[firewalld-recode] master: Remove the transaction if the commit operation was successful (fe19b51)
by mildew@fedoraproject.org
Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
>---------------------------------------------------------------
commit fe19b51e257e951380db70f164be7da3e1dfbe9e
Author: Daniel Kopecek <dkopecek(a)redhat.com>
Date: Tue Oct 14 16:57:41 2014 +0200
Remove the transaction if the commit operation was successful
>---------------------------------------------------------------
src/Daemon/Firewall/Backend.cpp | 19 +++++++++++++++++++
src/Daemon/Firewall/Backend.hpp | 3 ++-
src/Daemon/Firewall/Transaction.cpp | 10 ++++++++++
src/Daemon/Firewall/Transaction.hpp | 4 ++++
4 files changed, 35 insertions(+), 1 deletions(-)
diff --git a/src/Daemon/Firewall/Backend.cpp b/src/Daemon/Firewall/Backend.cpp
index 1dfb2ad..43dc1ae 100644
--- a/src/Daemon/Firewall/Backend.cpp
+++ b/src/Daemon/Firewall/Backend.cpp
@@ -40,6 +40,7 @@ namespace firewalld
for (size_t i = 0; i < transaction->countOperations(); ++i) {
processOperation(transaction->operation(i));
}
+ removeTransactionUnlocked(transaction->identifier());
} catch(const TransactionError& ex) {
// Undo completed operations
if (ex.rollbackNeeded()) {
@@ -54,6 +55,24 @@ namespace firewalld
return;
}
+ void Backend::removeTransaction(const String& identifier)
+ {
+ std::lock_guard<std::mutex> backend_lock(_backend_mutex);
+ removeTransactionUnlocked(identifier);
+ }
+
+ void Backend::removeTransactionUnlocked(const String& identifier)
+ {
+ size_t i = 0;
+ for (Pointer<const Transaction> member : _transactions) {
+ if (member->identifier() == identifier) {
+ _transactions.erase(_transactions.begin() + i);
+ return;
+ }
+ ++i;
+ }
+ }
+
size_t Backend::countTransactions() const
{
std::lock_guard<std::mutex> backend_lock(_backend_mutex);
diff --git a/src/Daemon/Firewall/Backend.hpp b/src/Daemon/Firewall/Backend.hpp
index 58298e8..97eb0ca 100644
--- a/src/Daemon/Firewall/Backend.hpp
+++ b/src/Daemon/Firewall/Backend.hpp
@@ -33,11 +33,12 @@ namespace firewalld
virtual const UString& identifier() const = 0;
Pointer<Transaction> createTransaction();
void commitTransaction(Pointer<Transaction> transaction);
- void removeTransaction(const UString& identifier);
+ void removeTransaction(const String& identifier);
size_t countTransactions() const;
protected:
virtual void processOperation(const UStringList& op, bool undo = false) = 0;
+ void removeTransactionUnlocked(const String& identifier);
private:
PointerVector<Transaction> _transactions;
diff --git a/src/Daemon/Firewall/Transaction.cpp b/src/Daemon/Firewall/Transaction.cpp
index 1505e69..b9f59f4 100644
--- a/src/Daemon/Firewall/Transaction.cpp
+++ b/src/Daemon/Firewall/Transaction.cpp
@@ -27,6 +27,11 @@ namespace firewalld
_identifier = identifier;
}
+ const String& Transaction::identifier() const
+ {
+ return _identifier;
+ }
+
const UStringList& Transaction::operation(size_t index) const
{
return _operations.at(index);
@@ -51,6 +56,11 @@ namespace firewalld
_operations.erase(_operations.begin() + index);
}
+ bool Transaction::operator==(const Transaction& rhs) const
+ {
+ return (_identifier == rhs._identifier);
+ }
+
TransactionError::TransactionError(Pointer<Transaction> transaction, size_t failed_op_index, const UString& message)
: std::runtime_error("Transaction error")
{
diff --git a/src/Daemon/Firewall/Transaction.hpp b/src/Daemon/Firewall/Transaction.hpp
index 2978039..5b23a48 100644
--- a/src/Daemon/Firewall/Transaction.hpp
+++ b/src/Daemon/Firewall/Transaction.hpp
@@ -31,12 +31,16 @@ namespace firewalld
public:
Transaction(const String& identifier);
+ const String& identifier() const;
+
const UStringList& operation(size_t index) const;
size_t countOperations() const;
size_t appendOperation(const UStringList& op);
void removeOperation(size_t index);
+ bool operator==(const Transaction& rhs) const;
+
private:
String _identifier;
std::vector<UStringList> _operations;
9 years, 7 months
[firewalld-recode] master: Fixed transaction rollback loop (ccd5a8c)
by mildew@fedoraproject.org
Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
>---------------------------------------------------------------
commit ccd5a8cb4b7b560589c5807806991906ffef9033
Author: Daniel Kopecek <dkopecek(a)redhat.com>
Date: Tue Oct 14 16:34:18 2014 +0200
Fixed transaction rollback loop
>---------------------------------------------------------------
src/Daemon/Firewall/Backend.cpp | 5 ++---
1 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/src/Daemon/Firewall/Backend.cpp b/src/Daemon/Firewall/Backend.cpp
index 73287b1..1dfb2ad 100644
--- a/src/Daemon/Firewall/Backend.cpp
+++ b/src/Daemon/Firewall/Backend.cpp
@@ -44,10 +44,9 @@ namespace firewalld
// Undo completed operations
if (ex.rollbackNeeded()) {
size_t i = ex.rollbackFromIndex();
- while (i > 1) {
+ do {
processOperation(transaction->operation(i), /*undo=*/true);
- --i;
- }
+ } while(i-- > 0);
}
throw;
}
9 years, 7 months
[firewalld-recode] master: Added a firewall backend abstraction class implementation (5c8b1fb)
by mildew@fedoraproject.org
Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
>---------------------------------------------------------------
commit 5c8b1fbb1a2e8de694802238708accc85f1599d6
Author: Daniel Kopecek <dkopecek(a)redhat.com>
Date: Tue Oct 14 14:46:37 2014 +0200
Added a firewall backend abstraction class implementation
>---------------------------------------------------------------
src/Daemon/Firewall/Backend.cpp | 64 ++++++++++++++++++++
.../Linux/Sysctl.hpp => Firewall/Backend.hpp} | 35 ++++++-----
2 files changed, 83 insertions(+), 16 deletions(-)
diff --git a/src/Daemon/Firewall/Backend.cpp b/src/Daemon/Firewall/Backend.cpp
new file mode 100644
index 0000000..73287b1
--- /dev/null
+++ b/src/Daemon/Firewall/Backend.cpp
@@ -0,0 +1,64 @@
+//
+// Copyright (C) 2014 Red Hat, Inc.
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; either version 2 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program. If not, see <http://www.gnu.org/licenses/>.
+//
+// Authors: Daniel Kopecek <dkopecek(a)redhat.com>
+//
+#include "Common/Types.hpp"
+#include "Daemon/Firewall/Transaction.hpp"
+#include "Backend.hpp"
+#include <mutex>
+
+namespace firewalld
+{
+
+ Pointer<Transaction> Backend::createTransaction()
+ {
+ std::lock_guard<std::mutex> backend_lock(_backend_mutex);
+ Pointer<Transaction> transaction = makePointer<Transaction>("");
+ _transactions.push_back(transaction);
+ return transaction;
+ }
+
+ void Backend::commitTransaction(Pointer<Transaction> transaction)
+ {
+ std::lock_guard<std::mutex> backend_lock(_backend_mutex);
+
+ try {
+ for (size_t i = 0; i < transaction->countOperations(); ++i) {
+ processOperation(transaction->operation(i));
+ }
+ } catch(const TransactionError& ex) {
+ // Undo completed operations
+ if (ex.rollbackNeeded()) {
+ size_t i = ex.rollbackFromIndex();
+ while (i > 1) {
+ processOperation(transaction->operation(i), /*undo=*/true);
+ --i;
+ }
+ }
+ throw;
+ }
+
+ return;
+ }
+
+ size_t Backend::countTransactions() const
+ {
+ std::lock_guard<std::mutex> backend_lock(_backend_mutex);
+ return _transactions.size();
+ }
+
+} /* namespace firewalld */
diff --git a/src/Daemon/Backends/Linux/Sysctl.hpp b/src/Daemon/Firewall/Backend.hpp
similarity index 56%
copy from src/Daemon/Backends/Linux/Sysctl.hpp
copy to src/Daemon/Firewall/Backend.hpp
index 437be95..58298e8 100644
--- a/src/Daemon/Backends/Linux/Sysctl.hpp
+++ b/src/Daemon/Firewall/Backend.hpp
@@ -16,31 +16,34 @@
//
// Authors: Daniel Kopecek <dkopecek(a)redhat.com>
//
-#ifndef _FIREWALLD_SYSCTL_HPP_
-#define _FIREWALLD_SYSCTL_HPP_
+#ifndef FIREWALLD_FIREWALL_BACKEND_HPP
+#define FIREWALLD_FIREWALL_BACKEND_HPP
#include "Common/Types.hpp"
+#include "Daemon/Firewall/Transaction.hpp"
+
+#include <cstddef>
+#include <mutex>
namespace firewalld
{
-
- class Sysctl
+ class Backend
{
- char _procfs_path[PATH_MAX];
- int _procfs_fd;
- bool _procfs_fd_read_only;
- bool _procfs_fd_close_on_unref;
+ public:
+ virtual const UString& identifier() const = 0;
+ Pointer<Transaction> createTransaction();
+ void commitTransaction(Pointer<Transaction> transaction);
+ void removeTransaction(const UString& identifier);
+ size_t countTransactions() const;
- bool open(bool read_only = true);
- void close(bool force_close = false);
+ protected:
+ virtual void processOperation(const UStringList& op, bool undo = false) = 0;
- public:
- Sysctl(const char *name, bool close_on_unref = false);
- ~Sysctl();
- bool set(const char *value);
- bool get(char *buffer, size_t buflen);
+ private:
+ PointerVector<Transaction> _transactions;
+ mutable std::mutex _backend_mutex;
};
} /* namespace firewalld */
-#endif /* _FIREWALLD_SYSCTL_HPP_ */
+#endif /* FIREWALLD_FIREWALL_BACKEND_HPP */
9 years, 7 months
[firewalld-recode] master: Added Transaction class implementation (8a1e1fe)
by mildew@fedoraproject.org
Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
>---------------------------------------------------------------
commit 8a1e1fed1466f41f7007c161fef5d3d1988ceed5
Author: Daniel Kopecek <dkopecek(a)redhat.com>
Date: Tue Oct 14 14:45:51 2014 +0200
Added Transaction class implementation
>---------------------------------------------------------------
src/Daemon/Firewall/Transaction.cpp | 80 +++++++++++++++++++++++++++++++++++
src/Daemon/Firewall/Transaction.hpp | 60 ++++++++++++++++++++++++++
2 files changed, 140 insertions(+), 0 deletions(-)
diff --git a/src/Daemon/Firewall/Transaction.cpp b/src/Daemon/Firewall/Transaction.cpp
new file mode 100644
index 0000000..1505e69
--- /dev/null
+++ b/src/Daemon/Firewall/Transaction.cpp
@@ -0,0 +1,80 @@
+//
+// Copyright (C) 2014 Red Hat, Inc.
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; either version 2 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program. If not, see <http://www.gnu.org/licenses/>.
+//
+// Authors: Daniel Kopecek <dkopecek(a)redhat.com>
+//
+#include "Transaction.hpp"
+#include <stdexcept>
+
+namespace firewalld
+{
+
+ Transaction::Transaction(const String& identifier)
+ {
+ _identifier = identifier;
+ }
+
+ const UStringList& Transaction::operation(size_t index) const
+ {
+ return _operations.at(index);
+ }
+
+ size_t Transaction::countOperations() const
+ {
+ return _operations.size();
+ }
+
+ size_t Transaction::appendOperation(const UStringList& op)
+ {
+ _operations.push_back(op);
+ return (_operations.size() - 1);
+ }
+
+ void Transaction::removeOperation(size_t index)
+ {
+ if (index > (_operations.size() - 1)) {
+ throw std::out_of_range("removeOperation range check failed");
+ }
+ _operations.erase(_operations.begin() + index);
+ }
+
+ TransactionError::TransactionError(Pointer<Transaction> transaction, size_t failed_op_index, const UString& message)
+ : std::runtime_error("Transaction error")
+ {
+ _transaction = transaction;
+ _failed_op_index = failed_op_index;
+ _message = message;
+ }
+
+ const UString& TransactionError::message() const
+ {
+ return _message;
+ }
+
+ bool TransactionError::rollbackNeeded() const
+ {
+ if (_transaction->countOperations() > 0) {
+ return (_failed_op_index > 0);
+ }
+ return false;
+ }
+
+ size_t TransactionError::rollbackFromIndex() const
+ {
+ return (_failed_op_index > 0 ? _failed_op_index - 1 : 0);
+ }
+
+} /* namespace firewalld */
diff --git a/src/Daemon/Firewall/Transaction.hpp b/src/Daemon/Firewall/Transaction.hpp
new file mode 100644
index 0000000..2978039
--- /dev/null
+++ b/src/Daemon/Firewall/Transaction.hpp
@@ -0,0 +1,60 @@
+//
+// Copyright (C) 2014 Red Hat, Inc.
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; either version 2 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program. If not, see <http://www.gnu.org/licenses/>.
+//
+// Authors: Daniel Kopecek <dkopecek(a)redhat.com>
+//
+#ifndef FIREWALLD_FIREWALL_TRANSACTION_HPP
+#define FIREWALLD_FIREWALL_TRANSACTION_HPP
+
+#include "Common/Types.hpp"
+#include <stdexcept>
+#include <cstddef>
+
+namespace firewalld
+{
+
+ class Transaction
+ {
+ public:
+ Transaction(const String& identifier);
+
+ const UStringList& operation(size_t index) const;
+ size_t countOperations() const;
+
+ size_t appendOperation(const UStringList& op);
+ void removeOperation(size_t index);
+
+ private:
+ String _identifier;
+ std::vector<UStringList> _operations;
+ };
+
+ class TransactionError : public std::runtime_error
+ {
+ public:
+ TransactionError(Pointer<Transaction> transaction, size_t failed_op_index, const UString& message);
+ const UString& message() const;
+ bool rollbackNeeded() const;
+ size_t rollbackFromIndex() const;
+ private:
+ Pointer<Transaction> _transaction;
+ size_t _failed_op_index;
+ UString _message;
+ };
+
+} /* namespace firewalld */
+
+#endif /* FIREWALLD_FIREWALL_TRANSACTION_HPP */
9 years, 7 months
[firewalld-recode] master: Fixed some overly ambiguous error messages (5e09af4)
by mildew@fedoraproject.org
Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
>---------------------------------------------------------------
commit 5e09af418cf00da105e5a0ec86408828d33d8316
Author: Daniel Kopecek <dkopecek(a)redhat.com>
Date: Tue Oct 14 10:54:16 2014 +0200
Fixed some overly ambiguous error messages
>---------------------------------------------------------------
src/Daemon/Firewall/Firewall.cpp | 9 +--------
src/Daemon/Firewall/Zone.cpp | 6 ++++--
2 files changed, 5 insertions(+), 10 deletions(-)
diff --git a/src/Daemon/Firewall/Firewall.cpp b/src/Daemon/Firewall/Firewall.cpp
index cafc834..fa626c1 100644
--- a/src/Daemon/Firewall/Firewall.cpp
+++ b/src/Daemon/Firewall/Firewall.cpp
@@ -147,17 +147,10 @@ namespace firewalld
{
auto zone_ptr = PointerMapOp::findOne(_zone_map, name);
if (zone_ptr == nullptr) {
- throw FirewallError("INVALID_ZONE", "Zone not defined");
+ throw FirewallError("INVALID_ZONE", "Zone \"" + name + "\" not defined");
} else {
return zone_ptr;
}
-#if 0
- auto zone_it = _zone_map.find(name);
- if (zone_it == _zone_map.end()) {
- throw FirewallError("INVALID_ZONE", "Zone not defined");
- }
- return zone_it->second;
-#endif
}
void Firewall::getAllZoneNames(UStringVector& names) const
diff --git a/src/Daemon/Firewall/Zone.cpp b/src/Daemon/Firewall/Zone.cpp
index 2b5fb16..1375e59 100644
--- a/src/Daemon/Firewall/Zone.cpp
+++ b/src/Daemon/Firewall/Zone.cpp
@@ -390,7 +390,8 @@ namespace firewalld
const UString& name = attr.at("name");
Pointer<Service> service = FirewallD::instance()->lookupService(name);
if (service == nullptr) {
- throw FirewallError("INVALID_SERVICE", "Unknown service");
+ throw ConfigurationError(_identifier + ".xml",
+ "Referenced service \"" + name + "\" is not defined");
}
addService(service);
}
@@ -417,7 +418,8 @@ namespace firewalld
const UString& name = attr.at("name");
Pointer<ICMPType> icmptype = FirewallD::instance()->lookupICMPType(name);
if (icmptype == nullptr) {
- throw FirewallError("INVALID_ICMPTYPE", "Unknown ICMP type");
+ throw ConfigurationError(_identifier + ".xml",
+ "Referenced ICMP type \"" + name + "\" is not defined");
}
addICMPBlock(icmptype);
}
9 years, 7 months
[firewalld-recode] master: Implemented XMLWrite method for ICMPType, Service, Zone and LockdownWhitelist objects (13c4a02)
by mildew@fedoraproject.org
Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
>---------------------------------------------------------------
commit 13c4a0288b55be7de5762442f7b7b423ba56e883
Author: Daniel Kopecek <dkopecek(a)redhat.com>
Date: Tue Oct 14 10:51:45 2014 +0200
Implemented XMLWrite method for ICMPType, Service, Zone and LockdownWhitelist objects
>---------------------------------------------------------------
src/Common/XMLStorage.cpp | 8 +++++
src/Common/XMLStorage.hpp | 3 ++
src/Daemon/Firewall/ICMPType.cpp | 11 +++++++
src/Daemon/Firewall/ICMPType.hpp | 1 +
src/Daemon/Firewall/Service.cpp | 21 +++++++++++++
src/Daemon/Firewall/Service.hpp | 1 +
src/Daemon/Firewall/Zone.cpp | 60 ++++++++++++++++++++++++++++++++++++++
src/Daemon/Firewall/Zone.hpp | 1 +
src/Daemon/LockdownWhitelist.cpp | 21 +++++++++++++
src/Daemon/LockdownWhitelist.hpp | 1 +
10 files changed, 128 insertions(+), 0 deletions(-)
diff --git a/src/Common/XMLStorage.cpp b/src/Common/XMLStorage.cpp
index bdc48da..c5d922c 100644
--- a/src/Common/XMLStorage.cpp
+++ b/src/Common/XMLStorage.cpp
@@ -134,4 +134,12 @@ namespace firewalld
return;
}
+ void XMLStorage::store(const String& filepath)
+ {
+ std::ofstream stream(filepath, std::ios_base::trunc);
+ stream << "<?xml version=\"1.0\" encoding=\"utf-8\"?>" << std::endl;
+ XMLWrite(stream);
+ return;
+ }
+
} /* namespace firewalld */
diff --git a/src/Common/XMLStorage.hpp b/src/Common/XMLStorage.hpp
index d6a1693..5f9cbfe 100644
--- a/src/Common/XMLStorage.hpp
+++ b/src/Common/XMLStorage.hpp
@@ -23,6 +23,7 @@
#include <expat.h>
#include <initializer_list>
+#include <fstream>
namespace firewalld
{
@@ -34,6 +35,7 @@ namespace firewalld
virtual void XMLElementStart(const UString& name, const UStringKeyMap<UString>& attr) = 0;
virtual void XMLElementEnd(const UString& name) = 0;
virtual void XMLElementStringValue(const UString& name, const UString& value) = 0;
+ virtual void XMLWrite(std::ofstream& stream) = 0;
static void expatElementStartHandler(void *arg0, const XML_Char* name, const XML_Char** attr);
static void expatElementEndHandler(void *arg0, const XML_Char* name);
@@ -46,6 +48,7 @@ namespace firewalld
bool elementStackState(std::initializer_list<UString> list) const;
void load(const String& filepath);
+ void store(const String& filepath);
private:
UStringList *_element_stack;
diff --git a/src/Daemon/Firewall/ICMPType.cpp b/src/Daemon/Firewall/ICMPType.cpp
index 529f074..4a4e81f 100644
--- a/src/Daemon/Firewall/ICMPType.cpp
+++ b/src/Daemon/Firewall/ICMPType.cpp
@@ -112,4 +112,15 @@ namespace firewalld
}
}
+ void ICMPType::XMLWrite(std::ofstream& stream)
+ {
+ stream << "<icmptype>" << std::endl;
+ stream << "\t<short>" << _name << "</short>" << std::endl;
+ stream << "\t<description>" << _description << "</description>" << std::endl;
+ stream << "\t<destination ipv4=\"" << (_flags.test(Flags::IPv4) ? "true" : "false") << "\"";
+ stream << " ipv6=\"" << (_flags.test(Flags::IPv6) ? " true" : "false") <<"\"/>" << std::endl;
+ stream << "</icmptype>" << std::endl;
+ return;
+ }
+
} /* namespace firewalld*/
diff --git a/src/Daemon/Firewall/ICMPType.hpp b/src/Daemon/Firewall/ICMPType.hpp
index 852d046..1cd8af0 100644
--- a/src/Daemon/Firewall/ICMPType.hpp
+++ b/src/Daemon/Firewall/ICMPType.hpp
@@ -48,6 +48,7 @@ namespace firewalld
void XMLElementStart(const UString& name, const UStringKeyMap<UString>& attr);
void XMLElementEnd(const UString& name);
void XMLElementStringValue(const UString& name, const UString& value);
+ void XMLWrite(std::ofstream& stream);
private:
// Unique identifier of the service.
diff --git a/src/Daemon/Firewall/Service.cpp b/src/Daemon/Firewall/Service.cpp
index 45d6c7f..5a95cfb 100644
--- a/src/Daemon/Firewall/Service.cpp
+++ b/src/Daemon/Firewall/Service.cpp
@@ -139,4 +139,25 @@ namespace firewalld
return;
}
}
+
+ void Service::XMLWrite(std::ofstream& stream)
+ {
+ stream << "<service>" << std::endl;
+ stream << "\t<short>" << _name << "</short>" << std::endl;
+ stream << "\t<description>" << _description << "</description>" << std::endl;
+ for (Pointer<const Port> port : _ports) {
+ stream << "\t<port port=\"" << port->range().toString() << "\"";
+ stream << " protocol=\"" << (port->protocol() == Port::Protocol::TCP ? "tcp" : "udp");
+ stream << "\"/>" << std::endl;
+ }
+ for (Pointer<const KernelModule> module : _modules) {
+ stream << "\t<module name=\"" << module->name() << "\"/>" << std::endl;
+ }
+
+ // TODO: Implement destinations
+ //stream << "<destination ipv4="" ipv6=""/>" << std::endl;
+
+ stream << "</service>" << std::endl;
+ return;
+ }
}
diff --git a/src/Daemon/Firewall/Service.hpp b/src/Daemon/Firewall/Service.hpp
index c50c0f2..82f43b8 100644
--- a/src/Daemon/Firewall/Service.hpp
+++ b/src/Daemon/Firewall/Service.hpp
@@ -48,6 +48,7 @@ namespace firewalld
void XMLElementStart(const UString& name, const UStringKeyMap<UString>& attr);
void XMLElementEnd(const UString& name);
void XMLElementStringValue(const UString& name, const UString& value);
+ void XMLWrite(std::ofstream& stream);
private:
// Unique identifier of the service.
diff --git a/src/Daemon/Firewall/Zone.cpp b/src/Daemon/Firewall/Zone.cpp
index 9c179c1..2b5fb16 100644
--- a/src/Daemon/Firewall/Zone.cpp
+++ b/src/Daemon/Firewall/Zone.cpp
@@ -483,4 +483,64 @@ namespace firewalld
return;
}
+ void Zone::XMLWrite(std::ofstream& stream)
+ {
+ stream << "<zone>" << std::endl;
+ stream << "\t<short>" << _name << "</short>" << std::endl;
+ stream << "\t<description>" << _description << "</description>" << std::endl;
+ // interface
+ for (auto const& map_entry : _interface_map) {
+ const UString& interface_name = map_entry.first;
+ stream << "\t<interface name=\"" << interface_name << "\"/>" << std::endl;
+ }
+ // source
+ for (auto const& map_entry : _source_map) {
+ const UString& address = map_entry.second->identifier();
+ stream << "\t<source address=\"" << address << "\"/>" << std::endl;
+ }
+ // service
+ for (auto const& map_entry : _service_map) {
+ const UString& service_name = map_entry.first;
+ stream << "\t<service name=\"" << service_name << "\"/>" << std::endl;
+ }
+ // port
+ for (auto const& map_entry : _tcp_port_map) {
+ Pointer<const Port> port = map_entry.second;
+ stream << "\t<port port=\"" << port->range().toString() << "\" protocol=\"tcp\"/>" << std::endl;
+ }
+ for (auto const& map_entry : _udp_port_map) {
+ Pointer<const Port> port = map_entry.second;
+ stream << "\t<port port=\"" << port->range().toString() << "\" protocol=\"udp\"/>" << std::endl;
+ }
+ // icmp-block
+ for (auto const& map_entry : _icmp_block_map) {
+ const UString& icmptype = map_entry.first;
+ stream << "\t<icmp-block name=\"" << icmptype << "\"/>" << std::endl;
+ }
+ // masquerade
+ if (_flags.test(Flags::Masquerade)) {
+ stream << "\t<masquerade/>" << std::endl;
+ }
+
+ // forward-port
+ for (auto const& map_entry : _port_forward_map) {
+ Pointer<const PortForward> forward = map_entry.second;
+ stream << "\t<forward-port port=\"" << forward->sourcePort()->range().toString() << "\"";
+ stream << " protocol=\"" << (forward->protocol() == Port::Protocol::TCP ? "tcp" : "udp") << "\"";
+
+ if (forward->sourcePort() != forward->destinationPort()) {
+ stream << " to-port=\"" << forward->destinationPort()->range().toString() << "\"";
+ }
+ if (!forward->destinationAddress().empty()) {
+ stream << " to-addr=\"" << forward->destinationAddress() << "\"";
+ }
+
+ stream << "/>" << std::endl;
+ }
+
+ // rule
+ // TODO: Implement rich rules
+
+ stream << "</zone>" << std::endl;
+ }
}
diff --git a/src/Daemon/Firewall/Zone.hpp b/src/Daemon/Firewall/Zone.hpp
index 410b6b0..3fd0d04 100644
--- a/src/Daemon/Firewall/Zone.hpp
+++ b/src/Daemon/Firewall/Zone.hpp
@@ -113,6 +113,7 @@ namespace firewalld
void XMLElementStart(const UString& name, const UStringKeyMap<UString>& attr);
void XMLElementEnd(const UString& name);
void XMLElementStringValue(const UString& name, const UString& value);
+ void XMLWrite(std::ofstream& stream);
private:
// Unique identifier of the zone.
diff --git a/src/Daemon/LockdownWhitelist.cpp b/src/Daemon/LockdownWhitelist.cpp
index ddbdf30..9dd4ec1 100644
--- a/src/Daemon/LockdownWhitelist.cpp
+++ b/src/Daemon/LockdownWhitelist.cpp
@@ -162,4 +162,25 @@ namespace firewalld
{
}
+ void LockdownWhitelist::XMLWrite(std::ofstream& stream)
+ {
+ stream << "<whitelist>" << std::endl;
+ for (auto const& map_entry : _secontexts) {
+ stream << "\t<selinux context=\"" << map_entry.second << "\"/>" << std::endl;
+ }
+ for (auto const& map_entry : _commands_full) {
+ stream << "\t<command name=\"" << map_entry.second << "\"/>" << std::endl;
+ }
+ for (auto const& list_entry : _commands_partial) {
+ stream << "\t<command name=\"" << list_entry << "\"/>" << std::endl;
+ }
+ for (auto const& map_entry : _usernames) {
+ stream << "\t<user name=\"" << map_entry.second << "\"/>" << std::endl;
+ }
+ for (auto const& map_entry : _uids) {
+ stream << "\t<user id=\"" << numberToString(map_entry.second) << "\"/>" << std::endl;
+ }
+ stream << "</whitelist>" << std::endl;
+ }
+
} /* namespace firewalld */
diff --git a/src/Daemon/LockdownWhitelist.hpp b/src/Daemon/LockdownWhitelist.hpp
index b635331..986fcba 100644
--- a/src/Daemon/LockdownWhitelist.hpp
+++ b/src/Daemon/LockdownWhitelist.hpp
@@ -52,6 +52,7 @@ namespace firewalld
void XMLElementStart(const UString& name, const UStringKeyMap<UString>& attr);
void XMLElementEnd(const UString& name);
void XMLElementStringValue(const UString& name, const UString& value);
+ void XMLWrite(std::ofstream& stream);
private:
template<typename value_type>
9 years, 7 months
[firewalld-recode] master: Allow to specify PID file path on the command-line (1b46b9e)
by mildew@fedoraproject.org
Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
>---------------------------------------------------------------
commit 1b46b9e7b524252f27be9cb0bccfa28d95950adb
Author: Daniel Kopecek <dkopecek(a)redhat.com>
Date: Tue Oct 14 10:48:58 2014 +0200
Allow to specify PID file path on the command-line
>---------------------------------------------------------------
src/Common/Utility.cpp | 10 ++++------
src/Common/Utility.hpp | 2 +-
src/Daemon/CLI.cpp | 10 ++++++++++
src/Daemon/CLI.hpp | 1 +
src/Daemon/main.cpp | 2 +-
5 files changed, 17 insertions(+), 8 deletions(-)
diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp
index 6f323bd..59e89de 100644
--- a/src/Common/Utility.cpp
+++ b/src/Common/Utility.cpp
@@ -73,15 +73,13 @@ namespace firewalld
return;
}
- bool writePID(const char *filepath)
+ bool writePID(const String& filepath)
{
- FILE *fp;
-
- if ((fp = ::fopen(filepath, "w")) == nullptr) {
+ std::ofstream pidstream(filepath, std::ios_base::trunc);
+ if (!pidstream) {
return false;
}
- ::fprintf(fp, "%u\n", (unsigned int)getpid());
- ::fclose(fp);
+ pidstream << numberToString(getpid()) << std::endl;
return true;
}
diff --git a/src/Common/Utility.hpp b/src/Common/Utility.hpp
index 271350a..a748888 100644
--- a/src/Common/Utility.hpp
+++ b/src/Common/Utility.hpp
@@ -33,7 +33,7 @@ namespace firewalld
{
void daemonize(void);
- bool writePID(const char *filepath);
+ bool writePID(const String& filepath);
#if defined(__GNUC__)
# define likely(expr) __builtin_expect(!!(expr), 1)
diff --git a/src/Daemon/CLI.cpp b/src/Daemon/CLI.cpp
index b5bfd45..e56c3ae 100644
--- a/src/Daemon/CLI.cpp
+++ b/src/Daemon/CLI.cpp
@@ -39,6 +39,7 @@ namespace firewalld
debug_level = 0;
debug_gc = false;
config_path = "firewalld.conf";
+ pid_path = "firewalld.pid";
// Define CLI options
add_option_entry("nofork",
@@ -47,6 +48,10 @@ namespace firewalld
add_option_entry("nopid",
"Disable writing pid file and don't check for existing.",
no_pid);
+ add_option_entry("pid",
+ "Write PID to the specified file.",
+ SLOT(*this, &CLIOptionGroup::on_option_arg_string),
+ OptionEntry::FLAG_FILENAME);
add_option_entry("config",
"Load configuration from the specified file.",
SLOT(*this, &CLIOptionGroup::on_option_arg_string),
@@ -94,6 +99,11 @@ namespace firewalld
VLOG(2) << "Using command-line specified configuration file path: " << config_path;
}
+ if (option_name == "--pid") {
+ pid_path = value;
+ VLOG(2) << "Using command-line specified PID file path: " << pid_path;
+ }
+
return true;
}
diff --git a/src/Daemon/CLI.hpp b/src/Daemon/CLI.hpp
index 9dc478e..7ab0f7e 100644
--- a/src/Daemon/CLI.hpp
+++ b/src/Daemon/CLI.hpp
@@ -36,6 +36,7 @@ namespace firewalld
bool debug_gc;
int debug_level;
UString config_path;
+ UString pid_path;
private:
// Add a long option entry associated with a variable
diff --git a/src/Daemon/main.cpp b/src/Daemon/main.cpp
index 28a7d5c..eb41c45 100644
--- a/src/Daemon/main.cpp
+++ b/src/Daemon/main.cpp
@@ -91,7 +91,7 @@ int main(int argc, char *argv[])
}
// Write PID file
if (!option_grp.no_pid) {
- if (!writePID("/tmp/firewalld.pid")) {
+ if (!writePID(option_grp.pid_path)) {
firewalld_exit(EXIT_FAILURE);
}
}
9 years, 7 months
[firewalld-recode] master: Check that at least one zone is defined (6659968)
by mildew@fedoraproject.org
Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
>---------------------------------------------------------------
commit 6659968f29e91263dedc0015d3ccde922c227d29
Author: Daniel Kopecek <dkopecek(a)redhat.com>
Date: Tue Oct 7 14:42:28 2014 +0200
Check that at least one zone is defined
>---------------------------------------------------------------
src/Daemon/FirewallD.cpp | 11 +++++++++--
1 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/src/Daemon/FirewallD.cpp b/src/Daemon/FirewallD.cpp
index b3422ab..db9507d 100644
--- a/src/Daemon/FirewallD.cpp
+++ b/src/Daemon/FirewallD.cpp
@@ -275,12 +275,19 @@ namespace firewalld
{
const UString& default_zone_name = _fw.getDefaultZoneName();
- // 1) Default zone is not empty
+ // 1) Number of defined zones. At least one zone has to be defined
+ // in order to be able to set a default one.
+ if (definedZones().size() < 1) {
+ throw ConfigurationError("firewalld.conf",
+ "No zones defined. Forgot to set DefinitionDirs or StaticDefinitionDirs?");
+ }
+
+ // 2) Default zone is not empty
if (default_zone_name.empty()) {
throw ConfigurationError("firewalld.conf", "Default zone is not set");
}
- // 2) Default zone exists
+ // 3) Default zone exists
if (lookupZone(default_zone_name) == nullptr) {
throw ConfigurationError("firewalld.conf",
"Default zone set to \"" + default_zone_name + "\" but no such zone defined");
9 years, 7 months
[firewalld-recode] master: Fix a typo in configuration error message (c4913a4)
by mildew@fedoraproject.org
Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
>---------------------------------------------------------------
commit c4913a470a837721ce3bea629e7c74acc3a87d21
Author: Daniel Kopecek <dkopecek(a)redhat.com>
Date: Tue Oct 7 14:25:57 2014 +0200
Fix a typo in configuration error message
>---------------------------------------------------------------
src/Daemon/FirewallD.cpp | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/Daemon/FirewallD.cpp b/src/Daemon/FirewallD.cpp
index c5036e4..b3422ab 100644
--- a/src/Daemon/FirewallD.cpp
+++ b/src/Daemon/FirewallD.cpp
@@ -283,7 +283,7 @@ namespace firewalld
// 2) Default zone exists
if (lookupZone(default_zone_name) == nullptr) {
throw ConfigurationError("firewalld.conf",
- "Default zone set to \"" + default_zone_name + "\" but not such zone defined");
+ "Default zone set to \"" + default_zone_name + "\" but no such zone defined");
}
}
9 years, 7 months
[firewalld-recode] master: Finalize the main DBus interface (5e09642)
by mildew@fedoraproject.org
Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
>---------------------------------------------------------------
commit 5e09642617a713543e1d2e5f0c17459478b0365b
Author: Daniel Kopecek <dkopecek(a)redhat.com>
Date: Tue Oct 7 13:23:46 2014 +0200
Finalize the main DBus interface
>---------------------------------------------------------------
src/Daemon/DBus/completeReload.cpp | 2 +-
src/Daemon/DBus/methods.decl | 3 +--
src/Daemon/DBus/reload.cpp | 7 ++++++-
3 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/src/Daemon/DBus/completeReload.cpp b/src/Daemon/DBus/completeReload.cpp
index 52de214..6a719cf 100644
--- a/src/Daemon/DBus/completeReload.cpp
+++ b/src/Daemon/DBus/completeReload.cpp
@@ -24,7 +24,7 @@ namespace firewalld
{
FIREWALLD_DBUS_METHOD(completeReload)
{
- result.setTypeSignature("()");
+ // TODO: Make sure kernel modules are reloaded
// Shutdown DBus and stop the Glib main loop
// This will result in terminating the .run() method
// in the main loop (main.cpp) and a complete reload
diff --git a/src/Daemon/DBus/methods.decl b/src/Daemon/DBus/methods.decl
index 0643775..8a82557 100644
--- a/src/Daemon/DBus/methods.decl
+++ b/src/Daemon/DBus/methods.decl
@@ -1,3 +1,4 @@
+FIREWALLD_DBUS_METHOD(reload);
FIREWALLD_DBUS_METHOD(completeReload);
FIREWALLD_DBUS_METHOD(disablePanicMode);
FIREWALLD_DBUS_METHOD(enablePanicMode);
@@ -6,8 +7,6 @@ FIREWALLD_DBUS_METHOD(listIcmpTypes);
FIREWALLD_DBUS_METHOD(listServices);
FIREWALLD_DBUS_METHOD(queryPanicMode);
FIREWALLD_DBUS_METHOD(setDefaultZone);
-
-FIREWALLD_DBUS_METHOD(reload);
FIREWALLD_DBUS_METHOD(getIcmpTypeSettings);
FIREWALLD_DBUS_METHOD(getServiceSettings);
FIREWALLD_DBUS_METHOD(getZoneSettings);
diff --git a/src/Daemon/DBus/reload.cpp b/src/Daemon/DBus/reload.cpp
index e6fa6d5..eb2d080 100644
--- a/src/Daemon/DBus/reload.cpp
+++ b/src/Daemon/DBus/reload.cpp
@@ -24,6 +24,11 @@ namespace firewalld
{
FIREWALLD_DBUS_METHOD(reload)
{
- result = DBusError("NotImplemented", "The reload method is currently not implemented");
+ // Shutdown DBus and stop the Glib main loop
+ // This will result in terminating the .run() method
+ // in the main loop (main.cpp) and a complete reload
+ // of the FirewallD instance.
+ quit();
+ return;
}
} /* namespace firewalld */
9 years, 7 months