OpenLMI Firewall Model

Russell Doty rdoty at redhat.com
Thu Jan 30 15:21:09 UTC 2014


On Thu, 2014-01-30 at 15:41 +0100, Jan Safranek wrote:
> On 01/30/2014 03:26 PM, Radek Novacek wrote:
> > Hi,
> > 
> > I'm going to write a provider for firewall as a part of OpenLMI project. 
> > 
> > My current plan is to use FirewallD (via DBus) as a backend for this provider.
> > 
> > 
> > I'm now facing the most difficult part: Model.
> > 
> > As far as I know there is no DMTF profile for firewall. There are few classes 
> > in the CIM schema that seem to describe some kind of firewall (see page 11 of 
> > [1]), but they're not applicable to describe neither iptables nor firewalld (I 
> > couldn't figure out how to model rule ordering in chain with given classes).
> > 
> > 
> > I can see a couple of options what to do with this problem:
> > 
> > 1) Model FirewallD API closely
> > 
> > Using same model as underlying service has one big advantage - it doesn't 
> > disrupt local configuration - one can use both remote and local API (command 
> > line, GUI) simultaneously, and one big disadvantage - model won't be 
> > compatible with other firewall implementations.
> > 
> > 
> > 2) Reuse as much of existing model (CIM classes) as possible
> > 
> > We could take what's already there and alter it to suit our needs, but I'm 
> > afraid that the result will be quite ugly. And it still won't be compatible 
> > with others.
> > 
> > 
> > 3) Try to create new model that would be (more) universal
> > 
> > It might be possible to create a model that would cover some common 
> > functionality of typical firewall on normal linux box (not some specialized 
> > firewall device), but it would be a lot of work and still it wouldn't cover 
> > advanced features of all firewall solutions out there.
> > 
> > 
> > 4) Some other approach
> > 
> > Feel free to suggest something.
> > 
> > 
> > Personally, I would go with 1). There is no model that would bring 
> > compatibility with other systems, so IMHO it would be best to create model 
> > that will be simple and understandable and it's usage won't disrupt other 
> > usage (cmdline, gui, ...).
> 
> Yes, 1) is my favorite too. IMHO there is no CIM firewall management
> implementation we know about and we want to be compatible with. So let's
> model it around _our_ firewall mgmt tools, which is currently firewalld.
This approach has Product Management approval.

Russ
> 
> Jan
> 
> _______________________________________________
> openlmi-devel mailing list
> openlmi-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/openlmi-devel




More information about the openlmi-devel mailing list