OpenLMI Firewall Model

Russell Doty rdoty at redhat.com
Fri Jan 31 14:56:06 UTC 2014


On Fri, 2014-01-31 at 09:44 -0500, Stephen Gallagher wrote:
> 
> > On Jan 31, 2014, at 1:21 PM, Tomáš Smetana <tsmetana at redhat.com> wrote:
> > 
> > On Thu, 30 Jan 2014 15:41:47 +0100
> > Jan Safranek <jsafrane at redhat.com> wrote:
> > 
> >> On 01/30/2014 03:26 PM, Radek Novacek wrote:
> > 
> > <...>
> > 
> >>> 1) Model FirewallD API closely
> >>> 
> >>> Using same model as underlying service has one big advantage - it doesn't 
> >>> disrupt local configuration - one can use both remote and local API
> >>> (command line, GUI) simultaneously, and one big disadvantage - model
> >>> won't be compatible with other firewall implementations.
> > 
> > <...>
> > 
> >>> Personally, I would go with 1). There is no model that would bring 
> >>> compatibility with other systems, so IMHO it would be best to create
> >>> model that will be simple and understandable and it's usage won't disrupt
> >>> other usage (cmdline, gui, ...).
> >> 
> >> Yes, 1) is my favorite too. IMHO there is no CIM firewall management
> >> implementation we know about and we want to be compatible with. So let's
> >> model it around _our_ firewall mgmt tools, which is currently firewalld.
> > 
> > Firewalld is (still) very Fedora-specific tool, whereas a firewall management
> > is quite universally demanded feature.  Even though it's probably a bit
> > premature consideration: we may make it harder for OpenLMI to become part of
> > other distributions.
> > 
> > But since the firewall provider is going to be difficult enough anyway I
> > don't have that strong opinion on reflecting the firewalld API in the
> > model.
> > 
> > 
> 
> 
> My recommendation is to follow 1) but name it the FirewallD provider instead of simply the firewall provider. It makes it very clear what it supports while also offering us the ability to build a more generic Firewall provider in the future (one that might be a wrapper for distro-specific tools).
Good suggestion - any objections to doing this?
> 
> Also, Russ: can you look into whether any of Cisco, et al have a CIM interface to their firewall/router appliances? We may want to see if a de facto standard already exists. 
Doubtful, but we can check.
> _______________________________________________
> openlmi-devel mailing list
> openlmi-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/openlmi-devel




More information about the openlmi-devel mailing list