[PATCH 2/2] Added zone.changeZoneOfInterface(zone, interface)

Jiri Popelka jpopelka at redhat.com
Wed Feb 29 17:02:44 UTC 2012


This function changes a zone the interface is part of.
Because when for example NetworkManager
wants to change the zone the interface belongs to it would otherwise
need to call removeInterface(old_zone, interface) followed by
addInterface(new_zone, interface).
---
 src/firewall-cmd                 |    8 +++++---
 src/firewall/client.py           |    4 ++++
 src/firewall/core/fw_zone.py     |   17 +++++++++++++++++
 src/firewall/server/firewalld.py |   21 +++++++++++++++++++++
 4 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/src/firewall-cmd b/src/firewall-cmd
index 5759508..9163680 100755
--- a/src/firewall-cmd
+++ b/src/firewall-cmd
@@ -71,7 +71,7 @@ try:
                         "get-zones", "get-active-zones",
                         "get-zone-of-interface=",
                         # modes (exactly one of those)
-                         "add", "remove","enable", "disable", "query", "list=",
+                         "add", "change", "remove","enable", "disable", "query", "list=",
                         # zone
                         "zone=",
                         # actions (exactly one of those)
@@ -133,7 +133,7 @@ for (opt, val) in opts:
             __fail("Timeout not valid")
 
     # mode
-    elif opt in [ "--enable", "--disable", "--query", "--add", "--remove" ]:
+    elif opt in [ "--enable", "--disable", "--query", "--add", "--change", "--remove" ]:
         if mode:
             __fail()
         mode = opt[2:]
@@ -174,7 +174,7 @@ if mode not in [ "version", "reload", "complete-reload", "state",
         __fail("No value.")
 
 if action in [ "interface", "service", "port", "forward-port", "icmp-block" ]:
-    if mode not in [ "add", "remove", "query", "list" ]:
+    if mode not in [ "add", "change", "remove", "query", "list" ]:
         __fail(_("Wrong action and mode combination"))
 elif action == "masquerade" and mode not in [ "enable", "disable", "query" ]:
     __fail(_("Wrong action and mode combination"))
@@ -242,6 +242,8 @@ try:
                     print(", ".join(l))
             elif mode == "add":
                 fw.addInterface(zone, value)
+            elif mode == "change":
+                fw.changeZoneOfInterface(zone, value)
             elif mode == "remove":
                 fw.removeInterface(zone, value)
             elif mode == "query":
diff --git a/src/firewall/client.py b/src/firewall/client.py
index f6ccc31..34398bc 100644
--- a/src/firewall/client.py
+++ b/src/firewall/client.py
@@ -112,6 +112,10 @@ class FirewallClient(object):
         return dbus_to_python(self.fw_zone.addInterface(zone, interface))
 
     @slip.dbus.polkit.enable_proxy
+    def changeZoneOfInterface(self, zone, interface):
+        return dbus_to_python(self.fw_zone.changeZoneOfInterface(zone, interface))
+
+    @slip.dbus.polkit.enable_proxy
     def getInterfaces(self, zone):
         return dbus_to_python(self.fw_zone.getInterfaces(zone))
 
diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
index 71d62d4..6778f75 100644
--- a/src/firewall/core/fw_zone.py
+++ b/src/firewall/core/fw_zone.py
@@ -314,6 +314,23 @@ class FirewallZone:
 
         return _zone
 
+    def change_zone_of_interface(self, zone, interface, sender=None):
+        self._fw.check_panic()
+        _old_zone = self.get_zone_of_interface(interface)
+        _new_zone = self._fw.check_zone(zone)
+        _obj = self._zones[_new_zone]
+        interface_id = self.__interface_id(interface)
+
+        if _new_zone == _old_zone:
+            raise FirewallError(ZONE_ALREADY_SET)
+
+        if _old_zone != None:
+            self.remove_interface(_old_zone, interface)
+
+        self.add_interface(_new_zone, interface, sender)
+
+        return _new_zone
+
     def remove_interface(self, zone, interface):
         self._fw.check_panic()
         _zone = self._fw.check_zone(zone)
diff --git a/src/firewall/server/firewalld.py b/src/firewall/server/firewalld.py
index 54e749f..2c59f3f 100644
--- a/src/firewall/server/firewalld.py
+++ b/src/firewall/server/firewalld.py
@@ -344,6 +344,21 @@ class FirewallD(dbus.service.Object):
     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='ss',
                          out_signature='s')
     @dbus_handle_exceptions
+    def changeZoneOfInterface(self, zone, interface, sender=None):
+        """Change a zone an interface is part of.
+        If zone is empty, use default zone.
+        """
+        interface = str(interface)
+        log.debug1("zone.changeZoneOfInterface('%s', '%s')" % (zone, interface))
+        _zone = self.fw.zone.change_zone_of_interface(zone, interface, sender)
+
+        self.ZoneOfInterfaceChanged(_zone, interface)
+        return _zone
+
+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG)
+    @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='ss',
+                         out_signature='s')
+    @dbus_handle_exceptions
     def removeInterface(self, zone, interface, sender=None):
         """Remove interface from a zone.
         If zone is empty, use default zone.
@@ -386,6 +401,12 @@ class FirewallD(dbus.service.Object):
 
     @dbus.service.signal(DBUS_INTERFACE_ZONE, signature='ss')
     @dbus_handle_exceptions
+    def ZoneOfInterfaceChanged(self, zone, interface):
+        log.debug1("zone.ZoneOfInterfaceChanged('%s', '%s')" % (zone, interface))
+        pass
+
+    @dbus.service.signal(DBUS_INTERFACE_ZONE, signature='ss')
+    @dbus_handle_exceptions
     def InterfaceRemoved(self, zone, interface):
         log.debug1("zone.InterfaceRemoved('%s', '%s')" % (zone, interface))
         pass
-- 
1.7.7.6



More information about the firewalld-devel mailing list