|
|
|
@ -16,11 +16,12 @@
|
|
|
|
|
# You should have received a copy of the GNU General Public License |
|
|
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>. |
|
|
|
|
# |
|
|
|
|
import dbus |
|
|
|
|
import os.path |
|
|
|
|
import socket |
|
|
|
|
import time |
|
|
|
|
|
|
|
|
|
from pydbus import SystemBus |
|
|
|
|
|
|
|
|
|
import sponson.configfile |
|
|
|
|
from sponson.constants import DNSMASQ_LEASES_FILE |
|
|
|
|
from sponson.constants import ETC_CONTAINER_CONF_DIR |
|
|
|
@ -50,13 +51,13 @@ class Firewall(object):
|
|
|
|
|
:param runtime_config: network runtime configuration. |
|
|
|
|
:type runtime_config: dict or None. |
|
|
|
|
""" |
|
|
|
|
self.bus = dbus.SystemBus() |
|
|
|
|
self.proxy = self.bus.get_object("org.fedoraproject.FirewallD1", |
|
|
|
|
"/org/fedoraproject/FirewallD1") |
|
|
|
|
self.firewalld_zone = dbus.Interface( |
|
|
|
|
self.proxy, "org.fedoraproject.FirewallD1.zone") |
|
|
|
|
self.firewalld = dbus.Interface(self.proxy, |
|
|
|
|
"org.fedoraproject.FirewallD1") |
|
|
|
|
self.bus = SystemBus() |
|
|
|
|
self.firewalld_proxy = self.bus.get("org.fedoraproject.FirewallD1", |
|
|
|
|
"/org/fedoraproject/FirewallD1") |
|
|
|
|
self.firewalld_zone = self.firewalld_proxy[ |
|
|
|
|
"org.fedoraproject.FirewallD1.zone"] |
|
|
|
|
self.firewalld = self.firewalld_proxy[ |
|
|
|
|
"org.fedoraproject.FirewallD1"] |
|
|
|
|
|
|
|
|
|
if runtime_config: |
|
|
|
|
self.default_zone = runtime_config.get( |
|
|
|
@ -64,20 +65,18 @@ class Firewall(object):
|
|
|
|
|
else: |
|
|
|
|
self.default_zone = self.firewalld.getDefaultZone() |
|
|
|
|
|
|
|
|
|
self.config_proxy = self.bus.get_object( |
|
|
|
|
self.firewalld_config = self.bus.get( |
|
|
|
|
"org.fedoraproject.FirewallD1", |
|
|
|
|
"/org/fedoraproject/FirewallD1/config") |
|
|
|
|
self.config_interface = dbus.Interface( |
|
|
|
|
self.config_proxy, "org.fedoraproject.FirewallD1.config") |
|
|
|
|
"/org/fedoraproject/FirewallD1/config")[ |
|
|
|
|
"org.fedoraproject.FirewallD1.config"] |
|
|
|
|
|
|
|
|
|
default_zone_object_path = self.config_interface.getZoneByName( |
|
|
|
|
default_zone_object_path = self.firewalld_config.getZoneByName( |
|
|
|
|
self.default_zone) |
|
|
|
|
|
|
|
|
|
self.default_zone_config_proxy = self.bus.get_object( |
|
|
|
|
"org.fedoraproject.FirewallD1", default_zone_object_path) |
|
|
|
|
self.default_zone_config = dbus.Interface( |
|
|
|
|
self.default_zone_config_proxy, |
|
|
|
|
"org.fedoraproject.FirewallD1.config.zone") |
|
|
|
|
self.firewalld_default_zone_config = self.bus.get( |
|
|
|
|
"org.fedoraproject.FirewallD1", |
|
|
|
|
default_zone_object_path)[ |
|
|
|
|
"org.fedoraproject.FirewallD1.config.zone"] |
|
|
|
|
|
|
|
|
|
def config_string_to_dict(self, config): |
|
|
|
|
""" |
|
|
|
@ -162,7 +161,7 @@ class Firewall(object):
|
|
|
|
|
""" |
|
|
|
|
Create the bridge firewall zone. |
|
|
|
|
""" |
|
|
|
|
self.config_interface.addZone(FIREWALL_ZONE, FIREWALL_ZONE_CONF) |
|
|
|
|
self.firewalld_config.addZone(FIREWALL_ZONE, FIREWALL_ZONE_CONF) |
|
|
|
|
|
|
|
|
|
self.firewalld.reload() |
|
|
|
|
|
|
|
|
@ -175,8 +174,8 @@ class Firewall(object):
|
|
|
|
|
richrule): |
|
|
|
|
self.firewalld_zone.addRichRule(self.default_zone, richrule, 0) |
|
|
|
|
|
|
|
|
|
if not self.default_zone_config.queryRichRule(richrule): |
|
|
|
|
self.default_zone_config.addRichRule(richrule) |
|
|
|
|
if not self.firewalld_default_zone_config.queryRichRule(richrule): |
|
|
|
|
self.firewalld_default_zone_config.addRichRule(richrule) |
|
|
|
|
|
|
|
|
|
def sanity_checks(self): |
|
|
|
|
""" |
|
|
|
|