Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
commit 013e91bf6dfb021e6ff35e5d251f1fc5227409e0 Author: Daniel Kopecek dkopecek@redhat.com Date: Mon Nov 24 15:28:04 2014 +0100
Implement internal zone definition to zone state transfers
- refactored the Firewall class API to provide two methods for getting a Zone object pointer:
1) getZone: returns a const pointer for read-only requests
2) getWritableZone: returns a writable Zone pointer to an internal firewall state copy of a Zone definition object which tracks runtime changes to a Zone
- adapted all DBus methods that used the old getZone method
src/Daemon/DBus/zone/addForwardPort.cpp | 3 +- src/Daemon/DBus/zone/addIcmpBlock.cpp | 3 +- src/Daemon/DBus/zone/addInterface.cpp | 3 +- src/Daemon/DBus/zone/addMasquerade.cpp | 3 +- src/Daemon/DBus/zone/addPort.cpp | 3 +- src/Daemon/DBus/zone/addRichRule.cpp | 3 +- src/Daemon/DBus/zone/addService.cpp | 3 +- src/Daemon/DBus/zone/addSource.cpp | 3 +- src/Daemon/DBus/zone/changeZone.cpp | 3 +- src/Daemon/DBus/zone/changeZoneOfInterface.cpp | 3 +- src/Daemon/DBus/zone/changeZoneOfSource.cpp | 2 +- src/Daemon/DBus/zone/getForwardPorts.cpp | 2 +- src/Daemon/DBus/zone/getIcmpBlocks.cpp | 2 +- src/Daemon/DBus/zone/getInterfaces.cpp | 2 +- src/Daemon/DBus/zone/getPorts.cpp | 2 +- src/Daemon/DBus/zone/getRichRules.cpp | 2 +- src/Daemon/DBus/zone/getServices.cpp | 2 +- src/Daemon/DBus/zone/getSources.cpp | 2 +- src/Daemon/DBus/zone/isImmutable.cpp | 2 +- src/Daemon/DBus/zone/queryForwardPort.cpp | 2 +- src/Daemon/DBus/zone/queryIcmpBlock.cpp | 2 +- src/Daemon/DBus/zone/queryInterface.cpp | 2 +- src/Daemon/DBus/zone/queryMasquerade.cpp | 2 +- src/Daemon/DBus/zone/queryPort.cpp | 2 +- src/Daemon/DBus/zone/queryRichRule.cpp | 2 +- src/Daemon/DBus/zone/queryService.cpp | 2 +- src/Daemon/DBus/zone/querySource.cpp | 2 +- src/Daemon/DBus/zone/removeForwardPort.cpp | 3 +- src/Daemon/DBus/zone/removeIcmpBlock.cpp | 3 +- src/Daemon/DBus/zone/removeInterface.cpp | 3 +- src/Daemon/DBus/zone/removeMasquerade.cpp | 3 +- src/Daemon/DBus/zone/removePort.cpp | 3 +- src/Daemon/DBus/zone/removeRichRule.cpp | 3 +- src/Daemon/DBus/zone/removeService.cpp | 3 +- src/Daemon/DBus/zone/removeSource.cpp | 2 +- src/Daemon/Firewall/Firewall.cpp | 53 +++++++++++++++++++++--- src/Daemon/Firewall/Firewall.hpp | 18 ++++++++- src/Daemon/Firewall/Zone.cpp | 16 +++++++- src/Daemon/Firewall/Zone.hpp | 2 +- 39 files changed, 132 insertions(+), 44 deletions(-)
diff --git a/src/Daemon/DBus/zone/addForwardPort.cpp b/src/Daemon/DBus/zone/addForwardPort.cpp index 98dc58a..1c89bd2 100644 --- a/src/Daemon/DBus/zone/addForwardPort.cpp +++ b/src/Daemon/DBus/zone/addForwardPort.cpp @@ -41,7 +41,8 @@ namespace firewalld parameters.get(5, timeout);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); Pointer<Port> src_port = makePointer<Port>(src_port_range, protocol); Pointer<Port> dst_port = makePointer<Port>(dst_port_range, protocol); Pointer<PortForward> port_forward = makePointer<PortForward>(src_port, dst_port, dst_address); diff --git a/src/Daemon/DBus/zone/addIcmpBlock.cpp b/src/Daemon/DBus/zone/addIcmpBlock.cpp index af509fe..60bdb2c 100644 --- a/src/Daemon/DBus/zone/addIcmpBlock.cpp +++ b/src/Daemon/DBus/zone/addIcmpBlock.cpp @@ -35,7 +35,8 @@ namespace firewalld parameters.get(2, timeout);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); Pointer<ICMPType> icmptype = lookupICMPType(icmptype_identifier);
if (icmptype == nullptr) { diff --git a/src/Daemon/DBus/zone/addInterface.cpp b/src/Daemon/DBus/zone/addInterface.cpp index 8b94cd0..8db80db 100644 --- a/src/Daemon/DBus/zone/addInterface.cpp +++ b/src/Daemon/DBus/zone/addInterface.cpp @@ -34,7 +34,8 @@ namespace firewalld
try { Pointer<Interface> interface = makePointer<Interface>(interface_identifier); - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name);
zone->addInterface(interface); _dbus.broadcastSignal("InterfaceAdded", DBUS_INTERFACE_ZONE, parameters); diff --git a/src/Daemon/DBus/zone/addMasquerade.cpp b/src/Daemon/DBus/zone/addMasquerade.cpp index 4bd3e89..05aa590 100644 --- a/src/Daemon/DBus/zone/addMasquerade.cpp +++ b/src/Daemon/DBus/zone/addMasquerade.cpp @@ -33,7 +33,8 @@ namespace firewalld parameters.get(1, timeout);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); zone->setMasquerade(true); result = zone->name(); } diff --git a/src/Daemon/DBus/zone/addPort.cpp b/src/Daemon/DBus/zone/addPort.cpp index 5ed7602..fe89bca 100644 --- a/src/Daemon/DBus/zone/addPort.cpp +++ b/src/Daemon/DBus/zone/addPort.cpp @@ -37,7 +37,8 @@ namespace firewalld parameters.get(3, timeout);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); Pointer<Port> port = makePointer<Port>(range_spec, protocol); port->setZone(zone); zone->addPort(port); diff --git a/src/Daemon/DBus/zone/addRichRule.cpp b/src/Daemon/DBus/zone/addRichRule.cpp index d01629f..22f075a 100644 --- a/src/Daemon/DBus/zone/addRichRule.cpp +++ b/src/Daemon/DBus/zone/addRichRule.cpp @@ -33,7 +33,8 @@ namespace firewalld parameters.get(1, rich_rule_spec);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); Pointer<RichRule> rich_rule = RichRuleParser::parse(rich_rule_spec); zone->addRichRule(rich_rule); _dbus.broadcastSignal("RichRuleAdded", DBUS_INTERFACE_ZONE, parameters); diff --git a/src/Daemon/DBus/zone/addService.cpp b/src/Daemon/DBus/zone/addService.cpp index 7e409b4..3dd3651 100644 --- a/src/Daemon/DBus/zone/addService.cpp +++ b/src/Daemon/DBus/zone/addService.cpp @@ -33,7 +33,8 @@ namespace firewalld parameters.get(1, service_identifier);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); Pointer<Service> service = makePointer<Service>(service_identifier); zone->addService(service); _dbus.broadcastSignal("ServiceAdded", DBUS_INTERFACE_ZONE, parameters); diff --git a/src/Daemon/DBus/zone/addSource.cpp b/src/Daemon/DBus/zone/addSource.cpp index 9bc8e15..b425398 100644 --- a/src/Daemon/DBus/zone/addSource.cpp +++ b/src/Daemon/DBus/zone/addSource.cpp @@ -34,7 +34,8 @@ namespace firewalld
try { Pointer<Source> source = makePointer<Source>(source_spec); - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); zone->addSource(source); _dbus.broadcastSignal("SourceAdded", DBUS_INTERFACE_ZONE, parameters); result = zone->name(); diff --git a/src/Daemon/DBus/zone/changeZone.cpp b/src/Daemon/DBus/zone/changeZone.cpp index ebcf65f..8d182ed 100644 --- a/src/Daemon/DBus/zone/changeZone.cpp +++ b/src/Daemon/DBus/zone/changeZone.cpp @@ -33,7 +33,8 @@ namespace firewalld parameters.get(1, interface_identifier);
try { - Pointer<Zone> zone_new = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone_new = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); Pointer<Interface> interface = _fw.getInterface(interface_identifier); Pointer<Zone> zone_cur = interface->getZone();
diff --git a/src/Daemon/DBus/zone/changeZoneOfInterface.cpp b/src/Daemon/DBus/zone/changeZoneOfInterface.cpp index 1c42ff8..b02efc1 100644 --- a/src/Daemon/DBus/zone/changeZoneOfInterface.cpp +++ b/src/Daemon/DBus/zone/changeZoneOfInterface.cpp @@ -33,7 +33,8 @@ namespace firewalld parameters.get(1, interface_identifier);
try { - Pointer<Zone> zone_new = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone_new = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); Pointer<Interface> interface = _fw.getInterface(interface_identifier); Pointer<Zone> zone_cur = interface->getZone();
diff --git a/src/Daemon/DBus/zone/changeZoneOfSource.cpp b/src/Daemon/DBus/zone/changeZoneOfSource.cpp index 461a40e..60cc238 100644 --- a/src/Daemon/DBus/zone/changeZoneOfSource.cpp +++ b/src/Daemon/DBus/zone/changeZoneOfSource.cpp @@ -33,7 +33,7 @@ namespace firewalld parameters.get(1, source_spec);
try { - Pointer<Zone> zone_new = _fw.getZone(zone_name); + Pointer<Zone> zone_new = _fw.getWritableZone(zone_name); Pointer<Source> source = _fw.getSource(source_spec); Pointer<Zone> zone_cur = source->getZone();
diff --git a/src/Daemon/DBus/zone/getForwardPorts.cpp b/src/Daemon/DBus/zone/getForwardPorts.cpp index 6d27229..e6b516e 100644 --- a/src/Daemon/DBus/zone/getForwardPorts.cpp +++ b/src/Daemon/DBus/zone/getForwardPorts.cpp @@ -31,7 +31,7 @@ namespace firewalld parameters.get(0, zone_name);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); auto port_forwards = zone->getForwardPorts(); size_t i = 0;
diff --git a/src/Daemon/DBus/zone/getIcmpBlocks.cpp b/src/Daemon/DBus/zone/getIcmpBlocks.cpp index 9dc5355..3da5df1 100644 --- a/src/Daemon/DBus/zone/getIcmpBlocks.cpp +++ b/src/Daemon/DBus/zone/getIcmpBlocks.cpp @@ -31,7 +31,7 @@ namespace firewalld parameters.get(0, zone_name);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); UStringVector icmp_types; for (auto const& map_entry : zone->getICMPBlocks()) { icmp_types.push_back(map_entry.first); diff --git a/src/Daemon/DBus/zone/getInterfaces.cpp b/src/Daemon/DBus/zone/getInterfaces.cpp index a3f1362..850552e 100644 --- a/src/Daemon/DBus/zone/getInterfaces.cpp +++ b/src/Daemon/DBus/zone/getInterfaces.cpp @@ -31,7 +31,7 @@ namespace firewalld parameters.get(0, zone_name);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); auto interface_map = zone->getInterfaces(); UStringVector interface_identifier_vector;
diff --git a/src/Daemon/DBus/zone/getPorts.cpp b/src/Daemon/DBus/zone/getPorts.cpp index 0b08aaa..5a331f8 100644 --- a/src/Daemon/DBus/zone/getPorts.cpp +++ b/src/Daemon/DBus/zone/getPorts.cpp @@ -31,7 +31,7 @@ namespace firewalld parameters.get(0, zone_name);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); auto tcp_ports = zone->getPorts(Port::Protocol::TCP); auto udp_ports = zone->getPorts(Port::Protocol::UDP); size_t i = 0; diff --git a/src/Daemon/DBus/zone/getRichRules.cpp b/src/Daemon/DBus/zone/getRichRules.cpp index f05663c..2e639b3 100644 --- a/src/Daemon/DBus/zone/getRichRules.cpp +++ b/src/Daemon/DBus/zone/getRichRules.cpp @@ -31,7 +31,7 @@ namespace firewalld parameters.get(0, zone_name);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); auto rich_rules = zone->getRichRules(); UStringVector rich_rule_vector;
diff --git a/src/Daemon/DBus/zone/getServices.cpp b/src/Daemon/DBus/zone/getServices.cpp index 4190e89..248305a 100644 --- a/src/Daemon/DBus/zone/getServices.cpp +++ b/src/Daemon/DBus/zone/getServices.cpp @@ -31,7 +31,7 @@ namespace firewalld parameters.get(0, zone_name);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); auto services = zone->getServices(); UStringVector service_identifier_vector;
diff --git a/src/Daemon/DBus/zone/getSources.cpp b/src/Daemon/DBus/zone/getSources.cpp index d1e4f4a..c0596f4 100644 --- a/src/Daemon/DBus/zone/getSources.cpp +++ b/src/Daemon/DBus/zone/getSources.cpp @@ -31,7 +31,7 @@ namespace firewalld parameters.get(0, zone_name);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); auto source_map = zone->getSources(); UStringVector source_spec_vector;
diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/zone/isImmutable.cpp index f224891..ed4f900 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/zone/isImmutable.cpp @@ -31,7 +31,7 @@ namespace firewalld parameters.get(0, zone_name);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); result = zone->isImmutable(); } catch(const FirewallError& ex) { diff --git a/src/Daemon/DBus/zone/queryForwardPort.cpp b/src/Daemon/DBus/zone/queryForwardPort.cpp index ef6f5a1..6c777f6 100644 --- a/src/Daemon/DBus/zone/queryForwardPort.cpp +++ b/src/Daemon/DBus/zone/queryForwardPort.cpp @@ -39,7 +39,7 @@ namespace firewalld parameters.get(4, dst_address);
try { - Pointer<Zone> zone = _fw.getZone(zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name); Pointer<Port> src_port = makePointer<Port>(src_port_range, protocol); Pointer<Port> dst_port = makePointer<Port>(dst_port_range, protocol); Pointer<PortForward> port_forward = makePointer<PortForward>(src_port, dst_port, dst_address); diff --git a/src/Daemon/DBus/zone/queryIcmpBlock.cpp b/src/Daemon/DBus/zone/queryIcmpBlock.cpp index f4cbad6..549ad82 100644 --- a/src/Daemon/DBus/zone/queryIcmpBlock.cpp +++ b/src/Daemon/DBus/zone/queryIcmpBlock.cpp @@ -33,7 +33,7 @@ namespace firewalld parameters.get(1, icmp_type);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); result = zone->queryICMPBlock(icmp_type); } catch(const FirewallError& ex) { diff --git a/src/Daemon/DBus/zone/queryInterface.cpp b/src/Daemon/DBus/zone/queryInterface.cpp index 305d461..9361199 100644 --- a/src/Daemon/DBus/zone/queryInterface.cpp +++ b/src/Daemon/DBus/zone/queryInterface.cpp @@ -34,7 +34,7 @@ namespace firewalld
try { Pointer<Interface> interface = makePointer<Interface>(interface_identifier); - Pointer<Zone> zone = _fw.getZone(zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name); result = zone->queryInterface(interface); } catch(const FirewallError& ex) { diff --git a/src/Daemon/DBus/zone/queryMasquerade.cpp b/src/Daemon/DBus/zone/queryMasquerade.cpp index cdb194e..8b95f86 100644 --- a/src/Daemon/DBus/zone/queryMasquerade.cpp +++ b/src/Daemon/DBus/zone/queryMasquerade.cpp @@ -31,7 +31,7 @@ namespace firewalld parameters.get(0, zone_name);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); result = zone->queryMasquerade(); } catch(const FirewallError& ex) { diff --git a/src/Daemon/DBus/zone/queryPort.cpp b/src/Daemon/DBus/zone/queryPort.cpp index 619ff6a..982ccf4 100644 --- a/src/Daemon/DBus/zone/queryPort.cpp +++ b/src/Daemon/DBus/zone/queryPort.cpp @@ -35,7 +35,7 @@ namespace firewalld parameters.get(2, protocol);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); Pointer<Port> port = makePointer<Port>(range_spec, protocol); result = zone->queryPort(port); } diff --git a/src/Daemon/DBus/zone/queryRichRule.cpp b/src/Daemon/DBus/zone/queryRichRule.cpp index 007a1ce..58d3b04 100644 --- a/src/Daemon/DBus/zone/queryRichRule.cpp +++ b/src/Daemon/DBus/zone/queryRichRule.cpp @@ -33,7 +33,7 @@ namespace firewalld parameters.get(1, rich_rule_spec);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); Pointer<RichRule> rich_rule = RichRuleParser::parse(rich_rule_spec); result = zone->queryRichRule(rich_rule); } diff --git a/src/Daemon/DBus/zone/queryService.cpp b/src/Daemon/DBus/zone/queryService.cpp index 423aa4d..d097aae 100644 --- a/src/Daemon/DBus/zone/queryService.cpp +++ b/src/Daemon/DBus/zone/queryService.cpp @@ -33,7 +33,7 @@ namespace firewalld parameters.get(1, service_identifier);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); Pointer<Service> service = makePointer<Service>(service_identifier); result = zone->queryService(service); } diff --git a/src/Daemon/DBus/zone/querySource.cpp b/src/Daemon/DBus/zone/querySource.cpp index 4e09b48..533e876 100644 --- a/src/Daemon/DBus/zone/querySource.cpp +++ b/src/Daemon/DBus/zone/querySource.cpp @@ -34,7 +34,7 @@ namespace firewalld
try { Pointer<Source> source = makePointer<Source>(source_spec); - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); result = zone->querySource(source); } catch(const FirewallError& ex) { diff --git a/src/Daemon/DBus/zone/removeForwardPort.cpp b/src/Daemon/DBus/zone/removeForwardPort.cpp index 3a06639..a36382a 100644 --- a/src/Daemon/DBus/zone/removeForwardPort.cpp +++ b/src/Daemon/DBus/zone/removeForwardPort.cpp @@ -39,7 +39,8 @@ namespace firewalld parameters.get(4, dst_address);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); Pointer<Port> src_port = makePointer<Port>(src_port_range, protocol); Pointer<Port> dst_port = makePointer<Port>(dst_port_range, protocol); Pointer<PortForward> port_forward = makePointer<PortForward>(src_port, dst_port, dst_address); diff --git a/src/Daemon/DBus/zone/removeIcmpBlock.cpp b/src/Daemon/DBus/zone/removeIcmpBlock.cpp index 65230f6..64b3833 100644 --- a/src/Daemon/DBus/zone/removeIcmpBlock.cpp +++ b/src/Daemon/DBus/zone/removeIcmpBlock.cpp @@ -33,7 +33,8 @@ namespace firewalld parameters.get(1, icmp_type);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); zone->removeICMPBlock(icmp_type); result = zone->name(); } diff --git a/src/Daemon/DBus/zone/removeInterface.cpp b/src/Daemon/DBus/zone/removeInterface.cpp index d000455..062f342 100644 --- a/src/Daemon/DBus/zone/removeInterface.cpp +++ b/src/Daemon/DBus/zone/removeInterface.cpp @@ -34,7 +34,8 @@ namespace firewalld
try { Pointer<Interface> interface = makePointer<Interface>(interface_identifier); - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name);
if (zone->removeInterface(interface)) { _dbus.broadcastSignal("InterfaceRemoved", DBUS_INTERFACE_ZONE, parameters); diff --git a/src/Daemon/DBus/zone/removeMasquerade.cpp b/src/Daemon/DBus/zone/removeMasquerade.cpp index 6bd5d6c..02ce720 100644 --- a/src/Daemon/DBus/zone/removeMasquerade.cpp +++ b/src/Daemon/DBus/zone/removeMasquerade.cpp @@ -31,7 +31,8 @@ namespace firewalld parameters.get(0, zone_name);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); zone->setMasquerade(false); result = zone->name(); } diff --git a/src/Daemon/DBus/zone/removePort.cpp b/src/Daemon/DBus/zone/removePort.cpp index 4c6b6c0..5ae9d18 100644 --- a/src/Daemon/DBus/zone/removePort.cpp +++ b/src/Daemon/DBus/zone/removePort.cpp @@ -35,7 +35,8 @@ namespace firewalld parameters.get(2, protocol);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); Pointer<Port> port = makePointer<Port>(range_spec, protocol);
if (zone->removePort(port)) { diff --git a/src/Daemon/DBus/zone/removeRichRule.cpp b/src/Daemon/DBus/zone/removeRichRule.cpp index 876e83e..cdfc119 100644 --- a/src/Daemon/DBus/zone/removeRichRule.cpp +++ b/src/Daemon/DBus/zone/removeRichRule.cpp @@ -33,7 +33,8 @@ namespace firewalld parameters.get(1, rich_rule_spec);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); Pointer<RichRule> rich_rule = RichRuleParser::parse(rich_rule_spec);
if (zone->removeRichRule(rich_rule)) { diff --git a/src/Daemon/DBus/zone/removeService.cpp b/src/Daemon/DBus/zone/removeService.cpp index 3cc5483..227c2a7 100644 --- a/src/Daemon/DBus/zone/removeService.cpp +++ b/src/Daemon/DBus/zone/removeService.cpp @@ -33,7 +33,8 @@ namespace firewalld parameters.get(1, service_identifier);
try { - Pointer<Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name.empty() ? + _fw.getDefaultZoneName() : zone_name); Pointer<Service> service = makePointer<Service>(service_identifier);
if (zone->removeService(service)) { diff --git a/src/Daemon/DBus/zone/removeSource.cpp b/src/Daemon/DBus/zone/removeSource.cpp index 5578688..c2abbcf 100644 --- a/src/Daemon/DBus/zone/removeSource.cpp +++ b/src/Daemon/DBus/zone/removeSource.cpp @@ -34,7 +34,7 @@ namespace firewalld
try { Pointer<Source> source = makePointer<Source>(source_spec); - Pointer<Zone> zone = _fw.getZone(zone_name); + Pointer<Zone> zone = _fw.getWritableZone(zone_name);
if (zone->removeSource(source)) { // Send the signal only if we actualy removed diff --git a/src/Daemon/Firewall/Firewall.cpp b/src/Daemon/Firewall/Firewall.cpp index f2d09d1..8083064 100644 --- a/src/Daemon/Firewall/Firewall.cpp +++ b/src/Daemon/Firewall/Firewall.cpp @@ -132,18 +132,59 @@ namespace firewalld }
bool Firewall::zoneExists(const UString &name) const - { + { return (_zone_map.find(name) != _zone_map.end()); }
- Pointer<Zone> Firewall::getZone(const UString& name) const + Pointer<const Zone> Firewall::getZone(const UString& name) const + { + /* + * First look into the internal firewall state map. + */ + Pointer<const Zone> zone = PointerMapOp::findOne(_zone_map, name); + + if (zone != nullptr) { + return zone; + } + + /* + * The requested zone doesn't have any runtime data to track, try + * to search for it among the zone definitions loaded from disk. + */ + zone = FirewallD::instance()->lookupZone(name); + + if (zone == nullptr) { + throw FirewallError("INVALID_ZONE", "Zone "" + name + "" not defined"); + } + + return zone; + } + + Pointer<Zone> Firewall::getWritableZone(const UString& name) { - auto zone_ptr = PointerMapOp::findOne(_zone_map, name); - if (zone_ptr == nullptr) { + Pointer<Zone> zone = PointerMapOp::findOne(_zone_map, name); + + if (zone != nullptr) { + return zone; + } + + Pointer<const Zone> zone_definition = FirewallD::instance()->lookupZone(name); + + if (zone_definition == nullptr) { throw FirewallError("INVALID_ZONE", "Zone "" + name + "" not defined"); - } else { - return zone_ptr; } + + /* + * Create a deep copy of the zone definition object and + * add it to the internal firewall state. All runtime data + * will be tracked in this instance. + */ + zone = makePointer<Zone>(*zone_definition); + _zone_map[name] = zone; + + LOG(DEBUG) << "Zone "" << name << "" copied to the internal firewall state"; + + return zone; }
Pointer<Source> Firewall::getSource(const UString& source_spec) const diff --git a/src/Daemon/Firewall/Firewall.hpp b/src/Daemon/Firewall/Firewall.hpp index f873ce8..cdf6a7a 100644 --- a/src/Daemon/Firewall/Firewall.hpp +++ b/src/Daemon/Firewall/Firewall.hpp @@ -67,7 +67,23 @@ namespace firewalld bool directIPv6QueryRule(const String& table, const String& chain, const String& rule_specification, int rule_num);
bool zoneExists(const UString& name) const; - Pointer<Zone> getZone(const UString& name) const; + /** + * Get a pointer to a readonly Zone object. + * A readonly Zone object may be used only for querying + * data. If a Zone object was changed at runtime, then + * the return value points to this modified version. + * Otherwise, a pointer to the Zone definition as it was + * read from the disk is returned. + */ + Pointer<const Zone> getZone(const UString& name) const; + /** + * Get a pointer to a writable Zone object. + * If a zone is requested for the first time via this + * functions, it's definition is first copied to the + * internal Firewall state as a new Zone object and a + * pointer to the newly created object is returned. + */ + Pointer<Zone> getWritableZone(const UString& name);
Pointer<Source> getSource(const UString& source_spec) const; Pointer<Interface> getInterface(const UString& interface_identifier) const; diff --git a/src/Daemon/Firewall/Zone.cpp b/src/Daemon/Firewall/Zone.cpp index c27f468..c3fb97a 100644 --- a/src/Daemon/Firewall/Zone.cpp +++ b/src/Daemon/Firewall/Zone.cpp @@ -27,8 +27,22 @@ namespace firewalld { }
- Zone::~Zone() - { + Zone::Zone(const Zone& zone) + { + _identifier = zone._identifier; + _name = zone._name; + _description = zone._description; + _version = zone._version; + _target = zone._target; + _flags = zone._flags; + _interface_map = zone._interface_map; + _service_map = zone._service_map; + _source_map = zone._source_map; + _tcp_port_map = zone._tcp_port_map; + _udp_port_map = zone._udp_port_map; + _port_forward_map = zone._port_forward_map; + _icmp_block_map = zone._icmp_block_map; + _rich_rule_map = zone._rich_rule_map; }
Zone::Zone(const UString& identifier, const UString& target) diff --git a/src/Daemon/Firewall/Zone.hpp b/src/Daemon/Firewall/Zone.hpp index e023f14..9a7ea6c 100644 --- a/src/Daemon/Firewall/Zone.hpp +++ b/src/Daemon/Firewall/Zone.hpp @@ -48,8 +48,8 @@ namespace firewalld };
Zone(); + Zone(const Zone& zone); Zone(const UString& identifier, const UString& target = UString()); - ~Zone();
const UString& name() const; const UString& identifier() const;
firewalld-recode@lists.fedorahosted.org