RFC: Firewalld provider model

Jan Synacek jsynacek at redhat.com
Fri Aug 22 12:28:43 UTC 2014


Radek Novacek <rnovacek at redhat.com> writes:
> Hi,
>
> I've been recently working on design of OpenLMI Firewalld provider model. 
> The model is loosely based on firewalld API but adjusted to provide CIM-like 
> look&feel.
>
> Note that firewalld API is fairly complex so there might be some 
> adjustments in the model as I will write the provider itself.
>
> Design document:
> https://rnovacek.fedorapeople.org/openlmi-firewalld/v1/html/design.html
>
> MOF file:
> https://rnovacek.fedorapeople.org/openlmi-firewalld/v1/60_LMI_Firewalld.html
>
> The model is not yet fully complete, for example indications, lockdown, 
> panic mode and reconfiguration are not there yet. Some of them will be 
> added in the future (indication support), some needs to be evaluated 
> whether they're useful to have at all.
>
> Suggestions and comments are welcome.
>
> Radek Novacek

* Model comments *

Could LMI_FirewalldPort be a parent to LMI_FirewalldForwardPort?

In LMI_FirewalldPort, I suggest renaming the Port(*) properties to
something like PortRangeLow, PortRangeHigh, or similar. It's not clear
now that it means that.

LMI_FirewalldICMPType and LMI_FirewalldService both have
IPv{4,6}Destination as a property, but of different types. Maybe rename
the one in LMI_FirewalldICMPType? To something like IPv{4,6}? It would
resemble what it looks like in the XML.

I could imagine that there will be a huge pile of LMI_FirewalldRule
instances linked together with LMI_FirewalldComponent associations
because of how the inheritance is designed now. That is,
LMI_FirewalldRule is a parent and ICMPType, Source, Port, etc. are
children. I'm not sure how to make it any simpler, though.

Is there an LMI_FirewalldDestination class missing? There is a
LMI_FirewalldSource, but no destination.

Both LMI_HostedFirewalldICMPType and LMI_HostedFirewalldDirect do the
same thing. I don't think that both are needed.

It feels like there are too many *Hosted* classes and some of them
aren't really needed. LMI_HostedFirewalldService looks like one.


* Instance diagram comments *

LMI_FirewalldService.Name should be "DHCPv6 Client" (typo).


* MOF comments *

LMI_FirewalldZone:
  + s/will reject all packet/will reject all packets/
  + The "No Target" options feels superfluous to me.

-- 
Jan Synacek
Software Engineer, Red Hat


More information about the openlmi-devel mailing list