About the firewall provider

Tomáš Smetana tsmetana at redhat.com
Mon Feb 4 12:12:53 UTC 2013


Hello,
  I think it might be useful to dump my ideas about the firewall provider
here to see what the others think.

I was looking at the DMTF standard models for the packet filtering: There is
a FilterList class to aggregate FilterEntryBase classes (or their
descendants).  All the FilterEntryBase items are ANDed in the list (no notion
of "chain").  Given there is no "management" class that would allow altering
the filters and the lists we will need to create proprietary ones for this
purpose.  Since we've decided to rely on the firewalld as the backend the
management classes would probably need to copy the Firewalld API to some
extent.  I'm inclined to think this provider is one of those where the
standard model is simply unsuitable.

The other problem is: our Trac says [0] (it's quite vague otherwise) the first
version of the firewall provider is scheduled to Milestone 1. Looking at the
firewalld development I'm almost sure whatever we create by then would have
to be rewritten anyway. Do we want to move the ticket deadline?

Regards,
-- 
Tomáš Smetana
Base OS Engineering, Red Hat

[0] https://fedorahosted.org/openlmi/ticket/23


More information about the openlmi-devel mailing list