RFC: Firewalld provider model

Jan Safranek jsafrane at redhat.com
Wed Aug 27 13:59:18 UTC 2014


On 08/21/2014 04:30 PM, Radek Novacek wrote:
> Design document:
> 
> https://rnovacek.fedorapeople.org/openlmi-firewalld/v1/html/design.html
> 
> MOF file:
> 
> https://rnovacek.fedorapeople.org/openlmi-firewalld/v1/60_LMI_Firewalld.html
> 
>  
> 
> The model is not yet fully complete, for example indications, lockdown,
> panic mode and reconfiguration are not there yet. Some of them will be
> added in the future (indication support), some needs to be evaluated
> whether they're useful to have at all.
> 
>  
> 
> Suggestions and comments are welcome.

Hello,

thanks for the proposal. Here come my remarks:

1) Association classes are done differently in UML. In plantuml:

class CIM_ComputerSystem
class LMI_FirewallConfigurationService
class LMI_HostedService
(CIM_ComputerSystem, LMI_FirewallConfigurationService) .. LMI_HostedService

http://codeuml.com/?635447417355422516

Now it's hard to see what's a real class and what's an association.


2) I don't like LMI_HostedFirewalldService association.
CIM_HostedService connects ComputerSystem with services, that manage
something and the name of LMI_HostedFirewalldService implies it inherits
it. In addition, the rest of the rules are not connected to
ComputerSystem either,

3) I miss some example with one service in multiple zones - will there
be one LMI_FirewalldService instance for both zones or will each zone
have separate instance?

In the first case, how do you disable this service in one zone, leaving
it in the other one? LMI_FirewalldService.DeleteInstance() will remove
the instance, not the association to zone.

In the second case, what if I add a port to only one instance? Thy are
independent instances, so from CIM point of view it should be possible.
IMO firewalld does not allow this.


3) Manipulation with the rules is not atomic. e.g. in "3.2.4 Forward
port", one creates a new rule with zone.AddForwardPort(). After the
method call:
- is the incomplete rule added to firewall?
- where does it send packets to?
- what if the client crashes before it adds a destination address/port?
- how to find these incomplete rules?

The same applies to "3.2.3 Opening a range of ports" - by calling
zone.AddPort() you must add one port to the firewall. By rule.push() you
must remove it (!) and add a new rule with a port range. This looks messy.

I think we should only insert complete rules to the firewall, without
intermediate objects.

4) What is the purpose of LMI_FirewalldRuleComponent association? Why
can LMI_FirewalldPort have a subcomponents, e.g. a service or ICMPType?
Shouldn't LMI_FirewalldRuleComponent associate only rules to
LMI_FirewalldService?

5) How to add rules to a service? There is
LMI_FirewalldService.AddPort(), which is pretty clear, but what does
LMI_FirewalldRule.AddRuleComponent() do? It must get an already existing
rule, associated to a zone or another LMI_FirewalldRule. Will the rule
_move_ to FirewalldRule and all previous associations will be removed,
or will it create a copy?


Jan


More information about the openlmi-devel mailing list