From: "Brian C. Lane" bcl@redhat.com
NOTE: This depends on firewalld changes and will be held until they are pushed. --- pyanaconda/__init__.py | 4 +- pyanaconda/firewall.py | 80 ---------------------------------- pyanaconda/install.py | 3 +- pyanaconda/kickstart.py | 32 ++++++++++++++ tests/pyanaconda_test/firewall_test.py | 41 ----------------- 5 files changed, 35 insertions(+), 125 deletions(-) delete mode 100644 pyanaconda/firewall.py delete mode 100644 tests/pyanaconda_test/firewall_test.py
diff --git a/pyanaconda/__init__.py b/pyanaconda/__init__.py index 8948fdb..4abca2e 100644 --- a/pyanaconda/__init__.py +++ b/pyanaconda/__init__.py @@ -43,7 +43,7 @@ _ = lambda x: gettext.ldgettext("anaconda", x)
class Anaconda(object): def __init__(self): - import desktop, firewall + import desktop from flags import flags
self._backend = None @@ -53,7 +53,6 @@ class Anaconda(object): self.dir = None self.displayMode = None self.extraModules = [] - self.firewall = firewall.Firewall() self.id = None self._instClass = None self._intf = None @@ -242,4 +241,3 @@ class Anaconda(object): network.disableNMForStorageDevices(self.storage) network.autostartFCoEDevices(self.storage) self.desktop.write() - self.firewall.write() diff --git a/pyanaconda/firewall.py b/pyanaconda/firewall.py deleted file mode 100644 index 5e82cba..0000000 --- a/pyanaconda/firewall.py +++ /dev/null @@ -1,80 +0,0 @@ -# -# firewall.py - firewall install data and installation -# -# Copyright (C) 2004 Red Hat, Inc. All rights reserved. -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# Author(s): Bill Nottingham notting@redhat.com -# Jeremy Katz katzj@redhat.com -# - -import iutil -import os.path -from flags import flags -from constants import * - -import gettext -_ = lambda x: gettext.ldgettext("anaconda", x) - -import logging -log = logging.getLogger("anaconda") - -class Firewall: - def __init__ (self): - self.enabled = 1 - self.trustdevs = [] - self.portlist = [] - self.servicelist = [] - - def getArgList(self): - args = [] - - if not self.enabled: - args.append("--disabled") - return args - - if not "ssh" in self.servicelist and not "22:tcp" in self.portlist: - args += ["--service=ssh"] - - for dev in self.trustdevs: - args = args + [ "--trust=%s" %(dev,) ] - - for port in self.portlist: - args = args + [ "--port=%s" %(port,) ] - - for service in self.servicelist: - args = args + [ "--service=%s" % (service,) ] - - return args - - def write (self): - args = [ "--quiet", "--nostart", "-f" ] + self.getArgList() - - try: - if not os.path.exists("%s/etc/sysconfig/iptables" %(ROOT_PATH,)): - iutil.execWithRedirect("/usr/sbin/lokkit", args, - root=ROOT_PATH, stdout="/dev/null", - stderr="/dev/null") - else: - log.error("would have run %s", args) - except (RuntimeError, OSError) as msg: - log.error ("lokkit run failed: %s", msg) - else: - f = open(ROOT_PATH + - '/etc/sysconfig/system-config-firewall', 'w') - f.write("# system-config-firewall config written out by anaconda\n\n") - for arg in args[3:]: - f.write("%s\n" %(arg,)) - f.close() diff --git a/pyanaconda/install.py b/pyanaconda/install.py index b716364..3192862 100644 --- a/pyanaconda/install.py +++ b/pyanaconda/install.py @@ -58,6 +58,7 @@ def doConfiguration(storage, payload, ksdata, instClass): ksdata.keyboard.execute(storage, ksdata, instClass) ksdata.timezone.execute(storage, ksdata, instClass) ksdata.lang.execute(storage, ksdata, instClass) + ksdata.firewall.execute(storage, ksdata, instClass)
with progress_report(_("Writing network configuration")): writeNetworkConf(storage, ksdata, instClass) @@ -107,7 +108,7 @@ def doInstall(storage, payload, ksdata, instClass): # anaconda requires storage packages in order to make sure the target # system is bootable and configurable, and some other packages in order # to finish setting up the system. - packages = storage.packages + ["authconfig", "system-config-firewall-base"] + packages = storage.packages + ["authconfig", "firewalld"] payload.preInstall(packages=packages, groups=payload.languageGroups(ksdata.lang.lang)) payload.install()
diff --git a/pyanaconda/kickstart.py b/pyanaconda/kickstart.py index 18b04c0..639527c 100644 --- a/pyanaconda/kickstart.py +++ b/pyanaconda/kickstart.py @@ -452,6 +452,37 @@ class Fcoe(commands.fcoe.F13_Fcoe):
return fc
+class Firewall(commands.firewall.F14_Firewall): + def execute(self, storage, ksdata, instClass): + args = [] + # enabled is None is neither --enable or --disable is passed + # default to enabled if nothing has been set. + if self.enabled == False: + args += ["--disabled"] + else: + args += ["--enabled"] + + if not "ssh" in self.services and not "22:tcp" in self.ports: + args += ["--service=ssh"] + + for dev in self.trusts: + args += [ "--trust=%s" % (dev,) ] + + for port in self.ports: + args += [ "--port=%s" % (port,) ] + + for service in self.services: + args += [ "--service=%s" % (service,) ] + + cmd = "/usr/bin/firewall-convert-scfw-config" + if not os.path.exists(ROOT_PATH+cmd): + msg = _("%s is missing. Cannot setup firewall.") % (cmd,) + raise KickstartError(msg) + else: + iutil.execWithRedirect(cmd, args, + stdout="/dev/tty5", stderr="/dev/tty5", + root=ROOT_PATH) + class Firstboot(commands.firstboot.FC3_Firstboot): def execute(self, *args): if not os.path.exists(ROOT_PATH + "/lib/systemd/system/firstboot-graphical.service"): @@ -1385,6 +1416,7 @@ commandMap = { "clearpart": ClearPart, "dmraid": DmRaid, "fcoe": Fcoe, + "firewall": Firewall, "firstboot": Firstboot, "group": Group, "ignoredisk": IgnoreDisk, diff --git a/tests/pyanaconda_test/firewall_test.py b/tests/pyanaconda_test/firewall_test.py deleted file mode 100644 index 19c4554..0000000 --- a/tests/pyanaconda_test/firewall_test.py +++ /dev/null @@ -1,41 +0,0 @@ -import mock - -class FirewallTest(mock.TestCase): - def setUp(self): - self.setupModules(["_isys", "block", "ConfigParser"]) - - self.fs = mock.DiskIO() - - import pyanaconda.firewall - - self.modifiedModule("pyanaconda.firewall") - self.modifiedModule("os.path") - - pyanaconda.firewall.open = self.fs.open - pyanaconda.firewall.log = mock.Mock() - pyanaconda.firewall.iutil = mock.Mock() - pyanaconda.firewall.os = mock.Mock() - pyanaconda.firewall.os.path = mock.Mock() - pyanaconda.firewall.os.path.exists = self.fs.os_path_exists - - def tearDown(self): - self.tearDownModules() - - def default_write_test(self): - import pyanaconda.firewall - fw = pyanaconda.firewall.Firewall() - fw.write() - - self.assertEqual(pyanaconda.firewall.iutil.method_calls, [ - ("execWithRedirect", - ( - "/usr/sbin/lokkit", - [ "--quiet", "--nostart", "-f", "--service=ssh" ] - ), - { - "root": "/mnt/sysimage", - "stdout": "/dev/null", - "stderr": "/dev/null", - } - ) - ])
On Wed, 2012-10-03 at 12:40 -0700, Brian C. Lane wrote:
+class Firewall(commands.firewall.F14_Firewall):
- def execute(self, storage, ksdata, instClass):
args = []
# enabled is None is neither --enable or --disable is passed
^^ typo?
Otherwise this looks good to me.
On Thu, Oct 04, 2012 at 08:52:27AM +0200, Vratislav Podzimek wrote:
On Wed, 2012-10-03 at 12:40 -0700, Brian C. Lane wrote:
+class Firewall(commands.firewall.F14_Firewall):
- def execute(self, storage, ksdata, instClass):
args = []
# enabled is None is neither --enable or --disable is passed
^^ typo?
Otherwise this looks good to me.
Whoops, should be 'if'. Thanks.
anaconda-patches@lists.fedorahosted.org