Repository :
http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
---------------------------------------------------------------
commit 063c8eaca504a65fc1c8a70977beb9368a95d537
Author: Daniel Kopecek <dkopecek(a)redhat.com>
Date: Wed Aug 20 13:33:50 2014 +0200
Add support for loading configuration from a firewalld.conf file
---------------------------------------------------------------
firewalld.cpp | 78 +++++++++++++++++++-
firewalld.hpp | 11 +++-
firewalld_cli.cpp | 11 +++
firewalld_cli.hpp | 2 +
.../zone/{getIcmpBlocks.cpp => getRichRules.cpp} | 7 +-
firewalld_dbus/zone/methods.decl | 3 +-
main.cpp | 3 +-
7 files changed, 102 insertions(+), 13 deletions(-)
diff --git a/firewalld.cpp b/firewalld.cpp
index 6beade7..9ee6257 100644
--- a/firewalld.cpp
+++ b/firewalld.cpp
@@ -88,11 +88,81 @@ namespace firewalld
_glib_loop->quit();
}
- void FirewallD::loadConfig()
+ void FirewallD::loadConfiguration(const UString& filepath)
{
- LOG(TRACE) << "Loading configuration";
- loadServiceDefinitions("./config/services/");
- loadZoneDefinitions("./config/zones/");
+ LOG(INFO) << "Loading configuration from " << filepath;
+ std::ifstream config(filepath);
+ String config_line;
+ size_t config_line_num = 0;
+
+ if (!config) {
+ LOG(ERROR) << "Unable to open the configuration file: " <<
filepath;
+ throw std::runtime_error("Unable to open the configuration file");
+ }
+
+ while(std::getline(config, config_line)) {
+ ++config_line_num;
+ size_t nv_separator = config_line.find_first_of("=");
+
+ if (nv_separator == String::npos) {
+ continue;
+ }
+
+ String name = trim(config_line.substr(0, nv_separator));
+ String value = config_line.substr(nv_separator + 1);
+
+ if (name[0] == '#') {
+ continue;
+ }
+
+ processConfigurationNVPair(name, value, config_line_num);
+ }
+
+ return;
+ }
+
+ void FirewallD::processConfigurationNVPair(const String& name, const String&
value, size_t line_num)
+ {
+ if (name == "DefaultZone") {
+ //
+ // Just assign the value here. Sanity checking is
+ // done after the definitions are loaded.
+ //
+ _fw.setDefaultZoneName(value);
+ return;
+ }
+
+ if (name == "MinimalMark") {
+ return;
+ }
+ if (name == "CleanupOnExit") {
+ return;
+ }
+ if (name == "Lockdown") {
+ return;
+ }
+ if (name == "IPv6_rpfilter") {
+ return;
+ }
+
+ if (name == "StaticDefinitionDirs" || name == "DefinitionDirs")
{
+ tokenizeString(value, _definition_dirs, ":", /*trim_empty=*/true);
+ return;
+ }
+
+ LOG(WARNING) << "Unknown name-value pair in configuration file: line
"
+ << line_num << ": " << name << "="
<< value;
+ }
+
+ /**
+ * Load definitions from the directories specified in the configuration file.
+ */
+ void FirewallD::loadDefinitions()
+ {
+ for(auto const& path : _definition_dirs) {
+ loadServiceDefinitions(path + "/services/");
+ loadZoneDefinitions(path + "/zones/");
+ }
}
void FirewallD::setPanicMode(bool panic_mode)
diff --git a/firewalld.hpp b/firewalld.hpp
index 58f42c0..ada40cf 100644
--- a/firewalld.hpp
+++ b/firewalld.hpp
@@ -37,7 +37,8 @@ namespace firewalld
FirewallD();
void run();
void quit();
- void loadConfig();
+ void loadConfiguration(const UString& filepath);
+ void loadDefinitions();
bool panicMode() const { return _panic_mode; }
void setPanicMode(bool panic_mode);
@@ -80,6 +81,11 @@ namespace firewalld
*/
void loadZoneDefinition(const String& filepath);
+ /**
+ * Process a name-value pair from the configuration file.
+ */
+ void processConfigurationNVPair(const String& name, const String& value,
size_t line_num);
+
void dbus_method_handle(const UString& name,
const DBusParameters& parameters,
DBusResultBuilder& result);
@@ -104,6 +110,9 @@ namespace firewalld
DBus _dbus;
Firewall _fw;
+ UString _default_zone;
+ StringVector _definition_dirs;
+
// Defined services
UStringKeyMap<Service*> _defined_services;
UStringKeyMap<Zone*> _defined_zones;
diff --git a/firewalld_cli.cpp b/firewalld_cli.cpp
index 892d320..85b0c21 100644
--- a/firewalld_cli.cpp
+++ b/firewalld_cli.cpp
@@ -38,6 +38,7 @@ namespace firewalld
no_pid = false;
debug_level = 0;
debug_gc = false;
+ config_path = "firewalld.conf";
// Define CLI options
add_option_entry("nofork",
@@ -54,6 +55,10 @@ namespace firewalld
add_option_entry("debug-gc",
"Does nothing. This option is here only for backward compatibility.",
debug_gc);
+ add_option_entry("config",
+ "Load configuration from the specified file.",
+ SLOT(*this, &CLIOptionGroup::on_option_arg_string),
+ OptionEntry::FLAG_FILENAME);
}
bool CLIOptionGroup::on_option_arg_string(const ustring& option_name,
@@ -81,6 +86,12 @@ namespace firewalld
}
}
}
+
+ if (option_name == "--config") {
+ config_path = value;
+ LOG(INFO) << "Config file is: " << config_path;
+ }
+
return true;
}
diff --git a/firewalld_cli.hpp b/firewalld_cli.hpp
index c01c29c..c21f906 100644
--- a/firewalld_cli.hpp
+++ b/firewalld_cli.hpp
@@ -34,6 +34,8 @@ namespace firewalld
bool no_pid;
bool debug_gc;
int debug_level;
+ UString config_path;
+
private:
// Add a long option entry associated with a variable
template<typename T>
diff --git a/firewalld_dbus/zone/getIcmpBlocks.cpp b/firewalld_dbus/zone/getRichRules.cpp
similarity index 85%
copy from firewalld_dbus/zone/getIcmpBlocks.cpp
copy to firewalld_dbus/zone/getRichRules.cpp
index 453a1cb..6102675 100644
--- a/firewalld_dbus/zone/getIcmpBlocks.cpp
+++ b/firewalld_dbus/zone/getRichRules.cpp
@@ -22,7 +22,7 @@
namespace firewalld
{
- FIREWALLD_DBUS_METHOD(getIcmpBlocks)
+ FIREWALLD_DBUS_METHOD(getRichRules)
{
result.setTypeSignature("(as)");
@@ -31,10 +31,7 @@ namespace firewalld
parameters.get(0, zone_name);
try {
- Zone* zone = _fw.getZone(zone_name);
- UStringVector icmp_types;
- zone->getICMPBlocks(icmp_types);
- result = icmp_types;
+ result = UStringVector();
}
catch(...) {
result = UStringVector();
diff --git a/firewalld_dbus/zone/methods.decl b/firewalld_dbus/zone/methods.decl
index 11876a2..aeb520b 100644
--- a/firewalld_dbus/zone/methods.decl
+++ b/firewalld_dbus/zone/methods.decl
@@ -46,5 +46,4 @@ FIREWALLD_DBUS_METHOD(getForwardPorts);
//FIREWALLD_DBUS_METHOD(addRichRule)
//FIREWALLD_DBUS_METHOD(removeRichRule)
//FIREWALLD_DBUS_METHOD(queryRichRule)
-//FIREWALLD_DBUS_METHOD(getRichRules)
-
+FIREWALLD_DBUS_METHOD(getRichRules);
diff --git a/main.cpp b/main.cpp
index e028933..5b15dd1 100644
--- a/main.cpp
+++ b/main.cpp
@@ -103,7 +103,8 @@ int main(int argc, char *argv[])
try {
startSignalHandler(&firewalld);
- firewalld.loadConfig();
+ firewalld.loadConfiguration(option_grp.config_path);
+ firewalld.loadDefinitions();
firewalld.run();
stopSignalHandler();
} catch(...) {