Sign In
Sign Up
Sign In
Sign Up
Manage this list
×
Keyboard Shortcuts
Thread View
j
: Next unread message
k
: Previous unread message
j a
: Jump to all threads
j l
: Jump to MailingList overview
2024
June
May
April
March
February
January
2023
December
November
October
September
August
July
June
May
April
March
February
January
2022
December
November
October
September
August
July
June
May
April
March
February
January
2021
December
November
October
September
August
July
June
May
April
March
February
January
2020
December
November
October
September
August
July
June
May
April
March
February
January
2019
December
November
October
September
August
July
June
May
April
March
February
January
2018
December
November
October
September
August
July
June
May
April
March
February
January
2017
December
November
October
September
August
July
June
May
April
March
February
January
2016
December
November
October
September
August
July
June
May
April
March
February
January
2015
December
November
October
September
August
July
June
May
April
March
February
January
2014
December
November
October
September
August
July
List overview
Download
firewalld-recode
----- 2024 -----
June 2024
May 2024
April 2024
March 2024
February 2024
January 2024
----- 2023 -----
December 2023
November 2023
October 2023
September 2023
August 2023
July 2023
June 2023
May 2023
April 2023
March 2023
February 2023
January 2023
----- 2022 -----
December 2022
November 2022
October 2022
September 2022
August 2022
July 2022
June 2022
May 2022
April 2022
March 2022
February 2022
January 2022
----- 2021 -----
December 2021
November 2021
October 2021
September 2021
August 2021
July 2021
June 2021
May 2021
April 2021
March 2021
February 2021
January 2021
----- 2020 -----
December 2020
November 2020
October 2020
September 2020
August 2020
July 2020
June 2020
May 2020
April 2020
March 2020
February 2020
January 2020
----- 2019 -----
December 2019
November 2019
October 2019
September 2019
August 2019
July 2019
June 2019
May 2019
April 2019
March 2019
February 2019
January 2019
----- 2018 -----
December 2018
November 2018
October 2018
September 2018
August 2018
July 2018
June 2018
May 2018
April 2018
March 2018
February 2018
January 2018
----- 2017 -----
December 2017
November 2017
October 2017
September 2017
August 2017
July 2017
June 2017
May 2017
April 2017
March 2017
February 2017
January 2017
----- 2016 -----
December 2016
November 2016
October 2016
September 2016
August 2016
July 2016
June 2016
May 2016
April 2016
March 2016
February 2016
January 2016
----- 2015 -----
December 2015
November 2015
October 2015
September 2015
August 2015
July 2015
June 2015
May 2015
April 2015
March 2015
February 2015
January 2015
----- 2014 -----
December 2014
November 2014
October 2014
September 2014
August 2014
July 2014
firewalld-recode@lists.fedorahosted.org
135 discussions
Start a n
N
ew thread
【读】5g85小心翼翼,a最新影院5gvnvw相敬如宾
by gs279671 gs279671
11 Dec '21
11 Dec '21
5g85a最新影院5gvnvw --》点击后面地址进入看午@夜大片:
http://phlaff561.aa345.cc/#fedoraproject1212
--》点击后面地址进入看午@夜视频:
http://phlaff561.aa345.cc/#fedoraproject1212
5g85a最新影院5gvnvw是谁三尺讲台,一生守候;是谁兢兢业业,不辞劳忧;是谁播撒知识,传承文明;是谁灌溉桃李,放飞希望;蜡炬春蚕,不管我们人生的峰峦如何巍峨壮观,奠基的,总是恩师的教诲恩师的箴言。想要实现人生的目标就要抓紧现在,不能在努力的过程中觉得累了就停滞不前。时间是不等人的,而且时间是有限的,不能把事情都拖到明天,今天可做之事,勿候明天。正如托尔斯泰所说“只有一个时间是重要的,那就是现在!它所以重要,就是因为它是我们唯一有所作为的时间。”我们只能活在现在,所以必须珍惜现在的时间,在现在努力,把事情及时完成。【读】5g85小心翼翼,a最新影院5gvnvw相敬如宾这就是真正的幸福——珍惜自己拥有的。5g85a最新影院5gvnvw
1
0
0
0
[firewalld-recode] master: Further teets in test.py, output fixes (006e250)
by Thomas Woerner
28 Jan '15
28 Jan '15
Repository :
http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master >--------------------------------------------------------------- commit 006e250af841c95d9bfb3bccdc110cb575face83 Author: Thomas Woerner <twoerner(a)redhat.com> Date: Wed Jan 28 16:22:31 2015 +0100 Further teets in test.py, output fixes - New tests for getServiceSettings and getIcmpTypeSettings - Reenabled authorizeAll - output changes >--------------------------------------------------------------- libfirewall/src/test.py | 207 +++++++++++++++++++++++++++------------------- 1 files changed, 121 insertions(+), 86 deletions(-) diff --git a/libfirewall/src/test.py b/libfirewall/src/test.py index fe7c8eb..d157b47 100755 --- a/libfirewall/src/test.py +++ b/libfirewall/src/test.py @@ -4,123 +4,155 @@ from gi.repository import firewall fw = firewall.Client() -#fw.authorizeAll() +print("Authorize All") +fw.authorizeAll() +print("\n-------------------------------------------------------------------------------\n") + +#print("Reload") #fw.reload() +#print("Complete Reload") #fw.completeReload() +#print("\n-------------------------------------------------------------------------------\n") + +#print("Runtime To Permanent") #fw.runtimeToPermanent() +#print("\n-------------------------------------------------------------------------------\n") + print("panic mode: %s" % fw.queryPanicMode()) #fw.enablePanicMode() #print(fw.queryPanicMode()) #fw.disablePanicMode() #print(fw.queryPanicMode()) -print("-------------------------------------------------------------------------------\n") -print("default zone: '%s'" % fw.getDefaultZone()) +print("\n-------------------------------------------------------------------------------\n") + +default_zone = fw.getDefaultZone() +print("default zone: '%s'" % default_zone) #fw.setDefaultZone("work") #print(fw.getDefaultZone()) +#fw.setDefaultZone(default_zone) +#print(fw.getDefaultZone()) -print(fw.listServices()) print("-------------------------------------------------------------------------------\n") -settings = fw.getZoneSettings("public") -print(settings) -settings.print_str() +fw.getZoneSettings("public").print_str() + +print("\n-------------------------------------------------------------------------------\n") + +print(fw.listServices()) + +print("\n-------------------------------------------------------------------------------\n") + +fw.getServiceSettings("mdns").print_str() + +fw.getServiceSettings("tftp").print_str() + +print("\n-------------------------------------------------------------------------------\n") print(fw.listIcmpTypes()) -print("-------------------------------------------------------------------------------\n") + +print("\n-------------------------------------------------------------------------------\n") + +fw.getIcmpTypeSettings("source-quench").print_str() + +print("\n-------------------------------------------------------------------------------\n") print(fw.getZones()) -print("-------------------------------------------------------------------------------\n") + +print("\n-------------------------------------------------------------------------------\n") active_zones = fw.getActiveZones() for zone in active_zones: print("%s:" % zone) print(" 'interfaces': %s" % active_zones[zone].getInterfaces()) print(" 'sources': %s" % active_zones[zone].getSources()) -print("-------------------------------------------------------------------------------\n") -#print(fw.getZoneOfInterface("em1")) -#print(fw.getZoneOfSource("192.168.254.253")) +print("\n-------------------------------------------------------------------------------\n") -#print("-------------------------------------------------------------------------------\n") +interface="em1" +print("Zone Of Interface '%s': '%s'" % (interface, fw.getZoneOfInterface(interface))) +source = "192.168.254.253" +print("Zone Of Source '%s': '%s'" % (source, fw.getZoneOfSource(source))) -#zone = "" -#item = "foobar" -#print("add interface '%s' to zone '%s': '%s'" % (item, zone, -# fw.addInterface(zone, item))) +print("\n-------------------------------------------------------------------------------\n") -#zone = "work" -#print("change zone of interface '%s' to zone '%s': '%s'" % (item, zone, -# fw.changeZoneOfInterface(zone, item))) +zone = "" +item = "foobar" +print("add interface '%s' to zone '%s': '%s'" % (item, zone, + fw.addInterface(zone, item))) -#print("is interface '%s' bound to zone '%s'? %s" % (item, zone, -# "yes" if fw.queryInterface(zone, item) else "no")) +zone = "work" +print("change zone of interface '%s' to zone '%s': '%s'" % (item, zone, + fw.changeZoneOfInterface(zone, item))) + +print("is interface '%s' bound to zone '%s'? %s" % (item, zone, + "yes" if fw.queryInterface(zone, item) else "no")) -#print("interfaces in zone '%s': %s" % (zone, fw.getInterfaces(zone))) +print("interfaces in zone '%s': %s" % (zone, fw.getInterfaces(zone))) -#print("remove interface '%s' from zone '%s': '%s'" % (item, zone, -# fw.removeInterface(zone, item))) +print("remove interface '%s' from zone '%s': '%s'" % (item, zone, + fw.removeInterface(zone, item))) -#print("interfaces in zone '%s' %s: " % (zone, fw.getInterfaces(zone))) +print("interfaces in zone '%s' %s: " % (zone, fw.getInterfaces(zone))) -#print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") -#zone = "" -#item = "192.168.254.252" -#print("add source '%s' to zone '%s': '%s'" % (item, zone, -# fw.addSource(zone, item))) +zone = "" +item = "192.168.254.252" +print("add source '%s' to zone '%s': '%s'" % (item, zone, + fw.addSource(zone, item))) -#zone = "work" -#print("change zone of source '%s' to zone '%s': '%s'" % (item, zone, -# fw.changeZoneOfSource(zone, item))) +zone = "work" +print("change zone of source '%s' to zone '%s': '%s'" % (item, zone, + fw.changeZoneOfSource(zone, item))) -#print("is source '%s' bound to zone '%s'? %s" % (item, zone, -# "yes" if fw.querySource(zone, item) else "no")) +print("is source '%s' bound to zone '%s'? %s" % (item, zone, + "yes" if fw.querySource(zone, item) else "no")) -#print("sources in zone '%s': %s" % (zone, fw.getSources(zone))) +print("sources in zone '%s': %s" % (zone, fw.getSources(zone))) -#print("remove source '%s' from zone '%s': '%s'" % (item, zone, -# fw.removeSource(zone, item))) +print("remove source '%s' from zone '%s': '%s'" % (item, zone, + fw.removeSource(zone, item))) -#print("sources in zone '%s' %s: " % (zone, fw.getSources(zone))) +print("sources in zone '%s' %s: " % (zone, fw.getSources(zone))) -#print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") -#zone = "work" -#item = "rule service name=ftp audit limit value='1/m' accept" -#print("add rich rule '%s' to zone '%s': '%s'" % (item, zone, -# fw.addRichRule(zone, item, 0))) +zone = "work" +item = "rule service name=ftp audit limit value='1/m' accept" +print("add rich rule '%s' to zone '%s': '%s'" % (item, zone, + fw.addRichRule(zone, item, 0))) -#print("is rich rule '%s' in zone '%s'? %s\n" % (item, zone, -# "yes" if fw.queryRichRule(zone, item) else "no")) +print("is rich rule '%s' in zone '%s'? %s\n" % (item, zone, + "yes" if fw.queryRichRule(zone, item) else "no")) -#print("rich rules in zone '%s': %s" % (zone, fw.getRichRules(zone))) +print("rich rules in zone '%s': %s" % (zone, fw.getRichRules(zone))) -#print("remove rich rule '%s' from zone '%s': '%s'\n" % (item, zone, -# fw.removeRichRule(zone, item))) +print("remove rich rule '%s' from zone '%s': '%s'\n" % (item, zone, + fw.removeRichRule(zone, item))) -#print("rich rules in zone '%s': %s" % (zone, fw.getRichRules(zone))) +print("rich rules in zone '%s': %s" % (zone, fw.getRichRules(zone))) -#print("-------------------------------------------------------------------------------\n") +print("-------------------------------------------------------------------------------\n") -#zone = "work" -#item = "tftp" -#print("add service '%s' to zone '%s': '%s'\n" % (item, zone, -# fw.addService(zone, item, 0))) +zone = "work" +item = "tftp" +print("add service '%s' to zone '%s': '%s'\n" % (item, zone, + fw.addService(zone, item, 0))) -#print("is service '%s' in zone '%s'? %s\n" % (item, zone, -# "yes" if fw.queryService(zone, item) else "no")) +print("is service '%s' in zone '%s'? %s\n" % (item, zone, + "yes" if fw.queryService(zone, item) else "no")) -#print("services in zone '%s': %s" % (zone, fw.getServices(zone))) +print("services in zone '%s': %s" % (zone, fw.getServices(zone))) -#print("remove service '%s' from zone '%s': '%s'\n" % (item, zone, fw.removeService(zone, item))) +print("remove service '%s' from zone '%s': '%s'\n" % (item, zone, fw.removeService(zone, item))) -#print("services in zone '%s': %s" % (zone, fw.getServices(zone))) +print("services in zone '%s': %s" % (zone, fw.getServices(zone))) -#print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") zone = "work" item = "70" @@ -136,9 +168,9 @@ print("ports in zone '%s': [%s]" % (zone, ", ".join(z.getStr() for z in fw.getP print("remove port '%s' from zone '%s': '%s'" % (item, zone, fw.removePort(zone, item, item2))) -print("ports in zone '%s': [%s]\n" % (zone, ", ".join(z.getStr() for z in fw.getPorts(zone)))) +print("ports in zone '%s': [%s]" % (zone, ", ".join(z.getStr() for z in fw.getPorts(zone)))) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") print("add masquerade zone '%s': '%s'" % (zone, fw.addMasquerade(zone, 0))) @@ -148,10 +180,10 @@ print("is masquerade enabled in zone '%s'? %s" % (zone, print("remove masquerade from zone '%s': '%s'" % (zone, fw.removeMasquerade(zone))) -print("is masquerade enabled in zone '%s'? %s\n" % (zone, +print("is masquerade enabled in zone '%s'? %s" % (zone, "yes" if fw.queryMasquerade(zone) else "no")) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") zone = "work" item = "70" @@ -169,9 +201,9 @@ print("forward ports in zone '%s': [%s]" % (zone, ", ".join(z.getStr() for z in print("remove forward port '%s' from zone '%s': '%s'" % (item, zone, fw.removeForwardPort(zone, item, item2, item3, item4))) -print("forward ports in zone '%s': [%s]\n" % (zone, ", ".join(z.getStr() for z in fw.getForwardPorts(zone)))) +print("forward ports in zone '%s': [%s]" % (zone, ", ".join(z.getStr() for z in fw.getForwardPorts(zone)))) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") zone = "work" item = "time-exceeded" @@ -203,9 +235,9 @@ print("chains in ipv '%s' and table '%s': %s" % (ipv, table, fw.getChains(ipv, t print("remove chain '%s' from ipv '%s' and table '%s'" % (chain, ipv, table)) fw.removeChain(ipv, table, chain) -print("chains in ipv '%s' and table '%s': %s\n" % (ipv, table, fw.getChains(ipv, table))) +print("chains in ipv '%s' and table '%s': %s" % (ipv, table, fw.getChains(ipv, table))) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") ipv = "ipv4" table = "filter" @@ -221,9 +253,9 @@ print("chains in ipv '%s' and table '%s': %s" % (ipv, table, fw.getChains(ipv, t print("remove chain '%s' from ipv '%s' and table '%s'" % (chain, ipv, table)) fw.removeChain(ipv, table, chain) -print("chains in ipv '%s' and table '%s': %s\n" % (ipv, table, fw.getChains(ipv, table))) +print("chains in ipv '%s' and table '%s': %s" % (ipv, table, fw.getChains(ipv, table))) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") ipv = "ipv4" table = "filter" @@ -246,18 +278,18 @@ print("query if rule %s is in ipv '%s', table '%s', chain '%s' and priority %d: print("rules in ipv '%s', table '%s', chain '%s': %s" % (ipv, table, chain, fw.getRules(ipv, table, chain))) -print("all rules: %s\n" % ([ (rule.getIpv(), rule.getTable(), rule.getChain(), rule.getPriority(), rule.getArgs()) for rule in fw.getAllRules()] )) +print("all rules: %s" % ([ (rule.getIpv(), rule.getTable(), rule.getChain(), rule.getPriority(), rule.getArgs()) for rule in fw.getAllRules()] )) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") ipv = "ipv4" args = [ "-A", "INPUT", "-s", "1.2.3.4", "-j", "DROP" ] print("passthrough rule %s to ipv '%s': %s" % (args, ipv, fw.passthrough(ipv, args))) args = [ "-D", "INPUT", "-s", "1.2.3.4", "-j", "DROP" ] -print("passthrough rule %s to ipv '%s': %s\n" % (args, ipv, fw.passthrough(ipv, args))) +print("passthrough rule %s to ipv '%s': %s" % (args, ipv, fw.passthrough(ipv, args))) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") ipv = "ipv4" args = [ "-A", "INPUT", "-s", "1.2.3.4", "-j", "DROP" ] @@ -295,7 +327,7 @@ fw.removeAllPassthroughs() print("get all passthrough rules: %s" % ([ [ p.getIpv(), p.getArgs() ] for p in fw.getAllPassthroughs() ])) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") print("enable lockdown") fw.enableLockdown() @@ -305,9 +337,9 @@ print("query lockdown: %s" % fw.queryLockdown()) print("disable lockdown") fw.disableLockdown() -print("query lockdown: %s\n" % fw.queryLockdown()) +print("query lockdown: %s" % fw.queryLockdown()) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") print("get lockdown whitelist commands: %s" % fw.getLockdownWhitelistCommands()) command = "/usr/bin/foobar" @@ -323,9 +355,9 @@ fw.removeLockdownWhitelistCommand(command) print("query lockdown whitelist command '%s': %s" % (command, fw.queryLockdownWhitelistCommand(command))) -print("get lockdown whitelist commands: %s\n" % fw.getLockdownWhitelistCommands()) +print("get lockdown whitelist commands: %s" % fw.getLockdownWhitelistCommands()) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") print("get lockdown whitelist contexts: %s" % fw.getLockdownWhitelistContexts()) context = "system_u:system_r:MadDaemon_t:s0" @@ -341,9 +373,9 @@ fw.removeLockdownWhitelistContext(context) print("query lockdown whitelist context '%s': %s" % (context, fw.queryLockdownWhitelistContext(context))) -print("get lockdown whitelist contexts: %s\n" % fw.getLockdownWhitelistContexts()) +print("get lockdown whitelist contexts: %s" % fw.getLockdownWhitelistContexts()) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") print("get lockdown whitelist uids: %s" % fw.getLockdownWhitelistUids()) uid = 6666 @@ -359,9 +391,9 @@ fw.removeLockdownWhitelistUid(uid) print("query lockdown whitelist uid '%s': %s" % (uid, fw.queryLockdownWhitelistUid(uid))) -print("get lockdown whitelist uids: %s\n" % fw.getLockdownWhitelistUids()) +print("get lockdown whitelist uids: %s" % fw.getLockdownWhitelistUids()) -print("-------------------------------------------------------------------------------\n") +print("\n-------------------------------------------------------------------------------\n") print("get lockdown whitelist users: %s" % fw.getLockdownWhitelistUsers()) user = "theboss" @@ -377,4 +409,7 @@ fw.removeLockdownWhitelistUser(user) print("query lockdown whitelist user '%s': %s" % (user, fw.queryLockdownWhitelistUser(user))) -print("get lockdown whitelist users: %s\n" % fw.getLockdownWhitelistUsers()) +print("get lockdown whitelist users: %s" % fw.getLockdownWhitelistUsers()) + +print("\n-------------------------------------------------------------------------------\n") +
1
0
0
0
[firewalld-recode] master: New functional fw_client_getServiceSettings and fw_client_getIcmpTypeSettings methods (5aa812a)
by Thomas Woerner
28 Jan '15
28 Jan '15
Repository :
http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master >--------------------------------------------------------------- commit 5aa812a3268164c196d9bbc159cddb346605ab14 Author: Thomas Woerner <twoerner(a)redhat.com> Date: Wed Jan 28 16:21:01 2015 +0100 New functional fw_client_getServiceSettings and fw_client_getIcmpTypeSettings methods >--------------------------------------------------------------- libfirewall/src/fw_client.c | 168 ++++++++++++++++++++++++++++++++++++++++-- libfirewall/src/fw_client.h | 6 +- 2 files changed, 164 insertions(+), 10 deletions(-) diff --git a/libfirewall/src/fw_client.c b/libfirewall/src/fw_client.c index 9878231..8daf3c7 100644 --- a/libfirewall/src/fw_client.c +++ b/libfirewall/src/fw_client.c @@ -696,15 +696,116 @@ fw_client_listServices(FWClient *obj) /** * fw_client_getServiceSettings: * - * Returns: (transfer none) (allow-none) (type FWServiceSettings*) + * Returns: (transfer none) (allow-none) (type FWService*) */ -/* -FWServiceSettings * +FWService * fw_client_getServiceSettings(FWClient *obj, const gchar *service) { + FWClientPrivate *fw = FW_CLIENT_GET_PRIVATE(obj); + GVariant *variant; + FWService *srvc = NULL; + GVariant *item; + gchar *str; + GVariantIter iter; + + variant = _fw_client_proxy_call_sync(fw, fw->proxy, + "getServiceSettings", + g_variant_new("(s)", service)); + + if (fw->error != NULL) { + return srvc; + } + + if (strncmp(g_variant_get_type_string(variant), + "((sssa(ss)asa{ss}))", 19) != 0) + { + return srvc; + } + + /* get sssa(ss)asa{ss} from (sssa(ss)asa{ss}) */ + variant = g_variant_get_child_value(variant, 0); + + srvc = fw_service_new(); + + /* 0: version */ + item = g_variant_get_child_value(variant, 0); + g_variant_get(item, "s", &str); + fw_service_setVersion(srvc, str); + g_variant_unref(item); + + /* 1: short */ + item = g_variant_get_child_value(variant, 1); + g_variant_get(item, "s", &str); + fw_service_setShort(srvc, str); + g_variant_unref(item); + + /* 2: description */ + item = g_variant_get_child_value(variant, 2); + g_variant_get(item, "s", &str); + fw_service_setDescription(srvc, str); + g_variant_unref(item); + + /* 3: ports */ + item = g_variant_get_child_value(variant, 3); + if (g_variant_iter_init(&iter, item)) { + GVariant *element; + + while ((element = g_variant_iter_next_value(&iter)) != NULL) { + FWPort *prt = fw_port_new(); + GVariant *item2=NULL; + + item2 = g_variant_get_child_value(element, 0); + g_variant_get(item2, "s", &str); + fw_port_setPort(prt, g_strdup(str)); + g_variant_unref(item2); + + item2 = g_variant_get_child_value(element, 1); + g_variant_get(item2, "s", &str); + fw_port_setProtocol(prt, g_strdup(str)); + g_variant_unref(item2); + + fw_service_addPort(srvc, prt); + g_variant_unref(element); + } + } + g_variant_unref(item); + + /* 4: modules */ + item = g_variant_get_child_value(variant, 4); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_service_addModule(srvc, g_strdup(str)); + } + } + g_variant_unref(item); + + /* 5: destinations */ + item = g_variant_get_child_value(variant, 5); + if (g_variant_iter_init(&iter, item)) { + GVariant *element; + + while ((element = g_variant_iter_next_value(&iter)) != NULL) { + gchar *key, *value; + GVariant *item2=NULL; + + item2 = g_variant_get_child_value(element, 0); + g_variant_get(item2, "s", &key); + g_variant_unref(item2); + + item2 = g_variant_get_child_value(element, 1); + g_variant_get(item2, "s", &value); + g_variant_unref(item2); + + fw_service_setDestination(srvc, g_strdup(key), g_strdup(value)); + g_variant_unref(element); + } + } + + g_variant_unref(item); + + return srvc; } -*/ /** * fw_client_listIcmpTypes: @@ -723,15 +824,66 @@ fw_client_listIcmpTypes(FWClient *obj) /** * fw_client_getIcmpTypeSettings: * - * Returns: (transfer none) (allow-none) (type FWIcmpTypeSettings*) + * Returns: (transfer none) (allow-none) (type FWIcmpType*) */ -/* -FWIcmpTypeSettings * +FWIcmpType * fw_client_getIcmpTypeSettings(FWClient *obj, const gchar *icmptype) { + FWClientPrivate *fw = FW_CLIENT_GET_PRIVATE(obj); + GVariant *variant; + FWIcmpType *icmp = NULL; + GVariant *item; + gchar *str; + GVariantIter iter; + + variant = _fw_client_proxy_call_sync(fw, fw->proxy, + "getIcmpTypeSettings", + g_variant_new("(s)", icmptype)); + + if (fw->error != NULL) { + return icmp; + } + + if (strncmp(g_variant_get_type_string(variant), "((sssas))", 9) != 0) + { + return icmp; + } + + /* get sssas from (sssas) */ + variant = g_variant_get_child_value(variant, 0); + + icmp = fw_icmptype_new(); + + /* 0: version */ + item = g_variant_get_child_value(variant, 0); + g_variant_get(item, "s", &str); + fw_icmptype_setVersion(icmp, str); + g_variant_unref(item); + + /* 1: short */ + item = g_variant_get_child_value(variant, 1); + g_variant_get(item, "s", &str); + fw_icmptype_setShort(icmp, str); + g_variant_unref(item); + + /* 2: description */ + item = g_variant_get_child_value(variant, 2); + g_variant_get(item, "s", &str); + fw_icmptype_setDescription(icmp, str); + g_variant_unref(item); + + /* 3: destinations */ + item = g_variant_get_child_value(variant, 3); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_icmptype_addDestination(icmp, g_strdup(str)); + } + } + g_variant_unref(item); + + return icmp; } -*/ /* default zone */ diff --git a/libfirewall/src/fw_client.h b/libfirewall/src/fw_client.h index d792415..412771c 100644 --- a/libfirewall/src/fw_client.h +++ b/libfirewall/src/fw_client.h @@ -26,6 +26,8 @@ #include <gio/gio.h> #include "firewall.h" #include "fw_zone.h" +#include "fw_service.h" +#include "fw_icmptype.h" #define FW_CLIENT_TYPE (fw_client_get_type()) #define FW_CLIENT(obj) (G_TYPE_CHECK_INSTANCE_CAST((obj), FW_CLIENT_TYPE, FWClient)) @@ -80,9 +82,9 @@ gboolean fw_client_queryPanicMode(FWClient *obj); FWZone *fw_client_getZoneSettings(FWClient *obj, const gchar *zone); GList *fw_client_listServices(FWClient *obj); -/* FWServiceSettings *fw_client_getServiceSettings(FWClient *obj, const gchar *service); */ +FWService *fw_client_getServiceSettings(FWClient *obj, const gchar *service); GList *fw_client_listIcmpTypes(FWClient *obj); -/* FWIcmpTypeSettings *fw_client_getIcmpTypeSettings(FWClient *obj, const gchar *icmptype); */ +FWIcmpType *fw_client_getIcmpTypeSettings(FWClient *obj, const gchar *icmptype); /* default zone */
1
0
0
0
[firewalld-recode] master: Do not use g_variant_get for iter initialization, unref variants with g_variant_unref (862932d)
by Thomas Woerner
28 Jan '15
28 Jan '15
Repository :
http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master >--------------------------------------------------------------- commit 862932d5e57a8957e96025247d9bde74a646a062 Author: Thomas Woerner <twoerner(a)redhat.com> Date: Wed Jan 28 14:42:56 2015 +0100 Do not use g_variant_get for iter initialization, unref variants with g_variant_unref >--------------------------------------------------------------- libfirewall/src/fw_client.c | 119 ++++++++++++++++++++++++++++++------------- 1 files changed, 83 insertions(+), 36 deletions(-) diff --git a/libfirewall/src/fw_client.c b/libfirewall/src/fw_client.c index 7a9fcf5..9878231 100644 --- a/libfirewall/src/fw_client.c +++ b/libfirewall/src/fw_client.c @@ -366,8 +366,8 @@ _fw_client_proxy_call_sync_get_str_list(FWClientPrivate *fw, const gchar *method_name, GVariant *parameters) { - GVariant *variant; - GVariantIter *iter; + GVariant *variant, *element; + GVariantIter iter; GList *list = NULL; gchar *str; @@ -377,9 +377,20 @@ _fw_client_proxy_call_sync_get_str_list(FWClientPrivate *fw, return list; } - g_variant_get(variant, "(as)", &iter); - while (g_variant_iter_loop(iter, "s", &str)) { - list = g_list_append(list, g_strdup(str)); + if (strncmp(g_variant_get_type_string(variant), "(as)", 4) != 0) + { + return list; + } + + /* get as from (as) */ + variant = g_variant_get_child_value(variant, 0); + + if (g_variant_iter_init(&iter, variant)) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { + g_variant_get(element, "s", &str); + list = g_list_append(list, g_strdup(str)); + g_variant_unref(element); + } } g_variant_unref(variant); @@ -392,8 +403,8 @@ _fw_client_proxy_call_sync_get_gint32_list(FWClientPrivate *fw, const gchar *method_name, GVariant *parameters) { - GVariant *variant; - GVariantIter *iter; + GVariant *variant, *element; + GVariantIter iter; GList *list = NULL; gint32 *i; @@ -403,9 +414,20 @@ _fw_client_proxy_call_sync_get_gint32_list(FWClientPrivate *fw, return list; } - g_variant_get(variant, "(ai)", &iter); - while (g_variant_iter_loop(iter, "i", &i)) { - list = g_list_append(list, i); + if (strncmp(g_variant_get_type_string(variant), "(ai)", 4) != 0) + { + return list; + } + + /* get ai from (ai) */ + variant = g_variant_get_child_value(variant, 0); + + if (g_variant_iter_init(&iter, variant)) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { + g_variant_get(element, "i", &i); + list = g_list_append(list, i); + g_variant_unref(element); + } } g_variant_unref(variant); @@ -502,7 +524,7 @@ fw_client_getZoneSettings(FWClient *obj, GVariant *item; gchar *str; gboolean bool; - GVariantIter *iter; + GVariantIter iter; variant = _fw_client_proxy_call_sync(fw, fw->proxy, "getZoneSettings", @@ -527,16 +549,19 @@ fw_client_getZoneSettings(FWClient *obj, item = g_variant_get_child_value(variant, 0); g_variant_get(item, "s", &str); fw_zone_setVersion(zne, str); + g_variant_unref(item); /* 1: short */ item = g_variant_get_child_value(variant, 1); g_variant_get(item, "s", &str); fw_zone_setShort(zne, str); + g_variant_unref(item); /* 2: description */ item = g_variant_get_child_value(variant, 2); g_variant_get(item, "s", &str); fw_zone_setDescription(zne, str); + g_variant_unref(item); /* 3: unused */ @@ -544,20 +569,23 @@ fw_client_getZoneSettings(FWClient *obj, item = g_variant_get_child_value(variant, 4); g_variant_get(item, "s", &str); fw_zone_setTarget(zne, str); + g_variant_unref(item); /* 5: services */ item = g_variant_get_child_value(variant, 5); - g_variant_get(item, "as", &iter); - while (g_variant_iter_loop(iter, "s", &str)) { - fw_zone_addService(zne, g_strdup(str)); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_zone_addService(zne, g_strdup(str)); + } } + g_variant_unref(item); /* 6: ports */ item = g_variant_get_child_value(variant, 6); - if (g_variant_iter_init(iter, item)) { + if (g_variant_iter_init(&iter, item)) { GVariant *element; - while ((element = g_variant_iter_next_value(iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { FWPort *prt = fw_port_new(); GVariant *item2=NULL; @@ -570,27 +598,32 @@ fw_client_getZoneSettings(FWClient *obj, fw_port_setProtocol(prt, g_strdup(str)); fw_zone_addPort(zne, prt); + g_variant_unref(element); } } + g_variant_unref(item); /* 7: icmp_blocks */ item = g_variant_get_child_value(variant, 7); - g_variant_get(item, "as", &iter); - while (g_variant_iter_loop(iter, "s", &str)) { - fw_zone_addIcmpBlock(zne, g_strdup(str)); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_zone_addIcmpBlock(zne, g_strdup(str)); + } } + g_variant_unref(item); /* 8: masquerade */ item = g_variant_get_child_value(variant, 8); g_variant_get(item, "b", &bool); fw_zone_setMasquerade(zne, bool); + g_variant_unref(item); /* 9: forward_ports */ item = g_variant_get_child_value(variant, 9); - if (g_variant_iter_init(iter, item)) { + if (g_variant_iter_init(&iter, item)) { GVariant *element; - while ((element = g_variant_iter_next_value(iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { FWForwardPort *prt = fw_forward_port_new(); GVariant *item2=NULL; @@ -611,29 +644,37 @@ fw_client_getZoneSettings(FWClient *obj, fw_forward_port_setToAddr(prt, g_strdup(str)); fw_zone_addForwardPort(zne, prt); + g_variant_unref(element); } } + g_variant_unref(item); /* 10: interfaces */ item = g_variant_get_child_value(variant, 10); - g_variant_get(item, "as", &iter); - while (g_variant_iter_loop(iter, "s", &str)) { - fw_zone_addInterface(zne, g_strdup(str)); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_zone_addInterface(zne, g_strdup(str)); + } } + g_variant_unref(item); /* 11: sources */ item = g_variant_get_child_value(variant, 11); - g_variant_get(item, "as", &iter); - while (g_variant_iter_loop(iter, "s", &str)) { - fw_zone_addSource(zne, g_strdup(str)); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_zone_addSource(zne, g_strdup(str)); + } } + g_variant_unref(item); /* 12: rich_rules */ item = g_variant_get_child_value(variant, 12); - g_variant_get(item, "as", &iter); - while (g_variant_iter_loop(iter, "s", &str)) { - fw_zone_addRichRule(zne, g_strdup(str)); + if (g_variant_iter_init(&iter, item)) { + while (g_variant_iter_loop(&iter, "s", &str)) { + fw_zone_addRichRule(zne, g_strdup(str)); + } } + g_variant_unref(item); return zne; } @@ -1233,7 +1274,7 @@ fw_client_getPorts(FWClient *obj, if (g_variant_iter_init(&iter, variant)) { GVariant *element; - while ((element = g_variant_iter_next_value(&iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { gsize length; const gchar **strv = g_variant_get_strv(element, &length); @@ -1244,6 +1285,7 @@ fw_client_getPorts(FWClient *obj, list = g_list_append(list, prt); } g_free(strv); + g_variant_unref(element); } } @@ -1377,7 +1419,7 @@ fw_client_getForwardPorts(FWClient *obj, if (g_variant_iter_init(&iter, variant)) { GVariant *element; - while ((element = g_variant_iter_next_value(&iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { gsize length; const gchar **strv = g_variant_get_strv(element, &length); @@ -1390,6 +1432,7 @@ fw_client_getForwardPorts(FWClient *obj, list = g_list_append(list, prt); } g_free(strv); + g_variant_unref(element); } } @@ -1608,7 +1651,7 @@ fw_client_getRules(FWClient *obj, if (g_variant_iter_init(&iter, child)) { GVariant *element; - while ((element = g_variant_iter_next_value(&iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { GVariant *item; gint32 priority; GVariantIter iter2; @@ -1633,6 +1676,7 @@ fw_client_getRules(FWClient *obj, fw_simplerule_setPriority(rule, priority); fw_simplerule_setArgs(rule, args); list = g_list_append(list, rule); + g_variant_unref(element); } } @@ -1750,7 +1794,7 @@ fw_client_getAllRules(FWClient *obj) if (g_variant_iter_init(&iter, child)) { GVariant *element; - while ((element = g_variant_iter_next_value(&iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { GVariant *item; gchar *ipv, *table, *chain; gint32 priority; @@ -1788,6 +1832,7 @@ fw_client_getAllRules(FWClient *obj) fw_rule_setPriority(rule, priority); fw_rule_setArgs(rule, args); list = g_list_append(list, rule); + g_variant_unref(element); } } @@ -1970,7 +2015,7 @@ fw_client_getPassthroughs(FWClient *obj, if (g_variant_iter_init(&iter, variant)) { GVariant *element; - while ((element = g_variant_iter_next_value(&iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { FWArgs *args = fw_args_new(); gsize length, i; const gchar **strv = g_variant_get_strv(element, &length); @@ -1981,6 +2026,7 @@ fw_client_getPassthroughs(FWClient *obj, g_free(strv); list = g_list_append(list, args); + g_variant_unref(element); } } @@ -2025,7 +2071,7 @@ fw_client_getAllPassthroughs(FWClient *obj) if (g_variant_iter_init(&iter, variant)) { GVariant *element; - while ((element = g_variant_iter_next_value(&iter))) { + while ((element = g_variant_iter_next_value(&iter)) != NULL) { GVariant *item; gchar *ipv; GVariantIter iter2; @@ -2050,6 +2096,7 @@ fw_client_getAllPassthroughs(FWClient *obj) fw_passthrough_setIpv(pthru, ipv); fw_passthrough_setArgs(pthru, args); list = g_list_append(list, pthru); + g_variant_unref(element); } }
1
0
0
0
[firewalld-recode] master: Whitespace changes (f081701)
by Thomas Woerner
28 Jan '15
28 Jan '15
Repository :
http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master >--------------------------------------------------------------- commit f0817014f2fd364298d78271d643736802657ca7 Author: Thomas Woerner <twoerner(a)redhat.com> Date: Wed Jan 28 14:40:09 2015 +0100 Whitespace changes >--------------------------------------------------------------- libfirewall/src/fw_client.c | 39 +++++++++++++++++++-------------------- 1 files changed, 19 insertions(+), 20 deletions(-) diff --git a/libfirewall/src/fw_client.c b/libfirewall/src/fw_client.c index 1e3a673..7a9fcf5 100644 --- a/libfirewall/src/fw_client.c +++ b/libfirewall/src/fw_client.c @@ -117,10 +117,10 @@ _fw_client_reset_error(FWClientPrivate *fw) static void _fw_client_signal_receiver(GDBusProxy *proxy, - gchar *sender_name, - gchar *signal_name, - GVariant *parameters, - gpointer user_data) + gchar *sender_name, + gchar *signal_name, + GVariant *parameters, + gpointer user_data) { /* print received signals */ gchar *str; @@ -233,9 +233,9 @@ fw_client_set_property(GObject *obj, } static void -fw_client_get_property(GObject *obj, - guint property_id, - GValue *value, +fw_client_get_property(GObject *obj, + guint property_id, + GValue *value, GParamSpec *pspec) { FWClientPrivate *fw = FW_CLIENT_GET_PRIVATE(obj); @@ -296,9 +296,9 @@ fw_client_class_init(FWClientClass *fw_client_class) GVariant * _fw_client_proxy_call_sync(FWClientPrivate *fw, - GDBusProxy *proxy, - const gchar *method_name, - GVariant *parameters) + GDBusProxy *proxy, + const gchar *method_name, + GVariant *parameters) { GVariant *result; @@ -320,9 +320,9 @@ _fw_client_proxy_call_sync(FWClientPrivate *fw, const gchar * _fw_client_proxy_call_sync_get_str(FWClientPrivate *fw, - GDBusProxy *proxy, - const gchar *method_name, - GVariant *parameters) + GDBusProxy *proxy, + const gchar *method_name, + GVariant *parameters) { GVariant *variant; gchar *value_str; @@ -362,9 +362,9 @@ _fw_client_proxy_call_sync_get_bool(FWClientPrivate *fw, GList * _fw_client_proxy_call_sync_get_str_list(FWClientPrivate *fw, - GDBusProxy *proxy, - const gchar *method_name, - GVariant *parameters) + GDBusProxy *proxy, + const gchar *method_name, + GVariant *parameters) { GVariant *variant; GVariantIter *iter; @@ -388,9 +388,9 @@ _fw_client_proxy_call_sync_get_str_list(FWClientPrivate *fw, GList * _fw_client_proxy_call_sync_get_gint32_list(FWClientPrivate *fw, - GDBusProxy *proxy, - const gchar *method_name, - GVariant *parameters) + GDBusProxy *proxy, + const gchar *method_name, + GVariant *parameters) { GVariant *variant; GVariantIter *iter; @@ -788,7 +788,6 @@ fw_client_getActiveZones(FWClient *obj) g_variant_unref(entry2); g_variant_get(value2, "as", &iter3); - while (g_variant_iter_loop(iter3, "s", &str)) { list = g_list_append(list, g_strdup(str)); }
1
0
0
0
[firewalld-recode] master: New FWService and FWIcmpType types to handle service and icmptype settings (7a9a5b8)
by Thomas Woerner
28 Jan '15
28 Jan '15
Repository :
http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master >--------------------------------------------------------------- commit 7a9a5b8e491f935bc42b6f8b55002fbc4e750304 Author: Thomas Woerner <twoerner(a)redhat.com> Date: Wed Jan 28 14:51:54 2015 +0100 New FWService and FWIcmpType types to handle service and icmptype settings >--------------------------------------------------------------- libfirewall/src/Makefile | 2 +- libfirewall/src/fw_icmptype.c | 226 +++++++++++++++++++++++++ libfirewall/src/fw_icmptype.h | 64 +++++++ libfirewall/src/fw_service.c | 376 +++++++++++++++++++++++++++++++++++++++++ libfirewall/src/fw_service.h | 76 +++++++++ 5 files changed, 743 insertions(+), 1 deletions(-) diff --git a/libfirewall/src/Makefile b/libfirewall/src/Makefile index 44efaf3..66e89aa 100644 --- a/libfirewall/src/Makefile +++ b/libfirewall/src/Makefile @@ -18,7 +18,7 @@ # along with this program. If not, see <
http://www.gnu.org/licenses/
>. # -SOURCES = fw_client.c fw_zone.c fw_active_zone.c fw_port.c fw_forward_port.c fw_simplerule.c fw_rule.c fw_args.c fw_passthrough.c fw_functions.c +SOURCES = fw_client.c fw_zone.c fw_service.c fw_icmptype.c fw_active_zone.c fw_port.c fw_forward_port.c fw_simplerule.c fw_rule.c fw_args.c fw_passthrough.c fw_functions.c OBJECTS = $(SOURCES:.c=.lo) HEADERS = $(SOURCES:.c=.h) firewall.h diff --git a/libfirewall/src/fw_icmptype.c b/libfirewall/src/fw_icmptype.c new file mode 100644 index 0000000..4f7c466 --- /dev/null +++ b/libfirewall/src/fw_icmptype.c @@ -0,0 +1,226 @@ +/* + * Copyright (C) 2015 Red Hat, Inc. + * + * Authors: + * Thomas Woerner <twoerner(a)redhat.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <
http://www.gnu.org/licenses/
>. + */ + +#include "fw_icmptype.h" +#include <string.h> + +G_DEFINE_TYPE(FWIcmpType, fw_icmptype, G_TYPE_OBJECT); + +#define FW_ICMPTYPE_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE((o), FW_ICMPTYPE_TYPE, FWIcmpTypePrivate)) + +typedef struct { + gchar *version; /* string */ + gchar *short_description; /* string */ + gchar *description; /* string */ + GList *destinations; /* list of strings */ +} FWIcmpTypePrivate; + +FWIcmpType * +fw_icmptype_new() +{ + return g_object_new(FW_ICMPTYPE_TYPE, NULL); +} + +static void +fw_icmptype_init(FWIcmpType *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + /* init vars */ + priv->version = NULL; + priv->short_description = NULL; + priv->description = NULL; + priv->destinations = NULL; +} + +static void +fw_icmptype_finalize(GObject *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + if (priv->version != NULL) { + g_free(priv->version); + } + if (priv->short_description != NULL) { + g_free(priv->short_description); + } + if (priv->description != NULL) { + g_free(priv->description); + } + if (priv->destinations != NULL) { + g_free(priv->destinations); + } + + G_OBJECT_CLASS(fw_icmptype_parent_class)->finalize(obj); +} + +static void +fw_icmptype_class_init(FWIcmpTypeClass *fw_icmptype_class) +{ + GObjectClass *obj_class = G_OBJECT_CLASS(fw_icmptype_class); + + obj_class->finalize = fw_icmptype_finalize; + + g_type_class_add_private(obj_class, sizeof(FWIcmpTypePrivate)); +} + +/* methods */ + +/** + * fw_icmptype_getStr: + * + */ +void +fw_icmptype_print_str(FWIcmpType *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + g_print("( '%s', '%s', '%s', ", + priv->version, priv->short_description, priv->description); + + g_list_print_str(priv->destinations); + + g_print(" )\n"); +} + +/** + * fw_icmptype_getVersion: + * + * Returns: (transfer none) (allow-none) (type gchar*) + */ +gchar * +fw_icmptype_getVersion(FWIcmpType *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + return priv->version; +} + +void +fw_icmptype_setVersion(FWIcmpType *obj, + gchar *version) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + priv->version = version; +} + +/** + * fw_icmptype_getShort: + * + * Returns: (transfer none) (allow-none) (type gchar*) + */ +gchar * +fw_icmptype_getShort(FWIcmpType *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + return priv->short_description; +} + +void +fw_icmptype_setShort(FWIcmpType *obj, + gchar *short_description) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + priv->short_description = short_description; +} + +/** + * fw_icmptype_getDescription: + * + * Returns: (transfer none) (allow-none) (type gchar*) + */ +gchar * +fw_icmptype_getDescription(FWIcmpType *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + return priv->description; +} + +void +fw_icmptype_setDescription(FWIcmpType *obj, + gchar *description) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + priv->description = description; +} + +/** + * fw_icmptype_getDestinations: + * @obj: (type FWIcmpType*): a FWIcmpType instance + * + * Returns: (transfer none) (allow-none) (type GList*) (element-type gchar*) + */ +GList * +fw_icmptype_getDestinations(FWIcmpType *obj) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + return priv->destinations; +} + +/** + * fw_icmptype_setDestinations: + * @obj: (type FWIcmpType*): a FWIcmpType instance + * @destinations: (type GList*) (element-type gchar*) + */ +void +fw_icmptype_setDestinations(FWIcmpType *obj, + GList *destinations) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + priv->destinations = destinations; +} + +void +fw_icmptype_addDestination(FWIcmpType *obj, + gchar *destination) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + priv->destinations = g_list_append(priv->destinations, destination); +} + +void +fw_icmptype_removeDestination(FWIcmpType *obj, + gchar *destination) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + + priv->destinations = g_list_remove(priv->destinations, destination); +} + +gboolean +fw_icmptype_queryDestination(FWIcmpType *obj, + gchar *destination) +{ + FWIcmpTypePrivate *priv = FW_ICMPTYPE_GET_PRIVATE(obj); + GList *list; + + list = g_list_find(priv->destinations, destination); + if (list == NULL) + return FALSE; + return TRUE; +} diff --git a/libfirewall/src/fw_icmptype.h b/libfirewall/src/fw_icmptype.h new file mode 100644 index 0000000..c9b112b --- /dev/null +++ b/libfirewall/src/fw_icmptype.h @@ -0,0 +1,64 @@ +/* + * Copyright (C) 2015 Red Hat, Inc. + * + * Authors: + * Thomas Woerner <twoerner(a)redhat.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <
http://www.gnu.org/licenses/
>. + */ + +#ifndef __FW_ICMPTYPE_H__ +#define __FW_ICMPTYPE_H__ + +#include <glib.h> +#include <glib-object.h> +#include "firewall.h" +#include "fw_functions.h" +#include "fw_port.h" + +#define FW_ICMPTYPE_TYPE (fw_icmptype_get_type()) +#define FW_ICMPTYPE(obj) (G_TYPE_CHECK_INSTANCE_CAST((obj), FW_ICMPTYPE_TYPE, FWIcmpType)) +#define FW_ICMPTYPE_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST((klass), FW_ICMPTYPE_TYPE, FWIcmpTypeClass)) +#define FW_IS_ICMPTYPE(klass) (G_TYPE_CHECK_INSTANCE_CLASS((klass), FW_ICMPTYPE_TYPE, FWIcmpTypeClass)) +#define FW_ICMPTYPE_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS((obj), FW_ICMPTYPE_TYPE, FWIcmpTypeClass)) + +typedef struct { + GObject parent; +} FWIcmpType; + +typedef struct { + GObjectClass parent; +} FWIcmpTypeClass; + +GType fw_icmptype_get_type(void); +FWIcmpType *fw_icmptype_new(void); + +void fw_icmptype_print_str(FWIcmpType *obj); + +gchar *fw_icmptype_getVersion(FWIcmpType *obj); +void fw_icmptype_setVersion(FWIcmpType *obj, gchar *version); + +gchar *fw_icmptype_getShort(FWIcmpType *obj); +void fw_icmptype_setShort(FWIcmpType *obj, gchar *short_description); + +gchar *fw_icmptype_getDescription(FWIcmpType *obj); +void fw_icmptype_setDescription(FWIcmpType *obj, gchar *description); + +GList *fw_icmptype_getDestinations(FWIcmpType *obj); +void fw_icmptype_setDestinations(FWIcmpType *obj, GList *destinations); +void fw_icmptype_addDestination(FWIcmpType *obj, gchar *destination); +void fw_icmptype_removeDestination(FWIcmpType *obj, gchar *destination); +gboolean fw_icmptype_queryDestination(FWIcmpType *obj, gchar *destination); + +#endif /* __FW_ICMPTYPE_H__ */ diff --git a/libfirewall/src/fw_service.c b/libfirewall/src/fw_service.c new file mode 100644 index 0000000..9e2ec19 --- /dev/null +++ b/libfirewall/src/fw_service.c @@ -0,0 +1,376 @@ +/* + * Copyright (C) 2015 Red Hat, Inc. + * + * Authors: + * Thomas Woerner <twoerner(a)redhat.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <
http://www.gnu.org/licenses/
>. + */ + +#include "fw_service.h" +#include <string.h> + +G_DEFINE_TYPE(FWService, fw_service, G_TYPE_OBJECT); + +#define FW_SERVICE_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE((o), FW_SERVICE_TYPE, FWServicePrivate)) + +typedef struct { + gchar *version; /* string */ + gchar *short_description; /* string */ + gchar *description; /* string */ + GList *ports; /* list of FWPort */ + GList *modules; /* list of string */ + GHashTable *destinations; /* hash table of string: string */ +} FWServicePrivate; + +FWService * +fw_service_new() +{ + return g_object_new(FW_SERVICE_TYPE, NULL); +} + +static void +fw_service_init(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + /* init vars */ + priv->version = NULL; + priv->short_description = NULL; + priv->description = NULL; + priv->ports = NULL; + priv->modules = NULL; + priv->destinations = g_hash_table_new(g_str_hash, g_str_equal); +} + +static void +fw_service_finalize(GObject *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + if (priv->version != NULL) { + g_free(priv->version); + } + if (priv->short_description != NULL) { + g_free(priv->short_description); + } + if (priv->description != NULL) { + g_free(priv->description); + } + if (priv->ports != NULL) { + g_free(priv->ports); + } + if (priv->modules != NULL) { + g_free(priv->modules); + } + if (priv->destinations != NULL) { + g_free(priv->destinations); + } + + G_OBJECT_CLASS(fw_service_parent_class)->finalize(obj); +} + +static void +fw_service_class_init(FWServiceClass *fw_service_class) +{ + GObjectClass *obj_class = G_OBJECT_CLASS(fw_service_class); + + obj_class->finalize = fw_service_finalize; + + g_type_class_add_private(obj_class, sizeof(FWServicePrivate)); +} + +/* methods */ + +/** + * fw_service_getStr: + * + */ +void +fw_service_print_str(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + GList *list; + gchar *str; + gint i; + + g_print("( '%s', '%s', '%s', ", + priv->version, priv->short_description, + priv->description); + + g_print("[ "); + for (i=0; i<g_list_length(priv->ports); i++) { + FWPort *prt = g_list_nth_data(priv->ports, i); + gchar *str = fw_port_getStr(prt); + + g_print("%s'%s'", (i>0) ? ", " : "", str); + g_free(str); + } + g_print(" ], "); + + g_list_print_str(priv->modules); + + g_print(", { "); + + list = g_hash_table_get_keys(priv->destinations); + for (i=0; i<g_list_length(list); i++) { + str = (gchar *) g_list_nth_data(list, i); + g_print("%s'%s': '%s'", (i>0) ? ", " : "", str, + (gchar *)g_hash_table_lookup(priv->destinations, str)); + } + + g_print(" }"); + + g_print(" )\n"); +} + +/** + * fw_service_getVersion: + * + * Returns: (transfer none) (allow-none) (type gchar*) + */ +gchar * +fw_service_getVersion(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + return priv->version; +} + +void +fw_service_setVersion(FWService *obj, + gchar *version) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->version = version; +} + +/** + * fw_service_getShort: + * + * Returns: (transfer none) (allow-none) (type gchar*) + */ +gchar * +fw_service_getShort(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + return priv->short_description; +} + +void +fw_service_setShort(FWService *obj, + gchar *short_description) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->short_description = short_description; +} + +/** + * fw_service_getDescription: + * + * Returns: (transfer none) (allow-none) (type gchar*) + */ +gchar * +fw_service_getDescription(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + return priv->description; +} + +void +fw_service_setDescription(FWService *obj, + gchar *description) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->description = description; +} + +/** + * fw_service_getPorts: + * + * Returns: (transfer none) (allow-none) (type GList*) (element-type FWPort*) + */ +GList * +fw_service_getPorts(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + return priv->ports; +} + +/** + * fw_service_setPorts: + * @obj: (type FWService*): a FWService instance + * @ports: (type GList*) (element-type FWPort*) + */ +void +fw_service_setPorts(FWService *obj, + GList *ports) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->ports = ports; +} + +void +fw_service_addPort(FWService *obj, + FWPort *port) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->ports = g_list_append(priv->ports, port); +} + +void +fw_service_removePort(FWService *obj, + FWPort *port) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->ports = g_list_remove(priv->ports, port); +} + +gboolean +fw_service_queryPort(FWService *obj, + FWPort *port) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + GList *list; + + list = g_list_find(priv->ports, port); + if (list == NULL) + return FALSE; + return TRUE; +} + +/** + * fw_service_getModules: + * @obj: (type FWService*): a FWService instance + * + * Returns: (transfer none) (allow-none) (type GList*) (element-type gchar*) + */ +GList * +fw_service_getModules(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + return priv->modules; +} + +/** + * fw_service_setModules: + * @obj: (type FWService*): a FWService instance + * @modules: (type GList*) (element-type gchar*) + */ +void +fw_service_setModules(FWService *obj, + GList *modules) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->modules = modules; +} + +void +fw_service_addModule(FWService *obj, + gchar *module) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->modules = g_list_append(priv->modules, module); +} + +void +fw_service_removeModule(FWService *obj, + gchar *module) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->modules = g_list_remove(priv->modules, module); +} + +gboolean +fw_service_queryModule(FWService *obj, + gchar *module) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + GList *list; + + list = g_list_find(priv->modules, module); + if (list == NULL) + return FALSE; + return TRUE; +} + +/** + * fw_service_getDestinations: + * @obj: (type FWService*): a FWService instance + * + * Returns: (transfer none) (allow-none) (type GHashTable*) (element-type gchar* gchar*) + */ +GHashTable *fw_service_getDestinations(FWService *obj) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + return priv->destinations; +} + +/** + * fw_service_setDestinations: + * @obj: (type FWService*): a FWService instance + * @destinations: (type GHashTable*) (element-type gchar* gchar*) + */ +void fw_service_setDestinations(FWService *obj, + GHashTable *destinations) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + priv->destinations = destinations; +} + +void +fw_service_setDestination(FWService *obj, + gchar *ipv, + gchar *address) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + g_hash_table_replace(priv->destinations, ipv, address); +} + +void +fw_service_removeDestination(FWService *obj, + gchar *ipv) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + + g_hash_table_remove(priv->destinations, ipv); +} + +gboolean +fw_service_queryDestination(FWService *obj, + gchar *ipv, + gchar *address) +{ + FWServicePrivate *priv = FW_SERVICE_GET_PRIVATE(obj); + gchar *value; + + value = g_hash_table_lookup(priv->destinations, ipv); + return (strcmp(value, address) == 0); +} diff --git a/libfirewall/src/fw_service.h b/libfirewall/src/fw_service.h new file mode 100644 index 0000000..a7a07cf --- /dev/null +++ b/libfirewall/src/fw_service.h @@ -0,0 +1,76 @@ +/* + * Copyright (C) 2015 Red Hat, Inc. + * + * Authors: + * Thomas Woerner <twoerner(a)redhat.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <
http://www.gnu.org/licenses/
>. + */ + +#ifndef __FW_SERVICE_H__ +#define __FW_SERVICE_H__ + +#include <glib.h> +#include <glib-object.h> +#include "firewall.h" +#include "fw_functions.h" +#include "fw_port.h" + +#define FW_SERVICE_TYPE (fw_service_get_type()) +#define FW_SERVICE(obj) (G_TYPE_CHECK_INSTANCE_CAST((obj), FW_SERVICE_TYPE, FWService)) +#define FW_SERVICE_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST((klass), FW_SERVICE_TYPE, FWServiceClass)) +#define FW_IS_SERVICE(klass) (G_TYPE_CHECK_INSTANCE_CLASS((klass), FW_SERVICE_TYPE, FWServiceClass)) +#define FW_SERVICE_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS((obj), FW_SERVICE_TYPE, FWServiceClass)) + +typedef struct { + GObject parent; +} FWService; + +typedef struct { + GObjectClass parent; +} FWServiceClass; + +GType fw_service_get_type(void); +FWService *fw_service_new(void); + +void fw_service_print_str(FWService *obj); + +gchar *fw_service_getVersion(FWService *obj); +void fw_service_setVersion(FWService *obj, gchar *version); + +gchar *fw_service_getShort(FWService *obj); +void fw_service_setShort(FWService *obj, gchar *short_description); + +gchar *fw_service_getDescription(FWService *obj); +void fw_service_setDescription(FWService *obj, gchar *description); + +GList *fw_service_getPorts(FWService *obj); +void fw_service_setPorts(FWService *obj, GList *ports); +void fw_service_addPort(FWService *obj, FWPort *port); +void fw_service_removePort(FWService *obj, FWPort *port); +gboolean fw_service_queryPort(FWService *obj, FWPort *port); + +GList *fw_service_getModules(FWService *obj); +void fw_service_setModules(FWService *obj, GList *modules); +void fw_service_addModule(FWService *obj, gchar *module); +void fw_service_removeModule(FWService *obj, gchar *module); +gboolean fw_service_queryModule(FWService *obj, gchar *module); + +GHashTable *fw_service_getDestinations(FWService *obj); +void fw_service_setDestinations(FWService *obj, GHashTable *destinations); +void fw_service_setDestination(FWService *obj, gchar *ipv, gchar *address); +void fw_service_removeDestination(FWService *obj, gchar *ipv); +gboolean fw_service_queryDestination(FWService *obj, gchar *ipv, gchar *address); + +#endif /* __FW_SERVICE_H__ */
1
0
0
0
[firewalld-recode] master: Stub of firewallctl (916e6ed)
by jpopelka@fedoraproject.org
28 Jan '15
28 Jan '15
Repository :
http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master >--------------------------------------------------------------- commit 916e6ed748e010656ccc77db4420e534cb9389d6 Author: Jiri Popelka <jpopelka(a)redhat.com> Date: Wed Jan 28 14:24:39 2015 +0100 Stub of firewallctl Eventually it needs to be moved into separate directory. I've been heavily inspired by nmcli code (GPLv2+). >--------------------------------------------------------------- libfirewall/src/Makefile | 9 +- libfirewall/src/firewallctl.c | 346 +++++++++++++++++++++++++++++++++++++++ libfirewall/src/firewallctl.h | 52 ++++++ libfirewall/src/firewallctl.txt | 71 ++++++++ 4 files changed, 475 insertions(+), 3 deletions(-) diff --git a/libfirewall/src/Makefile b/libfirewall/src/Makefile index fb826dd..44efaf3 100644 --- a/libfirewall/src/Makefile +++ b/libfirewall/src/Makefile @@ -24,7 +24,7 @@ HEADERS = $(SOURCES:.c=.h) firewall.h CC = gcc C_INCLUDES = `pkg-config --cflags gio-2.0` -CFLAGS = $(C_INCLUDES) -g -O -Wall +CFLAGS = $(C_INCLUDES) -g -O -Wall -std=c11 LIBS = `pkg-config --libs gio-2.0` LIBDIR = /usr/lib64 @@ -33,7 +33,7 @@ NSVERSION=0.1 GIR_FILE=$(NAMESPACE)-$(NSVERSION).gir TYPELIB_FILE=$(NAMESPACE)-$(NSVERSION).typelib -all: libfirewall.la $(TYPELIB_FILE) test +all: libfirewall.la $(TYPELIB_FILE) test firewallctl libfirewall.la: $(OBJECTS) libtool link $(CC) $(LIBS) -rpath $(LIBDIR) $(OBJECTS) -o $@ @@ -50,6 +50,9 @@ $(GIR_FILE): $(SOURCES) $(HEADERS) test: test.o libtool link $(CC) $(CFLAGS) $< -o $@ $(LIBS) libfirewall.la +firewallctl: firewallctl.o + libtool link $(CC) $(CFLAGS) $< -o $@ $(LIBS) libfirewall.la + clean: - -rm *.lo *.o libfirewall.la $(TYPELIB_FILE) $(GIR_FILE) test *~ + -rm *.lo *.o libfirewall.la $(TYPELIB_FILE) $(GIR_FILE) test firewallctl *~ -rm -rf .libs diff --git a/libfirewall/src/firewallctl.c b/libfirewall/src/firewallctl.c new file mode 100644 index 0000000..c43c10f --- /dev/null +++ b/libfirewall/src/firewallctl.c @@ -0,0 +1,346 @@ +/* + * Copyright (C) 2015 Red Hat, Inc. + * + * Authors: + * Jiri Popelka <jpopelka(a)redhat.com> + * Jiri Klimes <jklimes(a)redhat.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <
http://www.gnu.org/licenses/
>. + */ + +#include <stdlib.h> +#include <stdio.h> +#include <getopt.h> +#include <assert.h> +#include <string.h> + +#include "firewallctl.h" + +# define FIREWALLCTL_VERSION "0.1" + +#define DDD() printf("%s:%s():%d\n",__FILE__,__func__,__LINE__); +#define DDDd(i) printf("%s:%s():%d -- %s=%d\n",__FILE__,__func__,__LINE__,#i,i); +#define DDDs(s) printf("%s:%s():%d -- %s=%s\n",__FILE__,__func__,__LINE__,#s,s); + +/* Global FwCtl object */ +FwCtl fw_ctl; + +int +matches (const char *cmd, const char *pattern) +{ + size_t len = strlen (cmd); + if (!len || len > strlen (pattern)) + return -1; + return memcmp (pattern, cmd, len); +} + +gboolean +fwc_arg_is_help (const char *arg) +{ + if (!arg) + return FALSE; + if ( matches (arg, "help") == 0 + || (g_str_has_prefix (arg, "-") && matches (arg+1, "help") == 0) + || (g_str_has_prefix (arg, "--") && matches (arg+2, "help") == 0)) { + return TRUE; + } + return FALSE; +} + +static void +usage (const char *prog_name) +{ + g_printerr (_("Usage: %s [OPTIONS] OBJECT { COMMAND | help }\n" + "\n" + "OPTIONS\n" + " -q[uiet] do not print status messages\n" + " -v[ersion] show program version\n" + " -h[elp] print this help\n" + "\n" + "OBJECT\n" + " z[one] zone configuration\n" + " d[irect] Direct configuration\n" + " l[ockdown-whitelist] Lockdown Whitelist\n" + " s[tate] general state/status commands\n" + "\n"), + prog_name); +} + +/* Initialize FwCtl structure - set default values */ +static void +fwc_init (FwCtl *fwc) +{ + fwc->fw = fw_client_new(); +g_print("default zone: '%s'\n", fw_client_getDefaultZone(fwc->fw)); + fwc->return_value = FWC_RESULT_SUCCESS; + fwc->return_text = g_string_new (_("Success")); + fwc->timeout = -1; + fwc->quiet_flag = TRUE; +} + +static void +fwc_cleanup (FwCtl *fwc) +{ + g_string_free (fwc->return_text, TRUE); +} + +static void +usage_zone () +{ + +} + +static gboolean +usage_zone_second_level (const char *cmd) +{ + gboolean ret = TRUE; + + if (matches (cmd, "add") == 0) + g_printerr (_("Usage: firewallctl zone add { ARGUMENTS [{--permanent | --runtime}] [--zone <zone>] | help }\n" + "\n" + "--permanent option can be used to set options permanently.\n" + "These changes are not effective immediately, only after service\n" + "restart/reload or system reboot.\n" + "With --runtime option, a change will only be part of\n" + "runtime configuration, i.e. overloaded with permanent configuration\n" + "after service restart/reload.\n" + "When none of --permanent, --runtime is used, both configuration are changed.\n" + "\n" + "If a timeout is supplied, the rule will be active for the specified amount\n" + "of time and will be removed automatically afterwards.\n" + "timeval is either a number (of seconds) or number followed by one\n" + "of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.\n" + "\n" + "ARGUMENTS := service <service> [--timeout <timeval>]\n" + "\n" + "Add a service in zone. If zone is omitted, default zone will be used.\n" + "\n" + "ARGUMENTS := port ...\n" + "\n" + "TODO\n" + "ARGUMENTS := ... TODO\n" + "\n" + "\n")); + else if (matches (cmd, "remove") == 0) + g_printerr (_("TODO")); + else if (matches (cmd, "query") == 0) + g_printerr (_("TODO")); + else if (matches (cmd, "list") == 0) + g_printerr (_("TODO")); + else if (matches (cmd, "get") == 0) + g_printerr (_("TODO")); + else if (matches (cmd, "set") == 0) + g_printerr (_("TODO")); + else if (matches (cmd, "runtime-to-permanent") == 0) + g_printerr (_("TODO")); + else + ret = FALSE; + return ret; +} + +static FWCResultCode +do_zone_add (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +static FWCResultCode +do_zone_remove (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +static FWCResultCode +do_zone_query (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +static FWCResultCode +do_zone_list_all_zones (FwCtl *fwc) +{ + return fwc->return_value; +} + +static FWCResultCode +do_zone_list (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +static FWCResultCode +do_zone_get (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +static FWCResultCode +do_zone_set (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +/* Entry point function for zone-related commands: 'firewallctl zone ...' */ +FWCResultCode +do_zone (FwCtl *fwc, int argc, char **argv) +{ + /* Exit early on help */ + if (fwc_arg_is_help (*argv)) { + usage_zone (); + return fwc->return_value; + } + if (argc != 0 && fwc_arg_is_help (*(argv+1))) { + if (usage_zone_second_level (*argv)) + return fwc->return_value; + } + + /* Now parse the command line and perform the required operation */ + if (argc == 0) { + fwc->return_value = do_zone_list_all_zones (fwc); + } else { + if (matches (*argv, "add") == 0) { + fwc->return_value = do_zone_add (fwc, argc-1, argv+1); + } else if (matches(*argv, "remove") == 0) { + fwc->return_value = do_zone_remove (fwc, argc-1, argv+1); + } else if (matches(*argv, "query") == 0) { + fwc->return_value = do_zone_query (fwc, argc-1, argv+1); + } else if (matches(*argv, "list") == 0) { + fwc->return_value = do_zone_list (fwc, argc-1, argv+1); + } else if (matches(*argv, "get") == 0) { + fwc->return_value = do_zone_get (fwc, argc-1, argv+1); + } else if (matches(*argv, "set") == 0) { + fwc->return_value = do_zone_set (fwc, argc-1, argv+1); + } else { + usage_zone (); + g_string_printf (fwc->return_text, _("Error: '%s' is not valid 'zone' command."), *argv); + fwc->return_value = FWC_RESULT_ERROR_USER_INPUT; + } + } + + return fwc->return_value; +} + +/* Entry point function for direct-related commands: 'firewallctl direct ...' */ +FWCResultCode +do_direct (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +/* Entry point function for lockdown-whitelist - related commands: 'firewallctl lockdown-whitelist ...' */ +FWCResultCode +do_lockdown (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + +/* Entry point function for state-related commands: 'firewallctl state ...' */ +FWCResultCode +do_state (FwCtl *fwc, int argc, char **argv) +{ + return fwc->return_value; +} + + +static const struct cmd { + const char *cmd; + FWCResultCode (*func) (FwCtl *fwc, int argc, char **argv); +} fwctl_cmds[] = { + { "zone", do_zone }, + { "direct", do_direct }, + { "lockdown-whitelist", do_lockdown }, + { "state", do_state }, + { 0 } +}; + +static FWCResultCode +do_cmd (FwCtl *fwc, const char *argv0, int argc, char **argv) +{ + const struct cmd *c; + + for (c = fwctl_cmds; c->cmd; ++c) { + if (matches (argv0, c->cmd) == 0) + return c->func (fwc, argc-1, argv+1); + } + + g_string_printf (fwc->return_text, _("Error: Object '%s' is unknown, try 'firewallctl help'."), argv0); + fwc->return_value = FWC_RESULT_ERROR_USER_INPUT; + return fwc->return_value; +} + +static int +parse_argv(FwCtl * fwc, int argc, char *argv[]) { + assert(argc >= 0); + assert(argv); + + char *base; + + base = strrchr (argv[0], '/'); + if (base == NULL) + base = argv[0]; + else + base++; + + /* parse options */ + while (argc > 1) { + char *opt = argv[1]; + /* '--' ends options */ + if (strcmp (opt, "--") == 0) { + argc--; argv++; + break; + } + if (opt[0] != '-') + break; + if (opt[1] == '-') + opt++; + if (matches (opt, "-version") == 0) { + g_print (_("firewallctl tool, version %s\n"), FIREWALLCTL_VERSION); + return FWC_RESULT_SUCCESS; + } else if (matches (opt, "-help") == 0) { + usage (base); + return FWC_RESULT_SUCCESS; + } else { + g_string_printf (fwc->return_text, _("Error: Option '%s' is unknown, try 'firewallctl -help'."), opt); + fwc->return_value = FWC_RESULT_ERROR_USER_INPUT; + return fwc->return_value; + } + argc--; + argv++; + } + + if (argc > 1) { + /* Now run the requested command */ + return do_cmd (fwc, argv[1], argc-1, argv+1); + } + + usage (base); + return fwc->return_value; + + return 0; +} + +int +main(int argc, char*argv[]) { + fwc_init (&fw_ctl); + + parse_argv(&fw_ctl, argc, argv); + + /* Print result descripting text */ + if (fw_ctl.return_value != FWC_RESULT_SUCCESS) { + g_printerr ("%s\n", fw_ctl.return_text->str); + } + + fwc_cleanup (&fw_ctl); + return fw_ctl.return_value; +} diff --git a/libfirewall/src/firewallctl.h b/libfirewall/src/firewallctl.h new file mode 100644 index 0000000..dea7ede --- /dev/null +++ b/libfirewall/src/firewallctl.h @@ -0,0 +1,52 @@ +/* + * Copyright (C) 2015 Red Hat, Inc. + * + * Authors: + * Jiri Popelka <jpopelka(a)redhat.com> + * Jiri Klimes <jklimes(a)redhat.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <
http://www.gnu.org/licenses/
>. + */ + +#ifndef FIREWALLCTL_H_ +#define FIREWALLCTL_H_ + +#include <glib.h> +#include "fw_client.h" + + +/* firewallctl exit codes */ +typedef enum { + /* Indicates successful execution */ + FWC_RESULT_SUCCESS = 0, + + /* Unknown / unspecified error */ + FWC_RESULT_ERROR_UNKNOWN = 1, + + /* Wrong invocation of firewallctl */ + FWC_RESULT_ERROR_USER_INPUT = 2, + +} FWCResultCode; + +/* FwCtl - main structure */ +typedef struct _FwCtl { + FWClient *fw; /* Client object */ + int return_value; /* Return code of firewallctl */ + GString *return_text; /* Reason text */ + int timeout; /* Operation timeout */ + gboolean quiet_flag; /* '--quiet' option */ +} FwCtl; + + +#endif diff --git a/libfirewall/src/firewallctl.txt b/libfirewall/src/firewallctl.txt new file mode 100644 index 0000000..d03b9b1 --- /dev/null +++ b/libfirewall/src/firewallctl.txt @@ -0,0 +1,71 @@ +zone + {add | remove | query} + (--timeout & --force valid only with 'add') + service <service> [--permanent | --runtime] [--zone=] [--timeout=] + port <portid[-portid]/protocol> [--permanent | --runtime] [--zone=] [--timeout=] + icmp-block <icmp-type> [--permanent | --runtime] [--zone=] [--timeout=] + forward-port <portid[-portid]/protocol> [--toport=portid[-portid]] [--toaddr=address[/mask]] + [--permanent | --runtime] [--zone=] [--timeout=] + masquerade [--permanent | --runtime] [--zone=] [--timeout=] + rich-rule <'rule'> [--permanent | --runtime] [--zone=] [--timeout=] + interface <interface> [--permanent | --runtime] [--zone=] [--force] + source <source[/mask]> [--permanent | --runtime] [--zone=] [--force] + list + all [{--permanent | --runtime}] [--zone=] + all-zones [{--permanent | --runtime}] + services [{--permanent | --runtime}] [--zone=] + ports [{--permanent | --runtime}] [--zone=] + icmp-blocks [{--permanent | --runtime}] [--zone=] + forward-ports [{--permanent | --runtime}] [--zone=] + rich-rules [{--permanent | --runtime}] [--zone=] + interfaces [{--permanent | --runtime}] [--zone=] + sources [{--permanent | --runtime}] [--zone=] + get + default-zone + active-zones + zone-of-interface <interface> [{--permanent | --runtime}] + zone-of-source <source> [{--permanent | --runtime}] + zones [{--permanent | --runtime}] + services [{--permanent | --runtime}] + icmptypes [{--permanent | --runtime}] + service-details --service= (RHBZ#1184232) + target (permanent only) [--zone=] + set + default-zone <zone> + target (permanent only) --target= [--zone=] + {new | delete } (permanent only) + {zone | service | icmptype} <name> + +direct + {add | remove | query} + chain [--permanent | --runtime] --tool={ipv4 | ipv6 | eb} --table= --chain= + rule [--permanent | --runtime] --tool={ipv4 | ipv6 | eb} --table= --chain= --priority= args + rules [--permanent | --runtime] --tool={ipv4 | ipv6 | eb} --table= --chain= (only with 'remove') + passthrough [--permanent | --runtime] --tool={ipv4 | ipv6 | eb} args + get + all-chains [{--permanent | --runtime}] + chains [{--permanent | --runtime}] --tool={ipv4 | ipv6 | eb} --table= + all-rules [{--permanent | --runtime}] + rules [{--permanent | --runtime}] --tool={ipv4 | ipv6 | eb} --table= --chain= + all-passthroughs [{--permanent | --runtime}] + passthroughs [{--permanent | --runtime}] --tool={ipv4 | ipv6 | eb} + passthrough --tool={ipv4 | ipv6 | eb} args + +lockdown-whitelist + {add | remove | query} + {command | context | uid | user} <value> [--permanent | --runtime] + list + {commands | contexts | uids | users} [{--permanent | --runtime}] + +state + state + reload + complete-reload + panic + {on | off | query} + runtime-to-permanent + +help + +-v/--version +-q/--quiet
1
0
0
0
[firewalld-recode] master: Delete the backend object in Firewall class dtor (ceacd93)
by mildew@fedoraproject.org
21 Jan '15
21 Jan '15
Repository :
http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master >--------------------------------------------------------------- commit ceacd932d177411c33d749ef212a34ea4c3773ff Author: Daniel Kopecek <dkopecek(a)redhat.com> Date: Wed Jan 21 13:23:17 2015 +0100 Delete the backend object in Firewall class dtor >--------------------------------------------------------------- src/Daemon/Firewall/Firewall.cpp | 10 ++++++++-- src/Daemon/Firewall/Firewall.hpp | 1 + 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/src/Daemon/Firewall/Firewall.cpp b/src/Daemon/Firewall/Firewall.cpp index 5832560..57aa184 100644 --- a/src/Daemon/Firewall/Firewall.cpp +++ b/src/Daemon/Firewall/Firewall.cpp @@ -31,6 +31,13 @@ namespace firewalld _backend = new LinuxXTables(); } + Firewall::~Firewall() + { + if (_backend != nullptr) { + delete _backend; + } + } + bool Firewall::directIPv4getTables(StringVector& tables) { tables = _ip4tables.listTables(); @@ -296,9 +303,8 @@ namespace firewalld Backend& Firewall::backend() { if (_backend == nullptr) { - LOG(FATAL) << "BUG: Firewall backend not set!"; + throw std::runtime_error("BUG: Firewall backend not set! Cannot return a reference to it."); } - return *_backend; } diff --git a/src/Daemon/Firewall/Firewall.hpp b/src/Daemon/Firewall/Firewall.hpp index 8d0d742..425540f 100644 --- a/src/Daemon/Firewall/Firewall.hpp +++ b/src/Daemon/Firewall/Firewall.hpp @@ -40,6 +40,7 @@ namespace firewalld { public: Firewall(); + ~Firewall(); // Direct interface bool directIPv4getTables(StringVector& tables);
1
0
0
0
[firewalld-recode] master: Added implementation of the DBus policies interface (724a69b)
by mildew@fedoraproject.org
21 Jan '15
21 Jan '15
Repository :
http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master >--------------------------------------------------------------- commit 724a69b175b711117b855e94b0851d1dff8eb5ea Author: Daniel Kopecek <dkopecek(a)redhat.com> Date: Wed Jan 21 13:21:54 2015 +0100 Added implementation of the DBus policies interface >--------------------------------------------------------------- Makefile.am | 25 +++++- .../addLockdownWhitelistCommand.cpp} | 21 ++--- .../addLockdownWhitelistContext.cpp} | 21 ++--- .../addLockdownWhitelistUid.cpp} | 21 ++--- .../addLockdownWhitelistUser.cpp} | 21 ++--- .../disableLockdown.cpp} | 16 +-- .../enableLockdown.cpp} | 16 +-- .../getLockdownWhitelistCommands.cpp} | 15 +-- .../getLockdownWhitelistContexts.cpp} | 15 +-- .../getLockdownWhitelistUids.cpp} | 20 ++-- .../getLockdownWhitelistUsers.cpp} | 15 +-- src/Daemon/DBus/policies/methods.decl | 23 +++++ .../queryLockdown.cpp} | 11 ++- .../queryLockdownWhitelistCommand.cpp} | 15 +-- .../queryLockdownWhitelistContext.cpp} | 15 +-- .../queryLockdownWhitelistUid.cpp} | 16 +-- .../queryLockdownWhitelistUser.cpp} | 15 +-- .../removeLockdownWhitelistCommand.cpp} | 19 ++-- .../removeLockdownWhitelistContext.cpp} | 19 ++-- .../removeLockdownWhitelistUid.cpp} | 20 ++-- .../removeLockdownWhitelistUser.cpp} | 19 ++-- src/Daemon/FirewallD.cpp | 21 ++++- src/Daemon/FirewallD.hpp | 8 +- src/Daemon/LockdownWhitelist.cpp | 103 +++++++++++++++++--- src/Daemon/LockdownWhitelist.hpp | 60 ++++++++++-- 25 files changed, 337 insertions(+), 233 deletions(-) diff --git a/Makefile.am b/Makefile.am index 631cd70..ac15f15 100644 --- a/Makefile.am +++ b/Makefile.am @@ -28,7 +28,8 @@ noinst_LTLIBRARIES =\ librichrules.la \ libdbus_main.la \ libdbus_zone.la \ - libdbus_direct.la + libdbus_direct.la \ + libdbus_policies.la sbin_PROGRAMS=\ firewalld @@ -192,6 +193,27 @@ libdbus_zone_la_LIBADD=\ $(top_builddir)/librichrules.la \ $(top_builddir)/libfirewall.la +libdbus_policies_la_SOURCES=\ + src/Daemon/DBus/policies/addLockdownWhitelistCommand.cpp \ + src/Daemon/DBus/policies/addLockdownWhitelistContext.cpp \ + src/Daemon/DBus/policies/addLockdownWhitelistUid.cpp \ + src/Daemon/DBus/policies/addLockdownWhitelistUser.cpp \ + src/Daemon/DBus/policies/disableLockdown.cpp \ + src/Daemon/DBus/policies/enableLockdown.cpp \ + src/Daemon/DBus/policies/getLockdownWhitelistCommands.cpp \ + src/Daemon/DBus/policies/getLockdownWhitelistContexts.cpp \ + src/Daemon/DBus/policies/getLockdownWhitelistUids.cpp \ + src/Daemon/DBus/policies/getLockdownWhitelistUsers.cpp \ + src/Daemon/DBus/policies/queryLockdown.cpp \ + src/Daemon/DBus/policies/queryLockdownWhitelistCommand.cpp \ + src/Daemon/DBus/policies/queryLockdownWhitelistContext.cpp \ + src/Daemon/DBus/policies/queryLockdownWhitelistUid.cpp \ + src/Daemon/DBus/policies/queryLockdownWhitelistUser.cpp \ + src/Daemon/DBus/policies/removeLockdownWhitelistCommand.cpp \ + src/Daemon/DBus/policies/removeLockdownWhitelistContext.cpp \ + src/Daemon/DBus/policies/removeLockdownWhitelistUid.cpp \ + src/Daemon/DBus/policies/removeLockdownWhitelistUser.cpp + firewalld_SOURCES=\ src/Daemon/Exceptions.hpp \ src/Daemon/CLI.cpp \ @@ -217,5 +239,6 @@ firewalld_LDADD=\ $(top_builddir)/libdbus_main.la \ $(top_builddir)/libdbus_zone.la \ $(top_builddir)/libdbus_direct.la \ + $(top_builddir)/libdbus_policies.la \ @pthread_LIBS@ \ @giomm_LIBS@ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/addLockdownWhitelistCommand.cpp similarity index 70% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/addLockdownWhitelistCommand.cpp index 3f87d05..a325396 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/addLockdownWhitelistCommand.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistCommand) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString command; + parameters.get(0, command); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); - } - catch(const FirewallError& ex) { + _lockdown_whitelist.addCommand(command); + _dbus.broadcastSignal("LockdownWhitelistCommandAdded", DBUS_INTERFACE_POLICIES, parameters); + } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/addLockdownWhitelistContext.cpp similarity index 70% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/addLockdownWhitelistContext.cpp index 3f87d05..0e3a17c 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/addLockdownWhitelistContext.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistContext) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString context; + parameters.get(0, context); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); - } - catch(const FirewallError& ex) { + _lockdown_whitelist.addSEContext(context); + _dbus.broadcastSignal("LockdownWhitelistContextAdded", DBUS_INTERFACE_POLICIES, parameters); + } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/disablePanicMode.cpp b/src/Daemon/DBus/policies/addLockdownWhitelistUid.cpp similarity index 73% copy from src/Daemon/DBus/disablePanicMode.cpp copy to src/Daemon/DBus/policies/addLockdownWhitelistUid.cpp index d001ae8..8738c94 100644 --- a/src/Daemon/DBus/disablePanicMode.cpp +++ b/src/Daemon/DBus/policies/addLockdownWhitelistUid.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,20 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,,disablePanicMode) + FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistUid) { result.setTypeSignature("()"); - - if (panicMode()) { - try { - setPanicMode(false); - } catch(...) { - result = DBusError("COMMAND_FAILED", "Unable to disable panic mode"); - } - } else { - result = DBusError("NOT_ENABLED", "Panic mode not enabled"); + gint uid_integer; + parameters.get(0, uid_integer); + uid_t uid = (uid_t)uid_integer; + try { + _lockdown_whitelist.addUID(uid); + } catch(const FirewallError& ex) { + result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/addLockdownWhitelistUser.cpp similarity index 71% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/addLockdownWhitelistUser.cpp index 3f87d05..dda4c18 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/addLockdownWhitelistUser.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistUser) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString username; + parameters.get(0, username); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); - } - catch(const FirewallError& ex) { + _lockdown_whitelist.addUsername(username); + _dbus.broadcastSignal("LockdownWhitelistUserAdded", DBUS_INTERFACE_POLICIES, parameters); + } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/disableLockdown.cpp similarity index 76% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/disableLockdown.cpp index 89b4cef..f89e026 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/disableLockdown.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,16 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,disableLockdown) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("()"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + setLockdownMode(/*enable=*/false); + _dbus.broadcastSignal("LockdownDisabled", DBUS_INTERFACE_POLICIES, parameters); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/enableLockdown.cpp similarity index 76% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/enableLockdown.cpp index 89b4cef..0318c97 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/enableLockdown.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,16 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,enableLockdown) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("()"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + setLockdownMode(/*enable=*/true); + _dbus.broadcastSignal("LockdownEnabled", DBUS_INTERFACE_POLICIES, parameters); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/getLockdownWhitelistCommands.cpp similarity index 77% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/getLockdownWhitelistCommands.cpp index 89b4cef..7f21efa 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/getLockdownWhitelistCommands.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,15 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistCommands) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("(as)"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + result = _lockdown_whitelist.getCommands(); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/getLockdownWhitelistContexts.cpp similarity index 77% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/getLockdownWhitelistContexts.cpp index 89b4cef..65cb460 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/getLockdownWhitelistContexts.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,15 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistContexts) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("(as)"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + result = _lockdown_whitelist.getSEContexts(); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/getLockdownWhitelistUids.cpp similarity index 72% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/getLockdownWhitelistUids.cpp index 3f87d05..51300ce 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/getLockdownWhitelistUids.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,20 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistUids) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("(ai)"); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); + std::vector<uid_t> uid_vector = _lockdown_whitelist.getUIDs(); + std::vector<gint> uid_integers; + for (auto const& uid : uid_vector) { + uid_integers.push_back((gint)uid); + } + result = uid_integers; } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/getLockdownWhitelistUsers.cpp similarity index 76% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/getLockdownWhitelistUsers.cpp index 89b4cef..608a9f4 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/getLockdownWhitelistUsers.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,15 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistUsers) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("(as)"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + result = _lockdown_whitelist.getUsernames(); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/policies/methods.decl b/src/Daemon/DBus/policies/methods.decl index e69de29..0a6690e 100644 --- a/src/Daemon/DBus/policies/methods.decl +++ b/src/Daemon/DBus/policies/methods.decl @@ -0,0 +1,23 @@ +FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistCommand); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistCommand); +FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistCommands); +FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistCommand); + +FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistContext); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistContext); +FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistContexts); +FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistContext); + +FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistUser); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistUser); +FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistUsers); +FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistUser); + +FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistUid); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistUid); +FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistUids); +FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistUid); + +FIREWALLD_DBUS_METHOD(1,policies,enableLockdown); +FIREWALLD_DBUS_METHOD(1,policies,disableLockdown); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdown); diff --git a/src/Daemon/DBus/queryPanicMode.cpp b/src/Daemon/DBus/policies/queryLockdown.cpp similarity index 81% copy from src/Daemon/DBus/queryPanicMode.cpp copy to src/Daemon/DBus/policies/queryLockdown.cpp index a4b632a..49ac76b 100644 --- a/src/Daemon/DBus/queryPanicMode.cpp +++ b/src/Daemon/DBus/policies/queryLockdown.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,10 +22,15 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,,queryPanicMode) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdown) { result.setTypeSignature("(b)"); - result = panicMode(); + try { + result = lockdownMode(); + } + catch(const FirewallError& ex) { + result = DBusError(ex); + } return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/queryLockdownWhitelistCommand.cpp similarity index 77% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/queryLockdownWhitelistCommand.cpp index 9137ba4..9b73e6b 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/queryLockdownWhitelistCommand.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistCommand) { result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + UString command; + parameters.get(0, command); try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + result = _lockdown_whitelist.commandInList(command); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/queryLockdownWhitelistContext.cpp similarity index 77% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/queryLockdownWhitelistContext.cpp index 9137ba4..24513e9 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/queryLockdownWhitelistContext.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistContext) { result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + UString context; + parameters.get(0, context); try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + result = _lockdown_whitelist.SEContextInList(context); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/queryLockdownWhitelistUid.cpp similarity index 77% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/queryLockdownWhitelistUid.cpp index 9137ba4..6a739e9 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/queryLockdownWhitelistUid.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,18 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistUid) { result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + gint uid_integer; + parameters.get(0, uid_integer); + uid_t uid = (uid_t)uid_integer; try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + result = _lockdown_whitelist.UIDInList(uid); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/queryLockdownWhitelistUser.cpp similarity index 77% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/queryLockdownWhitelistUser.cpp index 9137ba4..36bd4fa 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/queryLockdownWhitelistUser.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistUser) { result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + UString username; + parameters.get(0, username); try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + result = _lockdown_whitelist.UsernameInList(username); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/removeLockdownWhitelistCommand.cpp similarity index 73% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/removeLockdownWhitelistCommand.cpp index 3f87d05..8753fe5 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/removeLockdownWhitelistCommand.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,19 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistCommand) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString command; + parameters.get(0, command); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); + if (_lockdown_whitelist.removeCommand(command)) { + _dbus.broadcastSignal("LockdownWhitelistCommandRemoved", DBUS_INTERFACE_POLICIES, parameters); + } } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/removeLockdownWhitelistContext.cpp similarity index 72% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/removeLockdownWhitelistContext.cpp index 9137ba4..9b76ae2 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/removeLockdownWhitelistContext.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,19 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistContext) { - result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + result.setTypeSignature("()"); + UString context; + parameters.get(0, context); try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + if (_lockdown_whitelist.removeSEContext(context)) { + _dbus.broadcastSignal("LockdownWhitelistContextRemoved", DBUS_INTERFACE_POLICIES, parameters); + } } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/removeLockdownWhitelistUid.cpp similarity index 71% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/removeLockdownWhitelistUid.cpp index 3f87d05..12814d2 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/removeLockdownWhitelistUid.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,20 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistUid) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + gint uid_integer; + parameters.get(0, uid_integer); + uid_t uid = (uid_t)uid_integer; try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); + if (_lockdown_whitelist.removeUID(uid)) { + _dbus.broadcastSignal("LockdownWhitelistUidRemoved", DBUS_INTERFACE_POLICIES, parameters); + } } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/removeLockdownWhitelistUser.cpp similarity index 73% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/removeLockdownWhitelistUser.cpp index 3f87d05..c09361d 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/removeLockdownWhitelistUser.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,19 @@ namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistUser) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString username; + parameters.get(0, username); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); + if (_lockdown_whitelist.removeUsername(username)) { + _dbus.broadcastSignal("LockdownWhitelistUserRemoved", DBUS_INTERFACE_POLICIES, parameters); + } } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/FirewallD.cpp b/src/Daemon/FirewallD.cpp index 40feef2..3deb556 100644 --- a/src/Daemon/FirewallD.cpp +++ b/src/Daemon/FirewallD.cpp @@ -148,11 +148,28 @@ namespace firewalld } } - void FirewallD::setPanicMode(bool panic_mode) + bool FirewallD::panicMode() const + { + return _panic_mode; + } + + void FirewallD::setPanicMode(bool enable) { // Set the panic mode // Signal on dbus - _panic_mode = panic_mode; + _panic_mode = enable; + } + + bool FirewallD::lockdownMode() const + { + return _lockdown_mode; + } + + void FirewallD::setLockdownMode(bool enable) + { + // Set the lockdown mode + // Signal on dbus + _lockdown_mode = enable; } Pointer<Service> FirewallD::lookupService(const UString& name) const diff --git a/src/Daemon/FirewallD.hpp b/src/Daemon/FirewallD.hpp index 33b2f4d..d14f5fa 100644 --- a/src/Daemon/FirewallD.hpp +++ b/src/Daemon/FirewallD.hpp @@ -69,8 +69,11 @@ namespace firewalld */ void loadDefinitions(); - bool panicMode() const { return _panic_mode; } - void setPanicMode(bool panic_mode); + bool panicMode() const; + void setPanicMode(bool enable); + + bool lockdownMode() const; + void setLockdownMode(bool enable); /** * Return reference to the Service object definitions. @@ -215,6 +218,7 @@ namespace firewalld PointerMap<UString,ICMPType> _defined_icmptypes; bool _panic_mode; + bool _lockdown_mode; DBusMethodTable _dbus_method_table; std::mutex _dbus_method_mutex; diff --git a/src/Daemon/LockdownWhitelist.cpp b/src/Daemon/LockdownWhitelist.cpp index 4fcd1ef..d05816f 100644 --- a/src/Daemon/LockdownWhitelist.cpp +++ b/src/Daemon/LockdownWhitelist.cpp @@ -35,42 +35,87 @@ namespace firewalld LOG(DEBUG) << "Added SELinux context \"" << secontext << "\" to lockdown whitelist"; } + bool LockdownWhitelist::SEContextInList(const UString& secontext) const + { + return (_secontexts.count(secontext) == 1); + } + + bool LockdownWhitelist::removeSEContext(const UString& secontext) + { + return (_secontexts.erase(secontext) > 0); + } + + UStringVector LockdownWhitelist::getSEContexts() const + { + UStringVector contexts; + for (auto const& map_entry : _secontexts) { + contexts.push_back(map_entry.first); + } + return std::move(contexts); + } + void LockdownWhitelist::addUsername(const UString& username) { _usernames[username] = true; LOG(DEBUG) << "Added username \"" << username << "\" to lockdown whitelist"; } + bool LockdownWhitelist::UsernameInList(const UString& username) const + { + return (_usernames.count(username) == 1); + } + + bool LockdownWhitelist::removeUsername(const UString& username) + { + return (_usernames.erase(username) > 0); + } + + UStringVector LockdownWhitelist::getUsernames() const + { + UStringVector usernames; + for (auto const& map_entry : _usernames) { + usernames.push_back(map_entry.first); + } + return std::move(usernames); + } + void LockdownWhitelist::addUID(uid_t uid) { _uids[uid] = true; LOG(DEBUG) << "Added UID \"" << uid << "\" to lockdown whitelist"; } - void LockdownWhitelist::addCommand(const UString& command) + bool LockdownWhitelist::UIDInList(uid_t uid) const { - if (command[command.length() - 1] == '*') { - _commands_partial.push_back(command); - LOG(DEBUG) << "Added command pattern \"" << command << "\" to lockdown whitelist"; - } else { - _commands_full[command] = true; - LOG(DEBUG) << "Added command \"" << command << "\" to lockdown whitelist"; - } + return (_uids.count(uid) == 1); } - bool LockdownWhitelist::SEContextInList(const UString& secontext) const + bool LockdownWhitelist::removeUID(uid_t uid) { - return (_secontexts.count(secontext) == 1); + return (_uids.erase(uid) > 0); } - bool LockdownWhitelist::UsernameInList(const UString& username) const + std::vector<uid_t> LockdownWhitelist::getUIDs() const { - return (_usernames.count(username) == 1); + std::vector<uid_t> uid_vector; + for (auto const& map_entry : _uids) { + uid_vector.push_back(map_entry.first); + } + return std::move(uid_vector); } - bool LockdownWhitelist::UIDInList(uid_t uid) const + void LockdownWhitelist::addCommand(const UString& command) { - return (_uids.count(uid) == 1); + if (command.length() < 1) { + return; + } + if (command[command.length() - 1] == '*') { + _commands_partial.push_back(command); + LOG(DEBUG) << "Added command pattern \"" << command << "\" to lockdown whitelist"; + } else { + _commands_full[command] = true; + LOG(DEBUG) << "Added command \"" << command << "\" to lockdown whitelist"; + } } bool LockdownWhitelist::commandInList(const UString& command) const @@ -88,6 +133,36 @@ namespace firewalld return false; } + bool LockdownWhitelist::removeCommand(const UString& command) + { + if (command.length() < 1) { + return false; + } + if (command[command.length() - 1] == '*') { + for (auto it = _commands_partial.begin(); it != _commands_partial.end(); ++it) { + if (*it == command) { + _commands_partial.erase(it); + return true; + } + } + return false; + } else { + return (_commands_full.erase(command) > 0); + } + } + + UStringVector LockdownWhitelist::getCommands() const + { + UStringVector commands; + for (auto const& map_entry : _commands_full) { + commands.push_back(map_entry.first); + } + for (auto const& command : _commands_partial) { + commands.push_back(command); + } + return std::move(commands); + } + void LockdownWhitelist::clear() { _secontexts.clear(); diff --git a/src/Daemon/LockdownWhitelist.hpp b/src/Daemon/LockdownWhitelist.hpp index 525938f..7860d13 100644 --- a/src/Daemon/LockdownWhitelist.hpp +++ b/src/Daemon/LockdownWhitelist.hpp @@ -34,34 +34,44 @@ namespace firewalld LockdownWhitelist(); /** + * Add a SELinux context to the list. + */ + void addSEContext(const UString& secontext); + + /** * Check is the given SELinux context is in the list. */ bool SEContextInList(const UString& secontext) const; /** - * Check if the given username is in the list. + * Remove a SELinux context from the list. */ - bool UsernameInList(const UString& username) const; + bool removeSEContext(const UString& secontext); /** - * Check if the given UID is in the list. + * Return a vector of SELinux contexts. */ - bool UIDInList(uid_t uid) const; + UStringVector getSEContexts() const; /** - * Check if the given command is in the list. + * Add a username to the list. */ - bool commandInList(const UString& command) const; + void addUsername(const UString& username); /** - * Add a SELinux context to the list. + * Check if the given username is in the list. */ - void addSEContext(const UString& secontext); + bool UsernameInList(const UString& username) const; /** - * Add a username to the list. + * Remove a username from the list. */ - void addUsername(const UString& username); + bool removeUsername(const UString& username); + + /** + * Get a vector of all username from the list. + */ + UStringVector getUsernames() const; /** * Add a UID to the list. @@ -69,11 +79,41 @@ namespace firewalld void addUID(uid_t uid); /** + * Check if the given UID is in the list. + */ + bool UIDInList(uid_t uid) const; + + /** + * Remove a UID from the list. + */ + bool removeUID(uid_t uid); + + /** + * Get a vector of all UIDs from the list. + */ + std::vector<uid_t> getUIDs() const; + + /** * Add a command to the list. */ void addCommand(const UString& command); /** + * Check if the given command is in the list. + */ + bool commandInList(const UString& command) const; + + /** + * Remove a command from the list. + */ + bool removeCommand(const UString& command); + + /** + * Get a vector of all commands from the list. + */ + UStringVector getCommands() const; + + /** * Remove all items from the list. */ void clear();
1
0
0
0
[firewalld-recode] master: Fix uninitialized variable bug in ConfigFile::parse() (b58226e)
by mildew@fedoraproject.org
13 Jan '15
13 Jan '15
Repository :
http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master >--------------------------------------------------------------- commit b58226e7f96a491c04a991ab9453773779ca3eb4 Author: Daniel Kopecek <dkopecek(a)redhat.com> Date: Tue Jan 13 11:30:42 2015 +0100 Fix uninitialized variable bug in ConfigFile::parse() >--------------------------------------------------------------- src/Daemon/ConfigFile.cpp | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/Daemon/ConfigFile.cpp b/src/Daemon/ConfigFile.cpp index 9f32340..99189f7 100644 --- a/src/Daemon/ConfigFile.cpp +++ b/src/Daemon/ConfigFile.cpp @@ -99,7 +99,7 @@ namespace firewalld void ConfigFile::parse() { String config_line; - size_t config_line_number; + size_t config_line_number = 0; while(std::getline(_stream, config_line)) { ++config_line_number;
1
0
0
0
← Newer
1
2
3
4
...
14
Older →
Jump to page:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
Results per page:
10
25
50
100
200