string */ + gchar *description; /* string */ + GList *ports; /* list of FWPort */ + GList *modules; /* list of string */ + GHashTable *destinations; /* hash table of string: string */ +} FWServicePrivate; + +FWService * +fw_service_new() +{ + return g_object_new(FW_SERVICE_TYPE, NULL); +} + +static void +fw_service_init(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + /* init vars */ + priv->version = NULL; + priv->short_description = NULL; + priv->description = NULL; + priv->ports = NULL; + priv->modules = NULL; + priv->destinations = g_hash_table_new(g_str_hash, g_str_equal); +} + +static void +fw_service_finalize(GObject *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + if (priv->version != NULL) { + g_free(priv->version); + } + if (priv->short_description != NULL) { + g_free(priv->short_description); + } + if (priv->description != NULL) { + g_free(priv->description); + } + if (priv->ports != NULL) { + g_free(priv->ports); + } + if (priv->modules != NULL) { + g_free(priv->modules); + } + if (priv->destinations != NULL) { + g_free(priv->destinations); + } + + G_OBJECT_CLASS(fw_service_parent_class)->finalize(obj); +} + +static void +fw_service_class_init(FWServiceClass *fw_service_class) +{ + GObjectClass *obj_class = G_OBJECT_CLASS(fw_service_class); + + obj_class->finalize = fw_service_finalize; + + g_type_class_add_private(obj_class, sizeof(FWServicePrivate)); +} + +/* methods */ + +/** + * fw_service_getStr: + * + */ +void +fw_service_print_str(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + GList *list; + gchar *str; + gint i; + + g_print("( '%s', '%s', '%s', ", + priv->version, priv->short_description, + priv->description); + + g_print("[ "); + for (i=0; i<g_list_length(priv->ports); i++) { + FWPort *prt = g_list_nth_data(priv->ports, i); + gchar *str = fw_port_getStr(prt); + + g_print("%s'%s'", (i>0) ? ", " : "", str); + g_free(str); + } + g_print(" ], "); + + g_list_print_str(priv->modules); + + g_print(", { "); + + list = g_hash_table_get_keys(priv->destinations); + for (i=0; i<g_list_length(list); i++) { + str = (gchar *) g_list_nth_data(list, i); + g_print("%s'%s': '%s'", (i>0) ? ", " : "", str, + (gchar *)g_hash_table_lookup(priv->destinations, str)); + } + + g_print(" }"); + + g_print(" )\n"); +} + +/** + * fw_service_getVersion: + * + * Returns: (transfer none) (allow-none) (type gchar*) + */ +gchar * +fw_service_getVersion(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + return priv->version; +} + +void +fw_service_setVersion(FWService *obj, + gchar *version) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->version = version; +} + +/** + * fw_service_getShort: + * + * Returns: (transfer none) (allow-none) (type gchar*) + */ +gchar * +fw_service_getShort(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + return priv->short_description; +} + +void +fw_service_setShort(FWService *obj, + gchar *short_description) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->short_description = short_description; +} + +/** + * fw_service_getDescription: + * + * Returns: (transfer none) (allow-none) (type gchar*) + */ +gchar * +fw_service_getDescription(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + return priv->description; +} + +void +fw_service_setDescription(FWService *obj, + gchar *description) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->description = description; +} + +/** + * fw_service_getPorts: + * + * Returns: (transfer none) (allow-none) (type GList*) (element-type FWPort*) + */ +GList * +fw_service_getPorts(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + return priv->ports; +} + +/** + * fw_service_setPorts: + * @obj: (type FWService*): a FWService instance + * @ports: (type GList*) (element-type FWPort*) + */ +void +fw_service_setPorts(FWService *obj, + GList *ports) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->ports = ports; +} + +void +fw_service_addPort(FWService *obj, + FWPort *port) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->ports = g_list_append(priv->ports, port); +} + +void +fw_service_removePort(FWService *obj, + FWPort *port) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->ports = g_list_remove(priv->ports, port); +} + +gboolean +fw_service_queryPort(FWService *obj, + FWPort *port) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + GList *list; + + list = g_list_find(priv->ports, port); + if (list == NULL) + return FALSE; + return TRUE; +} + +/** + * fw_service_getModules: + * @obj: (type FWService*): a FWService instance + * + * Returns: (transfer none) (allow-none) (type GList*) (element-type gchar*) + */ +GList * +fw_service_getModules(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + return priv->modules; +} + +/** + * fw_service_setModules: + * @obj: (type FWService*): a FWService instance + * @modules: (type GList*) (element-type gchar*) + */ +void +fw_service_setModules(FWService *obj, + GList *modules) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->modules = modules; +} + +void +fw_service_addModule(FWService *obj, + gchar *module) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->modules = g_list_append(priv->modules, module); +} + +void +fw_service_removeModule(FWService *obj, + gchar *module) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->modules = g_list_remove(priv->modules, module); +} + +gboolean +fw_service_queryModule(FWService *obj, + gchar *module) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + GList *list; + + list = g_list_find(priv->modules, module); + if (list == NULL) + return FALSE; + return TRUE; +} + +/** + * fw_service_getDestinations: + * @obj: (type FWService*): a FWService instance + * + * Returns: (transfer none) (allow-none) (type GHashTable*) (element-type gchar* gchar*) + */ +GHashTable *fw_service_getDestinations(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + return priv->destinations; +} + +/** + * fw_service_setDestinations: + * @obj: (type FWService*): a FWService instance + * @destinations: (type GHashTable*) (element-type gchar* gchar*) + */ +void fw_service_setDestinations(FWService *obj, + GHashTable *destinations) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->destinations = destinations; +} + +void +fw_service_setDestination(FWService *obj, + gchar *ipv, + gchar *address) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + g_hash_table_replace(priv->destinations, ipv, address); +} + +void +fw_service_removeDestination(FWService *obj, + gchar *ipv) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + g_hash_table_remove(priv->destinations, ipv); +} + +gboolean +fw_service_queryDestination(FWService *obj, + gchar *ipv, + gchar *address) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + gchar *value; + + value = g_hash_table_lookup(priv->destinations, ipv); + return (strcmp(value, address) == 0); +} diff --git a/libfirewall/src/fw_service.h b/libfirewall/src/fw_service.h new file mode 100644 index 0000000..a7a07cf --- /dev/null +++ b/libfirewall/src/fw_service.h @@ -0,0 +1,76 @@ +/* + * Copyright (C) 2015 Red Hat, Inc. + * + * Authors: + * Thomas Woerner <twoerner(a)redhat.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#ifndef __FW_SERVICE_H__ +#define __FW_SERVICE_H__ + +#include <glib.h> +#include <glib-object.h> +#include "firewall.h" +#include "fw_functions.h" +#include "fw_port.h" + +#define FW_SERVICE_TYPE (fw_service_get_type()) +#define FW_SERVICE(obj) (G_TYPE_CHECK_INSTANCE_CAST((obj), FW_SERVICE_TYPE, FWService)) +#define FW_SERVICE_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST((klass), FW_SERVICE_TYPE, FWServiceClass)) +#define FW_IS_SERVICE(klass) (G_TYPE_CHECK_INSTANCE_CLASS((klass), FW_SERVICE_TYPE, FWServiceClass)) +#define FW_SERVICE_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS((obj), FW_SERVICE_TYPE, FWServiceClass)) + +typedef struct { + GObject parent; +} FWService; + +typedef struct { + GObjectClass parent; +} FWServiceClass; + +GType fw_service_get_type(void); +FWService *fw_service_new(void); + +void fw_service_print_str(FWService *obj); + +gchar *fw_service_getVersion(FWService *obj); +void fw_service_setVersion(FWService *obj, gchar *version); + +gchar *fw_service_getShort(FWService *obj); +void fw_service_setShort(FWService *obj, gchar *short_description); + +gchar *fw_service_getDescription(FWService *obj); +void fw_service_setDescription(FWService *obj, gchar *description); + +GList *fw_service_getPorts(FWService *obj); +void fw_service_setPorts(FWService *obj, GList *ports); +void fw_service_addPort(FWService *obj, FWPort *port); +void fw_service_removePort(FWService *obj, FWPort *port); +gboolean fw_service_queryPort(FWService *obj, FWPort *port); + +GList *fw_service_getModules(FWService *obj); +void fw_service_setModules(FWService *obj, GList *modules); +void fw_service_addModule(FWService *obj, gchar *module); +void fw_service_removeModule(FWService *obj, gchar *module); +gboolean fw_service_queryModule(FWService *obj, gchar *module); + +GHashTable *fw_service_getDestinations(FWService *obj); +void fw_service_setDestinations(FWService *obj, GHashTable *destinations); +void fw_service_setDestination(FWService *obj, gchar *ipv, gchar *address); +void fw_service_removeDestination(FWService *obj, gchar *ipv); +gboolean fw_service_queryDestination(FWService *obj, gchar *ipv, gchar *address); + +#endif /* __FW_SERVICE_H__ */

1 0

[firewalld-recode] master: Stub of firewallctl (916e6ed)
by jpopelka＠fedoraproject.org 28 Jan '15

28 Jan '15

Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git On branch : master >--------------------------------------------------------------- commit 916e6ed748e010656ccc77db4420e534cb9389d6 Author: Jiri Popelka <jpopelka(a)redhat.com> Date: Wed Jan 28 14:24:39 2015 +0100 Stub of firewallctl Eventually it needs to be moved into separate directory. I've been heavily inspired by nmcli code (GPLv2+). >--------------------------------------------------------------- libfirewall/src/Makefile | 9 +- libfirewall/src/firewallctl.c | 346 +++++++++++++++++++++++++++++++++++++++ libfirewall/src/firewallctl.h | 52 ++++++ libfirewall/src/firewallctl.txt | 71 ++++++++ 4 files changed, 475 insertions(+), 3 deletions(-) diff --git a/libfirewall/src/Makefile b/libfirewall/src/Makefile index fb826dd..44efaf3 100644 --- a/libfirewall/src/Makefile +++ b/libfirewall/src/Makefile @@ -24,7 +24,7 @@ HEADERS = $(SOURCES:.c=.h) firewall.h CC = gcc C_INCLUDES = `pkg-config --cflags gio-2.0` -CFLAGS = $(C_INCLUDES) -g -O -Wall +CFLAGS = $(C_INCLUDES) -g -O -Wall -std=c11 LIBS = `pkg-config --libs gio-2.0` LIBDIR = /usr/lib64 @@ -33,7 +33,7 @@ NSVERSION=0.1 GIR_FILE=$(NAMESPACE)-$(NSVERSION).gir TYPELIB_FILE=$(NAMESPACE)-$(NSVERSION).typelib -all: libfirewall.la $(TYPELIB_FILE) test +all: libfirewall.la $(TYPELIB_FILE) test firewallctl libfirewall.la: $(OBJECTS) libtool link $(CC) $(LIBS) -rpath $(LIBDIR) $(OBJECTS) -o $@ @@ -50,6 +50,9 @@ $(GIR_FILE): $(SOURCES) $(HEADERS) test: test.o libtool link $(CC) $(CFLAGS) $< -o $@ $(LIBS) libfirewall.la +firewallctl: firewallctl.o + libtool link $(CC) $(CFLAGS) $< -o $@ $(LIBS) libfirewall.la + clean: - -rm *.lo *.o libfirewall.la $(TYPELIB_FILE) $(GIR_FILE) test *~ + -rm *.lo *.o libfirewall.la $(TYPELIB_FILE) $(GIR_FILE) test firewallctl *~ -rm -rf .libs diff --git a/libfirewall/src/firewallctl.c b/libfirewall/src/firewallctl.c new file mode 100644 index 0000000..c43c10f --- /dev/null +++ b/libfirewall/src/firewallctl.c @@ -0,0 +1,346 @@ +/* + * Copyright (C) 2015 Red Hat, Inc. + * + * Authors: + * Jiri Popelka <jpopelka(a)redhat.com> + * Jiri Klimes <jklimes(a)redhat.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#include <stdlib.h> +#include <stdio.h> +#include <getopt.h> +#include <assert.h> +#include <string.h> + +#include "firewallctl.h" + +# define FIREWALLCTL_VERSION "0.1" + +#define DDD() printf("%s:%s():%d\n",__FILE__,__func__,__LINE__); +#define DDDd(i) printf("%s:%s():%d -- %s=%d\n",__FILE__,__func__,__LINE__,#i,i); +#define DDDs(s) printf("%s:%s():%d -- %s=%s\n",__FILE__,__func__,__LINE__,#s,s); + +/* Global FwCtl object */ +FwCtl fw_ctl; + +int +matches (const char *cmd, const char *pattern) +{ + size_t len = strlen (cmd); + if (!len || len > strlen (pattern)) + return -1; + return memcmp (pattern, cmd, len); +} + +gboolean +fwc_arg_is_help (const char *arg) +{ + if (!arg) + return FALSE; + if ( matches (arg, "help") == 0 + || (g_str_has_prefix (arg, "-") && matches (arg+1, "help") == 0) + || (g_str_has_prefix (arg, "--") && matches (arg+2, "help") == 0)) { + return TRUE; + } + return FALSE; +} + +static void +usage (const char *prog_name) +{ + g_printerr (_("Usage: %s [OPTIONS] OBJECT { COMMAND | help }\n" + "\n" + "OPTIONS\n" + " -q[uiet] do not print status messages\n" + " -v[ersion] show program version\n" + " -h[elp] print this help\n" + "\n" + "OBJECT\n" + " z[one] zone configuration\n" + " d[irect] Direct configuration\n" + " l[ockdown-whitelist] Lockdown Whitelist\n" + " s[tate] general state/status commands\n" + "\n"), + prog_name); +} + +/* Initialize FwCtl structure - set default values */ +static void +fwc_init (FwCtl *fwc) +{ + fwc->fw = fw_client_new(); +g_print("default zone: '%s'\n", fw_client_getDefaultZone(fwc->fw)); + fwc->return_value = FWC_RESULT_SUCCESS; + fwc->return_text = g_string_new (_("Success")); + fwc->timeout = -1; + fwc->quiet_flag = TRUE; +} + +static void +fwc_cleanup (FwCtl *fwc) +{ + g_string_free (fwc->return_text, TRUE); +} + +static void +usage_zone () +{ + +} + +static gboolean +usage_zone_second_level (const char *cmd) +{ + gboolean ret = TRUE; + + if (matches (cmd, "add") == 0) + g_printerr (_("Usage: firewallctl zone add { ARGUMENTS [{--permanent | --runtime}] [--zone <zone>] | help }\n" + "\n" + "--permanent option can be used to set options permanently.\n" + "These changes are not effective immediately, only after service\n" + "restart/reload or system reboot.\n" + "With --runtime option, a change will only be part of\n" + "runtime configuration, i.e. overloaded with permanent configuration\n" + "after service restart/reload.\n" + "When none of --permanent, --runtime is used, both configuration are changed.\n" + "\n" + "If a timeout is supplied, the rule will be active for the specified amount\n" + "of time and will be removed automatically afterwards.\n" + "timeval is either a number (of seconds) or number followed by one\n" + "of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.\n" + "\n" + "ARGUMENTS := service <service> [--timeout <timeval>]\n" + "\n" + "Add a service in zone. If zone is omitted, default zone will be used.\n" + "\n" + "ARGUMENTS := port ...\n" + "\n" + "TODO\n" + "ARGUMENTS := ... TODO\n" + "\n" + "\n")); + else if (matches (cmd, "remove") == 0) + g_printerr (_("TODO")); + else if (matches (cmd, "query") == 0) + g_printerr (_("TODO")); + else if (matches (cmd, "list") == 0) + g_printerr (_("TODO")); + else if (matches (cmd, "get") == 0) + g_printerr (_("TODO")); + else if (matches (cmd, "set") == 0) + g_printerr (_("TODO")); + else if (matches (cmd, "runtime-to-permanent") == 0) + g_printerr (_("TODO")); + else + ret = FALSE; + return ret; +} + +static FWCResultCode +do_zone_add (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +static FWCResultCode +do_zone_remove (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +static FWCResultCode +do_zone_query (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +static FWCResultCode +do_zone_list_all_zones (FwCtl *fwc) +{ + return fwc->return_value; +} + +static FWCResultCode +do_zone_list (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +static FWCResultCode +do_zone_get (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +static FWCResultCode +do_zone_set (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +/* Entry point function for zone-related commands: 'firewallctl zone ...' */ +FWCResultCode +do_zone (FwCtl *fwc, int argc, char **argv) +{ + /* Exit early on help */ + if (fwc_arg_is_help (*argv)) { + usage_zone (); + return fwc->return_value; + } + if (argc != 0 && fwc_arg_is_help (*(argv+1))) { + if (usage_zone_second_level (*argv)) + return fwc->return_value; + } + + /* Now parse the command line and perform the required operation */ + if (argc == 0) { + fwc->return_value = do_zone_list_all_zones (fwc); + } else { + if (matches (*argv, "add") == 0) { + fwc->return_value = do_zone_add (fwc, argc-1, argv+1); + } else if (matches(*argv, "remove") == 0) { + fwc->return_value = do_zone_remove (fwc, argc-1, argv+1); + } else if (matches(*argv, "query") == 0) { + fwc->return_value = do_zone_query (fwc, argc-1, argv+1); + } else if (matches(*argv, "list") == 0) { + fwc->return_value = do_zone_list (fwc, argc-1, argv+1); + } else if (matches(*argv, "get") == 0) { + fwc->return_value = do_zone_get (fwc, argc-1, argv+1); + } else if (matches(*argv, "set") == 0) { + fwc->return_value = do_zone_set (fwc, argc-1, argv+1); + } else { + usage_zone (); + g_string_printf (fwc->return_text, _("Error: '%s' is not valid 'zone' command."), *argv); + fwc->return_value = FWC_RESULT_ERROR_USER_INPUT; + } + } + + return fwc->return_value; +} + +/* Entry point function for direct-related commands: 'firewallctl direct ...' */ +FWCResultCode +do_direct (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +/* Entry point function for lockdown-whitelist - related commands: 'firewallctl lockdown-whitelist ...' */ +FWCResultCode +do_lockdown (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +/* Entry point function for state-related commands: 'firewallctl state ...' */ +FWCResultCode +do_state (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + + +static const struct cmd { + const char *cmd; + FWCResultCode (*func) (FwCtl *fwc, int argc, char **argv); +} fwctl_cmds[] = { + { "zone", do_zone }, + { "direct", do_direct }, + { "lockdown-whitelist", do_lockdown }, + { "state", do_state }, + { 0 } +}; + +static FWCResultCode +do_cmd (FwCtl *fwc, const char *argv0, int argc, char **argv) +{ + const struct cmd *c; + + for (c = fwctl_cmds; c->cmd; ++c) { + if (matches (argv0, c->cmd) == 0) + return c->func (fwc, argc-1, argv+1); + } + + g_string_printf (fwc->return_text, _("Error: Object '%s' is unknown, try 'firewallctl help'."), argv0); + fwc->return_value = FWC_RESULT_ERROR_USER_INPUT; + return fwc->return_value; +} + +static int +parse_argv(FwCtl * fwc, int argc, char *argv[]) { + assert(argc >= 0); + assert(argv); + + char *base; + + base = strrchr (argv[0], '/'); + if (base == NULL) + base = argv[0]; + else + base++; + + /* parse options */ + while (argc > 1) { + char *opt = argv[1]; + /* '--' ends options */ + if (strcmp (opt, "--") == 0) { + argc--; argv++; + break; + } + if (opt[0] != '-') + break; + if (opt[1] == '-') + opt++; + if (matches (opt, "-version") == 0) { + g_print (_("firewallctl tool, version %s\n"), FIREWALLCTL_VERSION); + return FWC_RESULT_SUCCESS; + } else if (matches (opt, "-help") == 0) { + usage (base); + return FWC_RESULT_SUCCESS; + } else { + g_string_printf (fwc->return_text, _("Error: Option '%s' is unknown, try 'firewallctl -help'."), opt); + fwc->return_value = FWC_RESULT_ERROR_USER_INPUT; + return fwc->return_value; + } + argc--; + argv++; + } + + if (argc > 1) { + /* Now run the requested command */ + return do_cmd (fwc, argv[1], argc-1, argv+1); + } + + usage (base); + return fwc->return_value; + + return 0; +} + +int +main(int argc, char*argv[]) { + fwc_init (&fw_ctl); + + parse_argv(&fw_ctl, argc, argv); + + /* Print result descripting text */ + if (fw_ctl.return_value != FWC_RESULT_SUCCESS) { + g_printerr ("%s\n", fw_ctl.return_text->str); + } + + fwc_cleanup (&fw_ctl); + return fw_ctl.return_value; +} diff --git a/libfirewall/src/firewallctl.h b/libfirewall/src/firewallctl.h new file mode 100644 index 0000000..dea7ede --- /dev/null +++ b/libfirewall/src/firewallctl.h @@ -0,0 +1,52 @@ +/* + * Copyright (C) 2015 Red Hat, Inc. + * + * Authors: + * Jiri Popelka <jpopelka(a)redhat.com> + * Jiri Klimes <jklimes(a)redhat.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#ifndef FIREWALLCTL_H_ +#define FIREWALLCTL_H_ + +#include <glib.h> +#include "fw_client.h" + + +/* firewallctl exit codes */ +typedef enum { + /* Indicates successful execution */ + FWC_RESULT_SUCCESS = 0, + + /* Unknown / unspecified error */ + FWC_RESULT_ERROR_UNKNOWN = 1, + + /* Wrong invocation of firewallctl */ + FWC_RESULT_ERROR_USER_INPUT = 2, + +} FWCResultCode; + +/* FwCtl - main structure */ +typedef struct _FwCtl { + FWClient *fw; /* Client object */ + int return_value; /* Return code of firewallctl */ + GString *return_text; /* Reason text */ + int timeout; /* Operation timeout */ + gboolean quiet_flag; /* '--quiet' option */ +} FwCtl; + + +#endif diff --git a/libfirewall/src/firewallctl.txt b/libfirewall/src/firewallctl.txt new file mode 100644 index 0000000..d03b9b1 --- /dev/null +++ b/libfirewall/src/firewallctl.txt @@ -0,0 +1,71 @@ +zone + {add | remove | query} + (--timeout & --force valid only with 'add') + service <service> [--permanent | --runtime] [--zone=] [--timeout=] + port <portid[-portid]/protocol> [--permanent | --runtime] [--zone=] [--timeout=] + icmp-block <icmp-type> [--permanent | --runtime] [--zone=] [--timeout=] + forward-port <portid[-portid]/protocol> [--toport=portid[-portid]] [--toaddr=address[/mask]] + [--permanent | --runtime] [--zone=] [--timeout=] + masquerade [--permanent | --runtime] [--zone=] [--timeout=] + rich-rule <'rule'> [--permanent | --runtime] [--zone=] [--timeout=] + interface <interface> [--permanent | --runtime] [--zone=] [--force] + source <source[/mask]> [--permanent | --runtime] [--zone=] [--force] + list + all [{--permanent | --runtime}] [--zone=] + all-zones [{--permanent | --runtime}] + services [{--permanent | --runtime}] [--zone=] + ports [{--permanent | --runtime}] [--zone=] + icmp-blocks [{--permanent | --runtime}] [--zone=] + forward-ports [{--permanent | --runtime}] [--zone=] + rich-rules [{--permanent | --runtime}] [--zone=] + interfaces [{--permanent | --runtime}] [--zone=] + sources [{--permanent | --runtime}] [--zone=] + get + default-zone + active-zones + zone-of-interface <interface> [{--permanent | --runtime}] + zone-of-source <source> [{--permanent | --runtime}] + zones [{--permanent | --runtime}] + services [{--permanent | --runtime}] + icmptypes [{--permanent | --runtime}] + service-details --service= (RHBZ#1184232) + target (permanent only) [--zone=] + set + default-zone <zone> + target (permanent only) --target= [--zone=] + {new | delete } (permanent only) + {zone | service | icmptype} <name> + +direct + {add | remove | query} + chain [--permanent | --runtime] --tool={ipv4 | ipv6 | eb} --table= --chain= + rule [--permanent | --runtime] --tool={ipv4 | ipv6 | eb} --table= --chain= --priority= args + rules [--permanent | --runtime] --tool={ipv4 | ipv6 | eb} --table= --chain= (only with 'remove') + passthrough [--permanent | --runtime] --tool={ipv4 | ipv6 | eb} args + get + all-chains [{--permanent | --runtime}] + chains [{--permanent | --runtime}] --tool={ipv4 | ipv6 | eb} --table= + all-rules [{--permanent | --runtime}] + rules [{--permanent | --runtime}] --tool={ipv4 | ipv6 | eb} --table= --chain= + all-passthroughs [{--permanent | --runtime}] + passthroughs [{--permanent | --runtime}] --tool={ipv4 | ipv6 | eb} + passthrough --tool={ipv4 | ipv6 | eb} args + +lockdown-whitelist + {add | remove | query} + {command | context | uid | user} <value> [--permanent | --runtime] + list + {commands | contexts | uids | users} [{--permanent | --runtime}] + +state + state + reload + complete-reload + panic + {on | off | query} + runtime-to-permanent + +help + +-v/--version +-q/--quiet

1 0

[firewalld-recode] master: Delete the backend object in Firewall class dtor (ceacd93)
by mildew＠fedoraproject.org 21 Jan '15

21 Jan '15

Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git On branch : master >--------------------------------------------------------------- commit ceacd932d177411c33d749ef212a34ea4c3773ff Author: Daniel Kopecek <dkopecek(a)redhat.com> Date: Wed Jan 21 13:23:17 2015 +0100 Delete the backend object in Firewall class dtor >--------------------------------------------------------------- src/Daemon/Firewall/Firewall.cpp | 10 ++++++++-- src/Daemon/Firewall/Firewall.hpp | 1 + 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/src/Daemon/Firewall/Firewall.cpp b/src/Daemon/Firewall/Firewall.cpp index 5832560..57aa184 100644 --- a/src/Daemon/Firewall/Firewall.cpp +++ b/src/Daemon/Firewall/Firewall.cpp @@ -31,6 +31,13 @@ namespace firewalld _backend = new LinuxXTables(); } + Firewall::~Firewall() + { + if (_backend != nullptr) { + delete _backend; + } + } + bool Firewall::directIPv4getTables(StringVector& tables) { tables = _ip4tables.listTables(); @@ -296,9 +303,8 @@ namespace firewalld Backend& Firewall::backend() { if (_backend == nullptr) { - LOG(FATAL) << "BUG: Firewall backend not set!"; + throw std::runtime_error("BUG: Firewall backend not set! Cannot return a reference to it."); } - return *_backend; } diff --git a/src/Daemon/Firewall/Firewall.hpp b/src/Daemon/Firewall/Firewall.hpp index 8d0d742..425540f 100644 --- a/src/Daemon/Firewall/Firewall.hpp +++ b/src/Daemon/Firewall/Firewall.hpp @@ -40,6 +40,7 @@ namespace firewalld { public: Firewall(); + ~Firewall(); // Direct interface bool directIPv4getTables(StringVector& tables);

1 0

[firewalld-recode] master: Added implementation of the DBus policies interface (724a69b)
by mildew＠fedoraproject.org 21 Jan '15

21 Jan '15

Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git On branch : master >--------------------------------------------------------------- commit 724a69b175b711117b855e94b0851d1dff8eb5ea Author: Daniel Kopecek <dkopecek(a)redhat.com> Date: Wed Jan 21 13:21:54 2015 +0100 Added implementation of the DBus policies interface >--------------------------------------------------------------- Makefile.am | 25 +++++- .../addLockdownWhitelistCommand.cpp} | 21 ++--- .../addLockdownWhitelistContext.cpp} | 21 ++--- .../addLockdownWhitelistUid.cpp} | 21 ++--- .../addLockdownWhitelistUser.cpp} | 21 ++--- .../disableLockdown.cpp} | 16 +-- .../enableLockdown.cpp} | 16 +-- .../getLockdownWhitelistCommands.cpp} | 15 +-- .../getLockdownWhitelistContexts.cpp} | 15 +-- .../getLockdownWhitelistUids.cpp} | 20 ++-- .../getLockdownWhitelistUsers.cpp} | 15 +-- src/Daemon/DBus/policies/methods.decl | 23 +++++ .../queryLockdown.cpp} | 11 ++- .../queryLockdownWhitelistCommand.cpp} | 15 +-- .../queryLockdownWhitelistContext.cpp} | 15 +-- .../queryLockdownWhitelistUid.cpp} | 16 +-- .../queryLockdownWhitelistUser.cpp} | 15 +-- .../removeLockdownWhitelistCommand.cpp} | 19 ++-- .../removeLockdownWhitelistContext.cpp} | 19 ++-- .../removeLockdownWhitelistUid.cpp} | 20 ++-- .../removeLockdownWhitelistUser.cpp} | 19 ++-- src/Daemon/FirewallD.cpp | 21 ++++- src/Daemon/FirewallD.hpp | 8 +- src/Daemon/LockdownWhitelist.cpp | 103 +++++++++++++++++--- src/Daemon/LockdownWhitelist.hpp | 60 ++++++++++-- 25 files changed, 337 insertions(+), 233 deletions(-) diff --git a/Makefile.am b/Makefile.am index 631cd70..ac15f15 100644 --- a/Makefile.am +++ b/Makefile.am @@ -28,7 +28,8 @@ noinst_LTLIBRARIES =\ librichrules.la \ libdbus_main.la \ libdbus_zone.la \ - libdbus_direct.la + libdbus_direct.la \ + libdbus_policies.la sbin_PROGRAMS=\ firewalld @@ -192,6 +193,27 @@ libdbus_zone_la_LIBADD=\ $(top_builddir)/librichrules.la \ $(top_builddir)/libfirewall.la +libdbus_policies_la_SOURCES=\ + src/Daemon/DBus/policies/addLockdownWhitelistCommand.cpp \ + src/Daemon/DBus/policies/addLockdownWhitelistContext.cpp \ + src/Daemon/DBus/policies/addLockdownWhitelistUid.cpp \ + src/Daemon/DBus/policies/addLockdownWhitelistUser.cpp \ + src/Daemon/DBus/policies/disableLockdown.cpp \ + src/Daemon/DBus/policies/enableLockdown.cpp \ + src/Daemon/DBus/policies/getLockdownWhitelistCommands.cpp \ + src/Daemon/DBus/policies/getLockdownWhitelistContexts.cpp \ + src/Daemon/DBus/policies/getLockdownWhitelistUids.cpp \ + src/Daemon/DBus/policies/getLockdownWhitelistUsers.cpp \ + src/Daemon/DBus/policies/queryLockdown.cpp \ + src/Daemon/DBus/policies/queryLockdownWhitelistCommand.cpp \ + src/Daemon/DBus/policies/queryLockdownWhitelistContext.cpp \ + src/Daemon/DBus/policies/queryLockdownWhitelistUid.cpp \ + src/Daemon/DBus/policies/queryLockdownWhitelistUser.cpp \ + src/Daemon/DBus/policies/removeLockdownWhitelistCommand.cpp \ + src/Daemon/DBus/policies/removeLockdownWhitelistContext.cpp \ + src/Daemon/DBus/policies/removeLockdownWhitelistUid.cpp \ + src/Daemon/DBus/policies/removeLockdownWhitelistUser.cpp + firewalld_SOURCES=\ src/Daemon/Exceptions.hpp \ src/Daemon/CLI.cpp \ @@ -217,5 +239,6 @@ firewalld_LDADD=\ $(top_builddir)/libdbus_main.la \ $(top_builddir)/libdbus_zone.la \ $(top_builddir)/libdbus_direct.la \ + $(top_builddir)/libdbus_policies.la \ @pthread_LIBS@ \ @giomm_LIBS@ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/addLockdownWhitelistCommand.cpp similarity index 70% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/addLockdownWhitelistCommand.cpp index 3f87d05..a325396 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/addLockdownWhitelistCommand.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistCommand) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString command; + parameters.get(0, command); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); - } - catch(const FirewallError& ex) { + _lockdown_whitelist.addCommand(command); + _dbus.broadcastSignal("LockdownWhitelistCommandAdded", DBUS_INTERFACE_POLICIES, parameters); + } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/addLockdownWhitelistContext.cpp similarity index 70% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/addLockdownWhitelistContext.cpp index 3f87d05..0e3a17c 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/addLockdownWhitelistContext.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistContext) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString context; + parameters.get(0, context); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); - } - catch(const FirewallError& ex) { + _lockdown_whitelist.addSEContext(context); + _dbus.broadcastSignal("LockdownWhitelistContextAdded", DBUS_INTERFACE_POLICIES, parameters); + } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/disablePanicMode.cpp b/src/Daemon/DBus/policies/addLockdownWhitelistUid.cpp similarity index 73% copy from src/Daemon/DBus/disablePanicMode.cpp copy to src/Daemon/DBus/policies/addLockdownWhitelistUid.cpp index d001ae8..8738c94 100644 --- a/src/Daemon/DBus/disablePanicMode.cpp +++ b/src/Daemon/DBus/policies/addLockdownWhitelistUid.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,20 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,,disablePanicMode) + FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistUid) { result.setTypeSignature("()"); - - if (panicMode()) { - try { - setPanicMode(false); - } catch(...) { - result = DBusError("COMMAND_FAILED", "Unable to disable panic mode"); - } - } else { - result = DBusError("NOT_ENABLED", "Panic mode not enabled"); + gint uid_integer; + parameters.get(0, uid_integer); + uid_t uid = (uid_t)uid_integer; + try { + _lockdown_whitelist.addUID(uid); + } catch(const FirewallError& ex) { + result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/addLockdownWhitelistUser.cpp similarity index 71% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/addLockdownWhitelistUser.cpp index 3f87d05..dda4c18 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/addLockdownWhitelistUser.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistUser) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString username; + parameters.get(0, username); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); - } - catch(const FirewallError& ex) { + _lockdown_whitelist.addUsername(username); + _dbus.broadcastSignal("LockdownWhitelistUserAdded", DBUS_INTERFACE_POLICIES, parameters); + } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/disableLockdown.cpp similarity index 76% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/disableLockdown.cpp index 89b4cef..f89e026 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/disableLockdown.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,16 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,disableLockdown) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("()"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + setLockdownMode(/*enable=*/false); + _dbus.broadcastSignal("LockdownDisabled", DBUS_INTERFACE_POLICIES, parameters); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/enableLockdown.cpp similarity index 76% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/enableLockdown.cpp index 89b4cef..0318c97 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/enableLockdown.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,16 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,enableLockdown) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("()"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + setLockdownMode(/*enable=*/true); + _dbus.broadcastSignal("LockdownEnabled", DBUS_INTERFACE_POLICIES, parameters); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/getLockdownWhitelistCommands.cpp similarity index 77% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/getLockdownWhitelistCommands.cpp index 89b4cef..7f21efa 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/getLockdownWhitelistCommands.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,15 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistCommands) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("(as)"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + result = _lockdown_whitelist.getCommands(); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/getLockdownWhitelistContexts.cpp similarity index 77% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/getLockdownWhitelistContexts.cpp index 89b4cef..65cb460 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/getLockdownWhitelistContexts.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,15 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistContexts) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("(as)"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + result = _lockdown_whitelist.getSEContexts(); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/getLockdownWhitelistUids.cpp similarity index 72% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/getLockdownWhitelistUids.cpp index 3f87d05..51300ce 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/getLockdownWhitelistUids.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,20 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistUids) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("(ai)"); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); + std::vector<uid_t> uid_vector = _lockdown_whitelist.getUIDs(); + std::vector<gint> uid_integers; + for (auto const& uid : uid_vector) { + uid_integers.push_back((gint)uid); + } + result = uid_integers; } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/getLockdownWhitelistUsers.cpp similarity index 76% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/getLockdownWhitelistUsers.cpp index 89b4cef..608a9f4 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/getLockdownWhitelistUsers.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,15 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistUsers) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("(as)"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + result = _lockdown_whitelist.getUsernames(); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/policies/methods.decl b/src/Daemon/DBus/policies/methods.decl index e69de29..0a6690e 100644 --- a/src/Daemon/DBus/policies/methods.decl +++ b/src/Daemon/DBus/policies/methods.decl @@ -0,0 +1,23 @@ +FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistCommand); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistCommand); +FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistCommands); +FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistCommand); + +FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistContext); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistContext); +FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistContexts); +FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistContext); + +FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistUser); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistUser); +FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistUsers); +FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistUser); + +FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistUid); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistUid); +FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistUids); +FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistUid); + +FIREWALLD_DBUS_METHOD(1,policies,enableLockdown); +FIREWALLD_DBUS_METHOD(1,policies,disableLockdown); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdown); diff --git a/src/Daemon/DBus/queryPanicMode.cpp b/src/Daemon/DBus/policies/queryLockdown.cpp similarity index 81% copy from src/Daemon/DBus/queryPanicMode.cpp copy to src/Daemon/DBus/policies/queryLockdown.cpp index a4b632a..49ac76b 100644 --- a/src/Daemon/DBus/queryPanicMode.cpp +++ b/src/Daemon/DBus/policies/queryLockdown.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,10 +22,15 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,,queryPanicMode) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdown) { result.setTypeSignature("(b)"); - result = panicMode(); + try { + result = lockdownMode(); + } + catch(const FirewallError& ex) { + result = DBusError(ex); + } return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/queryLockdownWhitelistCommand.cpp similarity index 77% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/queryLockdownWhitelistCommand.cpp index 9137ba4..9b73e6b 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/queryLockdownWhitelistCommand.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistCommand) { result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + UString command; + parameters.get(0, command); try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + result = _lockdown_whitelist.commandInList(command); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/queryLockdownWhitelistContext.cpp similarity index 77% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/queryLockdownWhitelistContext.cpp index 9137ba4..24513e9 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/queryLockdownWhitelistContext.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistContext) { result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + UString context; + parameters.get(0, context); try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + result = _lockdown_whitelist.SEContextInList(context); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/queryLockdownWhitelistUid.cpp similarity index 77% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/queryLockdownWhitelistUid.cpp index 9137ba4..6a739e9 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/queryLockdownWhitelistUid.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,18 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistUid) { result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + gint uid_integer; + parameters.get(0, uid_integer); + uid_t uid = (uid_t)uid_integer; try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + result = _lockdown_whitelist.UIDInList(uid); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/queryLockdownWhitelistUser.cpp similarity index 77% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/queryLockdownWhitelistUser.cpp index 9137ba4..36bd4fa 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/queryLockdownWhitelistUser.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistUser) { result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + UString username; + parameters.get(0, username); try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + result = _lockdown_whitelist.UsernameInList(username); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/removeLockdownWhitelistCommand.cpp similarity index 73% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/removeLockdownWhitelistCommand.cpp index 3f87d05..8753fe5 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/removeLockdownWhitelistCommand.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,19 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistCommand) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString command; + parameters.get(0, command); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); + if (_lockdown_whitelist.removeCommand(command)) { + _dbus.broadcastSignal("LockdownWhitelistCommandRemoved", DBUS_INTERFACE_POLICIES, parameters); + } } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/removeLockdownWhitelistContext.cpp similarity index 72% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/removeLockdownWhitelistContext.cpp index 9137ba4..9b76ae2 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/removeLockdownWhitelistContext.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,19 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistContext) { - result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + result.setTypeSignature("()"); + UString context; + parameters.get(0, context); try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + if (_lockdown_whitelist.removeSEContext(context)) { + _dbus.broadcastSignal("LockdownWhitelistContextRemoved", DBUS_INTERFACE_POLICIES, parameters); + } } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/removeLockdownWhitelistUid.cpp similarity index 71% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/removeLockdownWhitelistUid.cpp index 3f87d05..12814d2 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/removeLockdownWhitelistUid.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,20 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistUid) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + gint uid_integer; + parameters.get(0, uid_integer); + uid_t uid = (uid_t)uid_integer; try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); + if (_lockdown_whitelist.removeUID(uid)) { + _dbus.broadcastSignal("LockdownWhitelistUidRemoved", DBUS_INTERFACE_POLICIES, parameters); + } } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/removeLockdownWhitelistUser.cpp similarity index 73% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/removeLockdownWhitelistUser.cpp index 3f87d05..c09361d 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/removeLockdownWhitelistUser.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,19 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistUser) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString username; + parameters.get(0, username); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); + if (_lockdown_whitelist.removeUsername(username)) { + _dbus.broadcastSignal("LockdownWhitelistUserRemoved", DBUS_INTERFACE_POLICIES, parameters); + } } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/FirewallD.cpp b/src/Daemon/FirewallD.cpp index 40feef2..3deb556 100644 --- a/src/Daemon/FirewallD.cpp +++ b/src/Daemon/FirewallD.cpp @@ -148,11 +148,28 @@ namespace firewalld } } - void FirewallD::setPanicMode(bool panic_mode) + bool FirewallD::panicMode() const + { + return _panic_mode; + } + + void FirewallD::setPanicMode(bool enable) { // Set the panic mode // Signal on dbus - _panic_mode = panic_mode; + _panic_mode = enable; + } + + bool FirewallD::lockdownMode() const + { + return _lockdown_mode; + } + + void FirewallD::setLockdownMode(bool enable) + { + // Set the lockdown mode + // Signal on dbus + _lockdown_mode = enable; } Pointer<Service> FirewallD::lookupService(const UString& name) const diff --git a/src/Daemon/FirewallD.hpp b/src/Daemon/FirewallD.hpp index 33b2f4d..d14f5fa 100644 --- a/src/Daemon/FirewallD.hpp +++ b/src/Daemon/FirewallD.hpp @@ -69,8 +69,11 @@ namespace firewalld */ void loadDefinitions(); - bool panicMode() const { return _panic_mode; } - void setPanicMode(bool panic_mode); + bool panicMode() const; + void setPanicMode(bool enable); + + bool lockdownMode() const; + void setLockdownMode(bool enable); /** * Return reference to the Service object definitions. @@ -215,6 +218,7 @@ namespace firewalld PointerMap<UString,ICMPType> _defined_icmptypes; bool _panic_mode; + bool _lockdown_mode; DBusMethodTable _dbus_method_table; std::mutex _dbus_method_mutex; diff --git a/src/Daemon/LockdownWhitelist.cpp b/src/Daemon/LockdownWhitelist.cpp index 4fcd1ef..d05816f 100644 --- a/src/Daemon/LockdownWhitelist.cpp +++ b/src/Daemon/LockdownWhitelist.cpp @@ -35,42 +35,87 @@ namespace firewalld LOG(DEBUG) << "Added SELinux context \"" << secontext << "\" to lockdown whitelist"; } + bool LockdownWhitelist::SEContextInList(const UString& secontext) const + { + return (_secontexts.count(secontext) == 1); + } + + bool LockdownWhitelist::removeSEContext(const UString& secontext) + { + return (_secontexts.erase(secontext) > 0); + } + + UStringVector LockdownWhitelist::getSEContexts() const + { + UStringVector contexts; + for (auto const& map_entry : _secontexts) { + contexts.push_back(map_entry.first); + } + return std::move(contexts); + } + void LockdownWhitelist::addUsername(const UString& username) { _usernames[username] = true; LOG(DEBUG) << "Added username \"" << username << "\" to lockdown whitelist"; } + bool LockdownWhitelist::UsernameInList(const UString& username) const + { + return (_usernames.count(username) == 1); + } + + bool LockdownWhitelist::removeUsername(const UString& username) + { + return (_usernames.erase(username) > 0); + } + + UStringVector LockdownWhitelist::getUsernames() const + { + UStringVector usernames; + for (auto const& map_entry : _usernames) { + usernames.push_back(map_entry.first); + } + return std::move(usernames); + } + void LockdownWhitelist::addUID(uid_t uid) { _uids[uid] = true; LOG(DEBUG) << "Added UID \"" << uid << "\" to lockdown whitelist"; } - void LockdownWhitelist::addCommand(const UString& command) + bool LockdownWhitelist::UIDInList(uid_t uid) const { - if (command[command.length() - 1] == '*') { - _commands_partial.push_back(command); - LOG(DEBUG) << "Added command pattern \"" << command << "\" to lockdown whitelist"; - } else { - _commands_full[command] = true; - LOG(DEBUG) << "Added command \"" << command << "\" to lockdown whitelist"; - } + return (_uids.count(uid) == 1); } - bool LockdownWhitelist::SEContextInList(const UString& secontext) const + bool LockdownWhitelist::removeUID(uid_t uid) { - return (_secontexts.count(secontext) == 1); + return (_uids.erase(uid) > 0); } - bool LockdownWhitelist::UsernameInList(const UString& username) const + std::vector<uid_t> LockdownWhitelist::getUIDs() const { - return (_usernames.count(username) == 1); + std::vector<uid_t> uid_vector; + for (auto const& map_entry : _uids) { + uid_vector.push_back(map_entry.first); + } + return std::move(uid_vector); } - bool LockdownWhitelist::UIDInList(uid_t uid) const + void LockdownWhitelist::addCommand(const UString& command) { - return (_uids.count(uid) == 1); + if (command.length() < 1) { + return; + } + if (command[command.length() - 1] == '*') { + _commands_partial.push_back(command); + LOG(DEBUG) << "Added command pattern \"" << command << "\" to lockdown whitelist"; + } else { + _commands_full[command] = true; + LOG(DEBUG) << "Added command \"" << command << "\" to lockdown whitelist"; + } } bool LockdownWhitelist::commandInList(const UString& command) const @@ -88,6 +133,36 @@ namespace firewalld return false; } + bool LockdownWhitelist::removeCommand(const UString& command) + { + if (command.length() < 1) { + return false; + } + if (command[command.length() - 1] == '*') { + for (auto it = _commands_partial.begin(); it != _commands_partial.end(); ++it) { + if (*it == command) { + _commands_partial.erase(it); + return true; + } + } + return false; + } else { + return (_commands_full.erase(command) > 0); + } + } + + UStringVector LockdownWhitelist::getCommands() const + { + UStringVector commands; + for (auto const& map_entry : _commands_full) { + commands.push_back(map_entry.first); + } + for (auto const& command : _commands_partial) { + commands.push_back(command); + } + return std::move(commands); + } + void LockdownWhitelist::clear() { _secontexts.clear(); diff --git a/src/Daemon/LockdownWhitelist.hpp b/src/Daemon/LockdownWhitelist.hpp index 525938f..7860d13 100644 --- a/src/Daemon/LockdownWhitelist.hpp +++ b/src/Daemon/LockdownWhitelist.hpp @@ -34,34 +34,44 @@ namespace firewalld LockdownWhitelist(); /** + * Add a SELinux context to the list. + */ + void addSEContext(const UString& secontext); + + /** * Check is the given SELinux context is in the list. */ bool SEContextInList(const UString& secontext) const; /** - * Check if the given username is in the list. + * Remove a SELinux context from the list. */ - bool UsernameInList(const UString& username) const; + bool removeSEContext(const UString& secontext); /** - * Check if the given UID is in the list. + * Return a vector of SELinux contexts. */ - bool UIDInList(uid_t uid) const; + UStringVector getSEContexts() const; /** - * Check if the given command is in the list. + * Add a username to the list. */ - bool commandInList(const UString& command) const; + void addUsername(const UString& username); /** - * Add a SELinux context to the list. + * Check if the given username is in the list. */ - void addSEContext(const UString& secontext); + bool UsernameInList(const UString& username) const; /** - * Add a username to the list. + * Remove a username from the list. */ - void addUsername(const UString& username); + bool removeUsername(const UString& username); + + /** + * Get a vector of all username from the list. + */ + UStringVector getUsernames() const; /** * Add a UID to the list. @@ -69,11 +79,41 @@ namespace firewalld void addUID(uid_t uid); /** + * Check if the given UID is in the list. + */ + bool UIDInList(uid_t uid) const; + + /** + * Remove a UID from the list. + */ + bool removeUID(uid_t uid); + + /** + * Get a vector of all UIDs from the list. + */ + std::vector<uid_t> getUIDs() const; + + /** * Add a command to the list. */ void addCommand(const UString& command); /** + * Check if the given command is in the list. + */ + bool commandInList(const UString& command) const; + + /** + * Remove a command from the list. + */ + bool removeCommand(const UString& command); + + /** + * Get a vector of all commands from the list. + */ + UStringVector getCommands() const; + + /** * Remove all items from the list. */ void clear();

1 0

[firewalld-recode] master: Fix uninitialized variable bug in ConfigFile::parse() (b58226e)
by mildew＠fedoraproject.org 13 Jan '15

13 Jan '15

Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git On branch : master >--------------------------------------------------------------- commit b58226e7f96a491c04a991ab9453773779ca3eb4 Author: Daniel Kopecek <dkopecek(a)redhat.com> Date: Tue Jan 13 11:30:42 2015 +0100 Fix uninitialized variable bug in ConfigFile::parse() >--------------------------------------------------------------- src/Daemon/ConfigFile.cpp | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/Daemon/ConfigFile.cpp b/src/Daemon/ConfigFile.cpp index 9f32340..99189f7 100644 --- a/src/Daemon/ConfigFile.cpp +++ b/src/Daemon/ConfigFile.cpp @@ -99,7 +99,7 @@ namespace firewalld void ConfigFile::parse() { String config_line; - size_t config_line_number; + size_t config_line_number = 0; while(std::getline(_stream, config_line)) { ++config_line_number;

1 0

[firewalld-recode] master: Don't use exceptions for flow control in the FirewallD class (fa1248f)
by mildew＠fedoraproject.org 13 Jan '15

13 Jan '15

Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git On branch : master >--------------------------------------------------------------- commit fa1248f5291a2097e7296876a0ca79760fa15fcf Author: Daniel Kopecek <dkopecek(a)redhat.com> Date: Tue Jan 13 11:05:40 2015 +0100 Don't use exceptions for flow control in the FirewallD class >--------------------------------------------------------------- src/Daemon/ConfigFile.cpp | 5 +++ src/Daemon/ConfigFile.hpp | 3 +- src/Daemon/FirewallD.cpp | 79 ++++++++++++++++++++++----------------------- 3 files changed, 46 insertions(+), 41 deletions(-) diff --git a/src/Daemon/ConfigFile.cpp b/src/Daemon/ConfigFile.cpp index 0fe94aa..9f32340 100644 --- a/src/Daemon/ConfigFile.cpp +++ b/src/Daemon/ConfigFile.cpp @@ -91,6 +91,11 @@ namespace firewalld _dirty = true; } + bool ConfigFile::hasSettingValue(const String& name) const + { + return (_settings.count(name) != 0); + } + void ConfigFile::parse() { String config_line; diff --git a/src/Daemon/ConfigFile.hpp b/src/Daemon/ConfigFile.hpp index 0bf7cc9..ce3c5a9 100644 --- a/src/Daemon/ConfigFile.hpp +++ b/src/Daemon/ConfigFile.hpp @@ -34,8 +34,9 @@ namespace firewalld void write(); void close(); - const String& getSettingValue(const String& name) const; void setSettingValue(const String& name, String& value); + bool hasSettingValue(const String& name) const; + const String& getSettingValue(const String& name) const; protected: void parse(); diff --git a/src/Daemon/FirewallD.cpp b/src/Daemon/FirewallD.cpp index a77582a..40feef2 100644 --- a/src/Daemon/FirewallD.cpp +++ b/src/Daemon/FirewallD.cpp @@ -124,17 +124,13 @@ namespace firewalld _fw.setDefaultZoneName(_config.getSettingValue("DefaultZone")); /* Set definitions dir paths */ - try { - String definition_dirs_setting = _config.getSettingValue("StaticDefinitionDirs"); + if (_config.hasSettingValue("StaticDefinitionDirs")) { + const String definition_dirs_setting = _config.getSettingValue("StaticDefinitionDirs"); tokenizeString(definition_dirs_setting, _definition_dirs, ":", /*trim_empty=*/true); - } catch(const std::out_of_range& ex) { - /* Ignore out-of-range exception */ } - try { - String definition_dirs_setting = _config.getSettingValue("DefinitionDirs"); + if (_config.hasSettingValue("DefinitionDirs")) { + const String definition_dirs_setting = _config.getSettingValue("DefinitionDirs"); tokenizeString(definition_dirs_setting, _definition_dirs, ":", /*trim_empty=*/true); - } catch(const std::out_of_range& ex) { - /* Ignore out-of-range exception */ } return; } @@ -161,34 +157,31 @@ namespace firewalld Pointer<Service> FirewallD::lookupService(const UString& name) const { - try { + if (_defined_services.count(name) != 0) { return _defined_services.at(name); - } catch(const std::out_of_range& ex) { + } + else { return nullptr; - } catch(...) { - throw std::runtime_error("Unexpected exception"); } } Pointer<Zone> FirewallD::lookupZone(const UString& name) const { - try { + if (_defined_zones.count(name) != 0) { return _defined_zones.at(name); - } catch(const std::out_of_range& ex) { + } + else { return nullptr; - } catch(...) { - throw std::runtime_error("Unexpected exception"); } } Pointer<ICMPType> FirewallD::lookupICMPType(const UString& name) const { - try { + if (_defined_icmptypes.count(name) != 0) { return _defined_icmptypes.at(name); - } catch(const std::out_of_range& ex) { + } + else { return nullptr; - } catch(...) { - throw std::runtime_error("Unexpected exception"); } } @@ -269,7 +262,6 @@ namespace firewalld void FirewallD::dbus_method_handle(const ustring& name, const DBusParameters& parameters, DBusResultBuilder& result) { LOG(TRACE) << "DBus method call: method=" << name; - try { /* * First check whether the method call should be handled by @@ -280,33 +272,40 @@ namespace firewalld */ if (Glib::str_has_prefix(name, _fw.backend().directDBusInterface() + ".")) { _fw.backend().handleDBusMethod(name, parameters, result); - } else { + } + else { /* * Lookup the method implementation in the DBus method table * and call it. * * Method implementations are registered in the constructor. */ - const DBusMethodPointer method = _dbus_method_table.at(name); - /* - * Make sure no other DBus method will be executed during execution - * of this one. - */ - std::lock_guard<std::mutex> dbus_method_lock(_dbus_method_mutex); - /* - * This will call the method implementation on our instance of the - * FirewallD class - */ - (*this.*method)(parameters, result); - /* - * Catch bugs in method implementation. - */ - /* TODO: Assert: no zone is marked as dirty */ + if (_dbus_method_table.count(name) == 0) { + LOG(WARNING) << "Requested DBus method not found in the method table: " << name; + result = DBusError("NotImplemented", "The " + name + " method not implemented"); + } + else { + const DBusMethodPointer method = _dbus_method_table[name]; + /* + * Make sure no other DBus method will be executed during execution + * of this one. + */ + std::lock_guard<std::mutex> dbus_method_lock(_dbus_method_mutex); + /* + * This will call the method implementation on our instance of the + * FirewallD class + */ + (*this.*method)(parameters, result); + /* + * Catch bugs in method implementation. + */ + /* TODO: Assert: no zone is marked as dirty */ + } } } - catch(const std::out_of_range& ex) { - LOG(WARNING) << "Requested DBus method not found in the method table: " << name; - result = DBusError("NotImplemented", "The " + name + " method is currently not implented"); + catch(const FirewallError& ex) { + LOG(WARNING) << "FirewallError caught at DBus method handler"; + result = DBusError(ex); } return;

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

firewalld-recode January 2015