OpenLMI Firewall Model
Russell Doty
rdoty at redhat.com
Thu Jan 30 15:21:09 UTC 2014
On Thu, 2014-01-30 at 15:41 +0100, Jan Safranek wrote:
> On 01/30/2014 03:26 PM, Radek Novacek wrote:
> > Hi,
> >
> > I'm going to write a provider for firewall as a part of OpenLMI project.
> >
> > My current plan is to use FirewallD (via DBus) as a backend for this provider.
> >
> >
> > I'm now facing the most difficult part: Model.
> >
> > As far as I know there is no DMTF profile for firewall. There are few classes
> > in the CIM schema that seem to describe some kind of firewall (see page 11 of
> > [1]), but they're not applicable to describe neither iptables nor firewalld (I
> > couldn't figure out how to model rule ordering in chain with given classes).
> >
> >
> > I can see a couple of options what to do with this problem:
> >
> > 1) Model FirewallD API closely
> >
> > Using same model as underlying service has one big advantage - it doesn't
> > disrupt local configuration - one can use both remote and local API (command
> > line, GUI) simultaneously, and one big disadvantage - model won't be
> > compatible with other firewall implementations.
> >
> >
> > 2) Reuse as much of existing model (CIM classes) as possible
> >
> > We could take what's already there and alter it to suit our needs, but I'm
> > afraid that the result will be quite ugly. And it still won't be compatible
> > with others.
> >
> >
> > 3) Try to create new model that would be (more) universal
> >
> > It might be possible to create a model that would cover some common
> > functionality of typical firewall on normal linux box (not some specialized
> > firewall device), but it would be a lot of work and still it wouldn't cover
> > advanced features of all firewall solutions out there.
> >
> >
> > 4) Some other approach
> >
> > Feel free to suggest something.
> >
> >
> > Personally, I would go with 1). There is no model that would bring
> > compatibility with other systems, so IMHO it would be best to create model
> > that will be simple and understandable and it's usage won't disrupt other
> > usage (cmdline, gui, ...).
>
> Yes, 1) is my favorite too. IMHO there is no CIM firewall management
> implementation we know about and we want to be compatible with. So let's
> model it around _our_ firewall mgmt tools, which is currently firewalld.
This approach has Product Management approval.
Russ
>
> Jan
>
> _______________________________________________
> openlmi-devel mailing list
> openlmi-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/openlmi-devel
More information about the openlmi-devel
mailing list