[PATCH] update to use firewalld (#815540)

Brian C. Lane bcl at redhat.com
Wed Oct 3 19:40:05 UTC 2012


From: "Brian C. Lane" <bcl at redhat.com>

NOTE: This depends on firewalld changes and will be held until they are pushed.
---
 pyanaconda/__init__.py                 |  4 +-
 pyanaconda/firewall.py                 | 80 ----------------------------------
 pyanaconda/install.py                  |  3 +-
 pyanaconda/kickstart.py                | 32 ++++++++++++++
 tests/pyanaconda_test/firewall_test.py | 41 -----------------
 5 files changed, 35 insertions(+), 125 deletions(-)
 delete mode 100644 pyanaconda/firewall.py
 delete mode 100644 tests/pyanaconda_test/firewall_test.py

diff --git a/pyanaconda/__init__.py b/pyanaconda/__init__.py
index 8948fdb..4abca2e 100644
--- a/pyanaconda/__init__.py
+++ b/pyanaconda/__init__.py
@@ -43,7 +43,7 @@ _ = lambda x: gettext.ldgettext("anaconda", x)
 
 class Anaconda(object):
     def __init__(self):
-        import desktop, firewall
+        import desktop
         from flags import flags
 
         self._backend = None
@@ -53,7 +53,6 @@ class Anaconda(object):
         self.dir = None
         self.displayMode = None
         self.extraModules = []
-        self.firewall = firewall.Firewall()
         self.id = None
         self._instClass = None
         self._intf = None
@@ -242,4 +241,3 @@ class Anaconda(object):
         network.disableNMForStorageDevices(self.storage)
         network.autostartFCoEDevices(self.storage)
         self.desktop.write()
-        self.firewall.write()
diff --git a/pyanaconda/firewall.py b/pyanaconda/firewall.py
deleted file mode 100644
index 5e82cba..0000000
--- a/pyanaconda/firewall.py
+++ /dev/null
@@ -1,80 +0,0 @@
-#
-# firewall.py - firewall install data and installation
-#
-# Copyright (C) 2004  Red Hat, Inc.  All rights reserved.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-# Author(s): Bill Nottingham <notting at redhat.com>
-#            Jeremy Katz <katzj at redhat.com>
-#
-
-import iutil
-import os.path
-from flags import flags
-from constants import *
-
-import gettext
-_ = lambda x: gettext.ldgettext("anaconda", x)
-
-import logging
-log = logging.getLogger("anaconda")
-
-class Firewall:
-    def __init__ (self):
-	self.enabled = 1
-        self.trustdevs = []
-	self.portlist = []
-        self.servicelist = []
-
-    def getArgList(self):
-	args = []
-
-        if not self.enabled:
-            args.append("--disabled")
-            return args
-
-        if not "ssh" in self.servicelist and not "22:tcp" in self.portlist:
-            args += ["--service=ssh"]
-
-        for dev in self.trustdevs:
-            args = args + [ "--trust=%s" %(dev,) ]
-
-	for port in self.portlist:
-	    args = args + [ "--port=%s" %(port,) ]
-
-        for service in self.servicelist:
-            args = args + [ "--service=%s" % (service,) ]
-
-	return args
-
-    def write (self):
-	args = [ "--quiet", "--nostart", "-f" ] + self.getArgList()
-
-        try:
-            if not os.path.exists("%s/etc/sysconfig/iptables" %(ROOT_PATH,)):
-                iutil.execWithRedirect("/usr/sbin/lokkit", args,
-                                       root=ROOT_PATH, stdout="/dev/null",
-                                       stderr="/dev/null")
-            else:
-                log.error("would have run %s", args)
-        except (RuntimeError, OSError) as msg:
-            log.error ("lokkit run failed: %s", msg)
-        else:
-            f = open(ROOT_PATH +
-                     '/etc/sysconfig/system-config-firewall', 'w')
-            f.write("# system-config-firewall config written out by anaconda\n\n")
-            for arg in args[3:]:
-                f.write("%s\n" %(arg,))
-            f.close()
diff --git a/pyanaconda/install.py b/pyanaconda/install.py
index b716364..3192862 100644
--- a/pyanaconda/install.py
+++ b/pyanaconda/install.py
@@ -58,6 +58,7 @@ def doConfiguration(storage, payload, ksdata, instClass):
         ksdata.keyboard.execute(storage, ksdata, instClass)
         ksdata.timezone.execute(storage, ksdata, instClass)
         ksdata.lang.execute(storage, ksdata, instClass)
+        ksdata.firewall.execute(storage, ksdata, instClass)
 
     with progress_report(_("Writing network configuration")):
         writeNetworkConf(storage, ksdata, instClass)
@@ -107,7 +108,7 @@ def doInstall(storage, payload, ksdata, instClass):
     # anaconda requires storage packages in order to make sure the target
     # system is bootable and configurable, and some other packages in order
     # to finish setting up the system.
-    packages = storage.packages + ["authconfig", "system-config-firewall-base"]
+    packages = storage.packages + ["authconfig", "firewalld"]
     payload.preInstall(packages=packages, groups=payload.languageGroups(ksdata.lang.lang))
     payload.install()
 
diff --git a/pyanaconda/kickstart.py b/pyanaconda/kickstart.py
index 18b04c0..639527c 100644
--- a/pyanaconda/kickstart.py
+++ b/pyanaconda/kickstart.py
@@ -452,6 +452,37 @@ class Fcoe(commands.fcoe.F13_Fcoe):
 
         return fc
 
+class Firewall(commands.firewall.F14_Firewall):
+    def execute(self, storage, ksdata, instClass):
+        args = []
+        # enabled is None is neither --enable or --disable is passed
+        # default to enabled if nothing has been set.
+        if self.enabled == False:
+            args += ["--disabled"]
+        else:
+            args += ["--enabled"]
+
+        if not "ssh" in self.services and not "22:tcp" in self.ports:
+            args += ["--service=ssh"]
+
+        for dev in self.trusts:
+            args += [ "--trust=%s" % (dev,) ]
+
+        for port in self.ports:
+            args += [ "--port=%s" % (port,) ]
+
+        for service in self.services:
+            args += [ "--service=%s" % (service,) ]
+
+        cmd = "/usr/bin/firewall-convert-scfw-config" 
+        if not os.path.exists(ROOT_PATH+cmd):
+            msg = _("%s is missing. Cannot setup firewall.") % (cmd,)
+            raise KickstartError(msg)
+        else:
+            iutil.execWithRedirect(cmd, args,
+                                   stdout="/dev/tty5", stderr="/dev/tty5",
+                                   root=ROOT_PATH)
+
 class Firstboot(commands.firstboot.FC3_Firstboot):
     def execute(self, *args):
         if not os.path.exists(ROOT_PATH + "/lib/systemd/system/firstboot-graphical.service"):
@@ -1385,6 +1416,7 @@ commandMap = {
         "clearpart": ClearPart,
         "dmraid": DmRaid,
         "fcoe": Fcoe,
+        "firewall": Firewall,
         "firstboot": Firstboot,
         "group": Group,
         "ignoredisk": IgnoreDisk,
diff --git a/tests/pyanaconda_test/firewall_test.py b/tests/pyanaconda_test/firewall_test.py
deleted file mode 100644
index 19c4554..0000000
--- a/tests/pyanaconda_test/firewall_test.py
+++ /dev/null
@@ -1,41 +0,0 @@
-import mock
-
-class FirewallTest(mock.TestCase):
-    def setUp(self):
-        self.setupModules(["_isys", "block", "ConfigParser"])
-
-        self.fs = mock.DiskIO()
-
-        import pyanaconda.firewall
-
-        self.modifiedModule("pyanaconda.firewall")
-        self.modifiedModule("os.path")
-
-        pyanaconda.firewall.open = self.fs.open
-        pyanaconda.firewall.log = mock.Mock()
-        pyanaconda.firewall.iutil = mock.Mock()
-        pyanaconda.firewall.os = mock.Mock()
-        pyanaconda.firewall.os.path = mock.Mock()
-        pyanaconda.firewall.os.path.exists = self.fs.os_path_exists
-
-    def tearDown(self):
-        self.tearDownModules()
-
-    def default_write_test(self):
-        import pyanaconda.firewall
-        fw = pyanaconda.firewall.Firewall()
-        fw.write()
-
-        self.assertEqual(pyanaconda.firewall.iutil.method_calls, [
-            ("execWithRedirect",
-             (
-                 "/usr/sbin/lokkit",
-                 [ "--quiet", "--nostart", "-f", "--service=ssh" ]
-                 ),
-             {
-                 "root": "/mnt/sysimage",
-                 "stdout": "/dev/null",
-                 "stderr": "/dev/null",
-                 }
-             )
-            ])
-- 
1.7.11.4



More information about the anaconda-patches mailing list