Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
commit 063c8eaca504a65fc1c8a70977beb9368a95d537 Author: Daniel Kopecek dkopecek@redhat.com Date: Wed Aug 20 13:33:50 2014 +0200
Add support for loading configuration from a firewalld.conf file
firewalld.cpp | 78 +++++++++++++++++++- firewalld.hpp | 11 +++- firewalld_cli.cpp | 11 +++ firewalld_cli.hpp | 2 + .../zone/{getIcmpBlocks.cpp => getRichRules.cpp} | 7 +- firewalld_dbus/zone/methods.decl | 3 +- main.cpp | 3 +- 7 files changed, 102 insertions(+), 13 deletions(-)
diff --git a/firewalld.cpp b/firewalld.cpp index 6beade7..9ee6257 100644 --- a/firewalld.cpp +++ b/firewalld.cpp @@ -88,11 +88,81 @@ namespace firewalld _glib_loop->quit(); }
- void FirewallD::loadConfig() + void FirewallD::loadConfiguration(const UString& filepath) { - LOG(TRACE) << "Loading configuration"; - loadServiceDefinitions("./config/services/"); - loadZoneDefinitions("./config/zones/"); + LOG(INFO) << "Loading configuration from " << filepath; + std::ifstream config(filepath); + String config_line; + size_t config_line_num = 0; + + if (!config) { + LOG(ERROR) << "Unable to open the configuration file: " << filepath; + throw std::runtime_error("Unable to open the configuration file"); + } + + while(std::getline(config, config_line)) { + ++config_line_num; + size_t nv_separator = config_line.find_first_of("="); + + if (nv_separator == String::npos) { + continue; + } + + String name = trim(config_line.substr(0, nv_separator)); + String value = config_line.substr(nv_separator + 1); + + if (name[0] == '#') { + continue; + } + + processConfigurationNVPair(name, value, config_line_num); + } + + return; + } + + void FirewallD::processConfigurationNVPair(const String& name, const String& value, size_t line_num) + { + if (name == "DefaultZone") { + // + // Just assign the value here. Sanity checking is + // done after the definitions are loaded. + // + _fw.setDefaultZoneName(value); + return; + } + + if (name == "MinimalMark") { + return; + } + if (name == "CleanupOnExit") { + return; + } + if (name == "Lockdown") { + return; + } + if (name == "IPv6_rpfilter") { + return; + } + + if (name == "StaticDefinitionDirs" || name == "DefinitionDirs") { + tokenizeString(value, _definition_dirs, ":", /*trim_empty=*/true); + return; + } + + LOG(WARNING) << "Unknown name-value pair in configuration file: line " + << line_num << ": " << name << "=" << value; + } + + /** + * Load definitions from the directories specified in the configuration file. + */ + void FirewallD::loadDefinitions() + { + for(auto const& path : _definition_dirs) { + loadServiceDefinitions(path + "/services/"); + loadZoneDefinitions(path + "/zones/"); + } }
void FirewallD::setPanicMode(bool panic_mode) diff --git a/firewalld.hpp b/firewalld.hpp index 58f42c0..ada40cf 100644 --- a/firewalld.hpp +++ b/firewalld.hpp @@ -37,7 +37,8 @@ namespace firewalld FirewallD(); void run(); void quit(); - void loadConfig(); + void loadConfiguration(const UString& filepath); + void loadDefinitions();
bool panicMode() const { return _panic_mode; } void setPanicMode(bool panic_mode); @@ -80,6 +81,11 @@ namespace firewalld */ void loadZoneDefinition(const String& filepath);
+ /** + * Process a name-value pair from the configuration file. + */ + void processConfigurationNVPair(const String& name, const String& value, size_t line_num); + void dbus_method_handle(const UString& name, const DBusParameters& parameters, DBusResultBuilder& result); @@ -104,6 +110,9 @@ namespace firewalld DBus _dbus; Firewall _fw;
+ UString _default_zone; + StringVector _definition_dirs; + // Defined services UStringKeyMap<Service*> _defined_services; UStringKeyMap<Zone*> _defined_zones; diff --git a/firewalld_cli.cpp b/firewalld_cli.cpp index 892d320..85b0c21 100644 --- a/firewalld_cli.cpp +++ b/firewalld_cli.cpp @@ -38,6 +38,7 @@ namespace firewalld no_pid = false; debug_level = 0; debug_gc = false; + config_path = "firewalld.conf";
// Define CLI options add_option_entry("nofork", @@ -54,6 +55,10 @@ namespace firewalld add_option_entry("debug-gc", "Does nothing. This option is here only for backward compatibility.", debug_gc); + add_option_entry("config", + "Load configuration from the specified file.", + SLOT(*this, &CLIOptionGroup::on_option_arg_string), + OptionEntry::FLAG_FILENAME); }
bool CLIOptionGroup::on_option_arg_string(const ustring& option_name, @@ -81,6 +86,12 @@ namespace firewalld } } } + + if (option_name == "--config") { + config_path = value; + LOG(INFO) << "Config file is: " << config_path; + } + return true; }
diff --git a/firewalld_cli.hpp b/firewalld_cli.hpp index c01c29c..c21f906 100644 --- a/firewalld_cli.hpp +++ b/firewalld_cli.hpp @@ -34,6 +34,8 @@ namespace firewalld bool no_pid; bool debug_gc; int debug_level; + UString config_path; + private: // Add a long option entry associated with a variable template<typename T> diff --git a/firewalld_dbus/zone/getIcmpBlocks.cpp b/firewalld_dbus/zone/getRichRules.cpp similarity index 85% copy from firewalld_dbus/zone/getIcmpBlocks.cpp copy to firewalld_dbus/zone/getRichRules.cpp index 453a1cb..6102675 100644 --- a/firewalld_dbus/zone/getIcmpBlocks.cpp +++ b/firewalld_dbus/zone/getRichRules.cpp @@ -22,7 +22,7 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(getIcmpBlocks) + FIREWALLD_DBUS_METHOD(getRichRules) { result.setTypeSignature("(as)");
@@ -31,10 +31,7 @@ namespace firewalld parameters.get(0, zone_name);
try { - Zone* zone = _fw.getZone(zone_name); - UStringVector icmp_types; - zone->getICMPBlocks(icmp_types); - result = icmp_types; + result = UStringVector(); } catch(...) { result = UStringVector(); diff --git a/firewalld_dbus/zone/methods.decl b/firewalld_dbus/zone/methods.decl index 11876a2..aeb520b 100644 --- a/firewalld_dbus/zone/methods.decl +++ b/firewalld_dbus/zone/methods.decl @@ -46,5 +46,4 @@ FIREWALLD_DBUS_METHOD(getForwardPorts); //FIREWALLD_DBUS_METHOD(addRichRule) //FIREWALLD_DBUS_METHOD(removeRichRule) //FIREWALLD_DBUS_METHOD(queryRichRule) -//FIREWALLD_DBUS_METHOD(getRichRules) - +FIREWALLD_DBUS_METHOD(getRichRules); diff --git a/main.cpp b/main.cpp index e028933..5b15dd1 100644 --- a/main.cpp +++ b/main.cpp @@ -103,7 +103,8 @@ int main(int argc, char *argv[])
try { startSignalHandler(&firewalld); - firewalld.loadConfig(); + firewalld.loadConfiguration(option_grp.config_path); + firewalld.loadDefinitions(); firewalld.run(); stopSignalHandler(); } catch(...) {