Class: Yast::SuSEFirewallServicesClass
- Inherits:
-
Module
- Object
- Module
- Yast::SuSEFirewallServicesClass
- Defined in:
- ../../src/modules/SuSEFirewallServices.rb
Instance Method Summary (collapse)
-
- (String) GetDescription(service)
Function returns description of a firewall service.
-
- (String) GetFilenameFromServiceDefinedByPackage(service)
Creates a file name from service name defined by package.
-
- (Array<String>) GetListOfServicesAddedByPackage
Returns list of service-ids defined by packages.
-
- (Yast::Term) GetMetadataAgent(filefullpath)
Returns SCR Agent definition.
-
- (Boolean) GetModified
Returns whether configuration was modified.
-
- (Array<String>) GetNeededBroadcastPorts(service)
Function returns needed ports allowing broadcast.
-
- (Array<String>) GetNeededIPProtocols(service)
Function returns needed IP protocols for service.
-
- (Hash{String => Array<String>}) GetNeededPortsAndProtocols(service)
Function returns needed ports and protocols for service.
-
- (Array<String>) GetNeededRPCPorts(service)
Function returns needed RPC ports for service.
-
- (Array<String>) GetNeededTCPPorts(service)
Function returns needed TCP ports for service.
-
- (Array<String>) GetNeededUDPPorts(service)
Function returns needed UDP ports for service.
-
- (Array<String>) GetPossiblyConflictServices
Function returns list of possibly conflicting services.
-
- (Hash{String => String}) GetSupportedServices
Function returns the map of supported (known) services.
-
- (Boolean) IsKnownService(service_id)
Function returns if the service_id is a known (defined) service.
- - (Object) main
-
- (Boolean) ReadServicesDefinedByRPMPackages
Reads definition of services that can be used in FW_CONFIGURATIONS_ in SuSEfirewall2.
-
- (Object) ResetModified
Sets that configuration was not modified.
-
- (Boolean) ServiceDefinedByPackage(service)
Returns whether the service ID is defined by package.
-
- (Object) SetModified
Sets that configuration was modified.
-
- (Boolean) SetNeededPortsAndProtocols(service, store_definition)
Immediately writes the configuration of service defined by package to the service definition file.
Instance Method Details
- (String) GetDescription(service)
Function returns description of a firewall service
520 521 522 |
# File '../../src/modules/SuSEFirewallServices.rb', line 520 def GetDescription(service) Ops.get_string(@SERVICES, [service, "description"], "") end |
- (String) GetFilenameFromServiceDefinedByPackage(service)
Creates a file name from service name defined by package. Service MUST be defined by package, otherwise it returns 'nil'.
GetFilenameFromServiceDefinedByPackage (“service:abc”) -> “abc” GetFilenameFromServiceDefinedByPackage ("abc") -> nil
274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 |
# File '../../src/modules/SuSEFirewallServices.rb', line 274 def GetFilenameFromServiceDefinedByPackage(service) if !ServiceDefinedByPackage(service) Builtins.y2error("Service %1 is not defined by package", service) return nil end ret = Builtins.regexpsub( service, Ops.add(Ops.add("^", @ser_def_by_pkg_string), "(.*)$"), "\\1" ) Builtins.y2error("Wrong regexpsub definition") if ret == nil ret end |
- (Array<String>) GetListOfServicesAddedByPackage
Returns list of service-ids defined by packages.
474 475 476 477 478 479 480 481 482 |
# File '../../src/modules/SuSEFirewallServices.rb', line 474 def GetListOfServicesAddedByPackage ret = Builtins.maplist(@SERVICES) do |service_id, service_definition| service_id end ret = Builtins.filter(ret) do |service_id| ServiceDefinedByPackage(service_id) end deep_copy(ret) end |
- (Yast::Term) GetMetadataAgent(filefullpath)
Returns SCR Agent definition.
294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 |
# File '../../src/modules/SuSEFirewallServices.rb', line 294 def GetMetadataAgent(filefullpath) term( :IniAgent, filefullpath, { "options" => [ "global_values", "flat", "read_only", "ignore_case_regexps" ], "comments" => [ # jail followed by anything but jail (immediately) "^[ \t]*#[^#].*$", # jail alone "^[ \t]*\#$", # (empty space) "^[ \t]*$", # sysconfig entries "^[ \t]*[a-zA-Z0-9_]+.*" ], "params" => [ { "match" => ["^##[ \t]*([^:]+):[ \t]*(.*)[ \t]*$", "%s: %s"] } ] } ) end |
- (Boolean) GetModified
Returns whether configuration was modified
541 542 543 |
# File '../../src/modules/SuSEFirewallServices.rb', line 541 def GetModified @sfws_modified end |
- (Array<String>) GetNeededBroadcastPorts(service)
Function returns needed ports allowing broadcast
549 550 551 |
# File '../../src/modules/SuSEFirewallServices.rb', line 549 def GetNeededBroadcastPorts(service) Ops.get_list(@SERVICES, [service, "broadcast_ports"], []) end |
- (Array<String>) GetNeededIPProtocols(service)
Function returns needed IP protocols for service
512 513 514 |
# File '../../src/modules/SuSEFirewallServices.rb', line 512 def GetNeededIPProtocols(service) Ops.get_list(@SERVICES, [service, "ip_protocols"], []) end |
- (Hash{String => Array<String>}) GetNeededPortsAndProtocols(service)
Function returns needed ports and protocols for service. Function cares about if the service is defined or not.
GetNeededPortsAndProtocols (“service:aaa”) -> $[ “tcp_ports” : [ “122”, “ftp-data” ], “udp_ports” : [ “427” ], “rpc_ports” : [ “portmap”, “ypbind” ], “ip_protocols” : [], “broadcast_ports” : [ “427” ], ];
567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 |
# File '../../src/modules/SuSEFirewallServices.rb', line 567 def GetNeededPortsAndProtocols(service) needed = {} # Service defined by package, not known now # Reading new definitions if ServiceDefinedByPackage(service) && !IsKnownService(service) Builtins.y2milestone( "Service %1 is not known, searching for new definitions...", service ) ReadServicesDefinedByRPMPackages() end if !IsKnownService(service) Builtins.y2error("Uknown service '%1'", service) Builtins.y2milestone("Known services: %1", @SERVICES) return nil end Ops.set(needed, "tcp_ports", GetNeededTCPPorts(service)) Ops.set(needed, "udp_ports", GetNeededUDPPorts(service)) Ops.set(needed, "rpc_ports", GetNeededRPCPorts(service)) Ops.set(needed, "ip_protocols", GetNeededIPProtocols(service)) Ops.set(needed, "broadcast_ports", GetNeededBroadcastPorts(service)) deep_copy(needed) end |
- (Array<String>) GetNeededRPCPorts(service)
Function returns needed RPC ports for service
504 505 506 |
# File '../../src/modules/SuSEFirewallServices.rb', line 504 def GetNeededRPCPorts(service) Ops.get_list(@SERVICES, [service, "rpc_ports"], []) end |
- (Array<String>) GetNeededTCPPorts(service)
Function returns needed TCP ports for service
488 489 490 |
# File '../../src/modules/SuSEFirewallServices.rb', line 488 def GetNeededTCPPorts(service) Ops.get_list(@SERVICES, [service, "tcp_ports"], []) end |
- (Array<String>) GetNeededUDPPorts(service)
Function returns needed UDP ports for service
496 497 498 |
# File '../../src/modules/SuSEFirewallServices.rb', line 496 def GetNeededUDPPorts(service) Ops.get_list(@SERVICES, [service, "udp_ports"], []) end |
- (Array<String>) GetPossiblyConflictServices
Function returns list of possibly conflicting services. Conflicting services are for instance nis-client and nis-server. DEPRECATED - we currently don't have such services - services are defined by packages.
728 729 730 |
# File '../../src/modules/SuSEFirewallServices.rb', line 728 def GetPossiblyConflictServices [] end |
- (Hash{String => String}) GetSupportedServices
Function returns the map of supported (known) services.
Structure:
452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 |
# File '../../src/modules/SuSEFirewallServices.rb', line 452 def GetSupportedServices supported_services = {} Builtins.foreach(@SERVICES) do |service_id, service_definition| Ops.set( supported_services, service_id, # TRANSLATORS: Name of unknown service. This should never happen, just for cases..., %1 is a requested service id like nis-server Ops.get_string( service_definition, "name", Builtins.sformat(_("Unknown service '%1'"), service_id) ) ) end deep_copy(supported_services) end |
- (Boolean) IsKnownService(service_id)
Function returns if the service_id is a known (defined) service
431 432 433 434 435 436 437 |
# File '../../src/modules/SuSEFirewallServices.rb', line 431 def IsKnownService(service_id) if Ops.get(@SERVICES, service_id, {}) == {} return false else return true end end |
- (Object) main
38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 |
# File '../../src/modules/SuSEFirewallServices.rb', line 38 def main textdomain "base" Yast.import "FileUtils" # # # PLEASE, DO NOT ADD MORE SERVICES. # ADD THE SERVICE DEFINITION TO THE PACKAGE TO WHICH IT BELONGS. # USE /etc/sysconfig/SuSEfirewall2.d/services/TEMPLATE FOR THAT. # MORE INFORMATION IN FEATURE #300687: Ports for SuSEfirewall added via packages. # ANOTHER REFERENCE: Bugzilla #246911. # # See also http://en.opensuse.org/SuSEfirewall2/Service_Definitions_Added_via_Packages # #** # Names assigned to Port and Protocol numbers can be found # here: # # http://www.iana.org/assignments/protocol-numbers # http://www.iana.org/assignments/port-numbers # # Format of SERVICES # # "service-id" : $[ # "name" : _("Service Name"), # "tcp_ports" : list <tcp_ports>, # "udp_ports" : list <udp_ports>, # "rpc_ports" : list <rpc_ports>, # "ip_protocols" : list <ip_protocols>, # "broadcast_ports" : list <broadcast_ports>, # ], # @services_definitions_in = "/etc/sysconfig/SuSEfirewall2.d/services/" # please, check it with configuration in refresh-srv-def-by-pkgs-trans.sh script @fw_services_textdomain = "firewall-services" # firewall needs restarting @sfws_modified = false @known_services_features = { "TCP" => "tcp_ports", "UDP" => "udp_ports", "RPC" => "rpc_ports", "IP" => "ip_protocols", "BROADCAST" => "broadcast_ports" } @known_metadata = { "Name" => "name", "Description" => "description" } # this is how services defined by package are distinguished @ser_def_by_pkg_string = "service:" # Services definitions for conversion to the new ones. @OLD_SERVICES = { "http" => { "tcp_ports" => ["http"], "convert_to" => ["service:apache2", "service:lighttpd"] }, "https" => { "tcp_ports" => ["https"], "convert_to" => ["service:apache2-ssl", "service:lighttpd-ssl"] }, "smtp" => { "tcp_ports" => ["smtp"], "convert_to" => [] }, "pop3" => { "tcp_ports" => ["pop3"], "convert_to" => [] }, "pop3s" => { "tcp_ports" => ["pop3s"], "convert_to" => [] }, "imap" => { "tcp_ports" => ["imap"], "convert_to" => ["service:courier-imapd"] }, "imaps" => { "tcp_ports" => ["imaps"], "convert_to" => ["service:courier-imap-ssl"] }, "samba-server" => { "tcp_ports" => ["netbios-ssn", "microsoft-ds"], # TCP: 139, 445 "udp_ports" => ["netbios-ns", "netbios-dgm"], # UDP: 137, 138 "broadcast_ports" => ["netbios-ns", "netbios-dgm"], # UDP: 137, 138 "convert_to" => [] }, "ssh" => { "tcp_ports" => ["ssh"], "convert_to" => ["service:sshd"] }, "rsync" => { "tcp_ports" => ["rsync"], "convert_to" => [] }, "dhcp-server" => { "udp_ports" => ["bootps"], "broadcast_ports" => ["bootps"], "convert_to" => ["service:dhcp-server"] }, "dhcp-client" => { "udp_ports" => ["bootpc"], "convert_to" => [] }, "dns-server" => { "tcp_ports" => ["domain"], "udp_ports" => ["domain"], "convert_to" => ["service:bind"] }, "nfs-client" => { "rpc_ports" => ["portmap", "status", "nlockmgr"], "convert_to" => ["service:nfs-client"] }, "nfs-server" => { "rpc_ports" => [ "portmap", "status", "nlockmgr", "mountd", "nfs", "nfs_acl" ], "convert_to" => [] }, "nis-client" => { "rpc_ports" => ["portmap", "ypbind"], "convert_to" => ["service:ypserv"] }, "nis-server" => { "rpc_ports" => [ "portmap", "ypserv", "fypxfrd", "ypbind", "yppasswdd" ], "convert_to" => [] }, # Default SUSE installation "vnc" => { "tcp_ports" => ["5801", "5901"], "convert_to" => [] }, "tftp" => { "udp_ports" => ["tftp"], "convert_to" => [] }, # Internet Printing Protocol as a Server "ipp-tcp" => { "tcp_ports" => ["ipp"], "convert_to" => [] }, # Internet Printing Protocol as a Client # IPP Client needs to listen for broadcast messages "ipp-udp" => { "udp_ports" => ["ipp"], "broadcast_ports" => ["ipp"], "convert_to" => [] }, "ntp-server" => { "udp_ports" => ["ntp"], "broadcast_ports" => ["ntp"], "convert_to" => ["service:ntp"] }, "ldap" => { "tcp_ports" => ["ldap"], "convert_to" => ["service:openldap"] }, "ldaps" => { "tcp_ports" => ["ldaps"], "convert_to" => [] }, "ipsec" => { "udp_ports" => ["isakmp", "ipsec-nat-t"], "ip_protocols" => ["esp"], "convert_to" => [] }, "slp-daemon" => { "tcp_ports" => ["svrloc"], "udp_ports" => ["svrloc"], "broadcast_ports" => ["svrloc"], "convert_to" => [] }, # See bug #118200 for more information "xdmcp" => { "tcp_ports" => ["xdmcp"], "udp_ports" => ["xdmcp"], "broadcast_ports" => ["xdmcp"], "convert_to" => [] }, # See bug #118196 for more information "fam" => { "rpc_ports" => ["sgi_fam"], "convert_to" => [] }, # requested by thofmann "open-pbs" => { # /etc/services says: The following entries are invalid, but needed "tcp_ports" => [ "pbs", "pbs_mom", "pbs_resmom", "pbs_sched" ], "udp_ports" => ["pbs_resmom"], "convert_to" => [] }, "mysql-server" => { "tcp_ports" => ["mysql"], "convert_to" => ["service:mysql"] }, "iscsi-server" => { "tcp_ports" => ["iscsi-target"], "convert_to" => ["service:iscsitarget"] } } # Definitions were moved to OLD_SERVICES for conversion # and replaced by definitions in packages. # FATE #300687: Ports for SuSEfirewall added via packages. @SERVICES = {} end |
- (Boolean) ReadServicesDefinedByRPMPackages
Reads definition of services that can be used in FW_CONFIGURATIONS_ in SuSEfirewall2.
326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 |
# File '../../src/modules/SuSEFirewallServices.rb', line 326 def ReadServicesDefinedByRPMPackages if !FileUtils.Exists(@services_definitions_in) || !FileUtils.IsDirectory(@services_definitions_in) Builtins.y2error("Cannot read %1", @services_definitions_in) return false end all_definitions = Convert.convert( SCR.Read(path(".target.dir"), @services_definitions_in), :from => "any", :to => "list <string>" ) # skip the TEMPLATE file all_definitions = Builtins.filter(all_definitions) do |filename| filename != "TEMPLATE" end one_definition = nil filefullpath = nil # for all files in that directory Builtins.foreach(all_definitions) do |filename| # "service:abc_server" to distinguis between dynamic definition and the static one one_definition = Ops.add(@ser_def_by_pkg_string, filename) # Do not read already defined service # Just read only new definitions next if Ops.get(@SERVICES, one_definition, {}) != {} filefullpath = Ops.add(@services_definitions_in, filename) Ops.set(@SERVICES, one_definition, {}) # Registering sysconfig agent for this file if !SCR.RegisterAgent( path(".firewall_service_definition"), term(:ag_ini, term(:SysConfigFile, filefullpath)) ) Builtins.y2error("Cannot register agent for %1", filefullpath) next end definition = nil definition_values = nil Builtins.foreach(@known_services_features) do |known_feature, map_key| definition = Convert.to_string( SCR.Read( Builtins.add(path(".firewall_service_definition"), known_feature) ) ) definition = "" if definition == nil # map of services contains list of entries definition_values = Builtins.splitstring(definition, " \t\n") definition_values = Builtins.filter(definition_values) do |one_value| one_value != "" end Ops.set(@SERVICES, [one_definition, map_key], definition_values) end # Unregistering sysconfig agent for this file SCR.UnregisterAgent(path(".firewall_service_definition")) # Fallback for presented service Ops.set( @SERVICES, [one_definition, "name"], Builtins.sformat(_("Service: %1"), filename) ) Ops.set(@SERVICES, [one_definition, "description"], "") # Registering sysconfig agent for this file (to get metadata) if SCR.RegisterAgent( path(".firewall_service_metadata"), term(:ag_ini, GetMetadataAgent(filefullpath)) ) Builtins.foreach(@known_metadata) do |, | definition = Convert.to_string( SCR.Read( Builtins.add( path(".firewall_service_metadata"), ) ) ) next if definition == nil || definition == "" # call gettext to translate the metadata Ops.set( @SERVICES, [one_definition, ], Builtins.dgettext(@fw_services_textdomain, definition) ) end SCR.UnregisterAgent(path(".firewall_service_metadata")) else Builtins.y2error( "Cannot register agent for %1 (metadata)", filefullpath ) end Builtins.y2debug( "'%1' -> %2", filename, Ops.get(@SERVICES, one_definition, {}) ) end true end |
- (Object) ResetModified
Sets that configuration was not modified
532 533 534 535 536 |
# File '../../src/modules/SuSEFirewallServices.rb', line 532 def ResetModified @sfws_modified = false nil end |
- (Boolean) ServiceDefinedByPackage(service)
Returns whether the service ID is defined by package. Returns 'false' if it isn't.
ServiceDefinedByPackage (“http-server”) -> false ServiceDefinedByPackage ("service:http-server") -> true
258 259 260 261 262 263 |
# File '../../src/modules/SuSEFirewallServices.rb', line 258 def ServiceDefinedByPackage(service) Builtins.regexpmatch( service, Ops.add(Ops.add("^", @ser_def_by_pkg_string), ".*") ) end |
- (Object) SetModified
Sets that configuration was modified
525 526 527 528 529 |
# File '../../src/modules/SuSEFirewallServices.rb', line 525 def SetModified @sfws_modified = true nil end |
- (Boolean) SetNeededPortsAndProtocols(service, store_definition)
Immediately writes the configuration of service defined by package to the service definition file. Service must be defined by package, this function doesn't work for hard-coded services (SuSEFirewallServices).
SetNeededPortsAndProtocols ( "service:something", $[ "tcp_ports" : [ "22", "ftp-data", "400:420" ], "udp_ports" : [ ], "rpc_ports" : [ "portmap", "ypbind" ], "ip_protocols" : [ "esp" ], "broadcast_ports" : [ ], ] );
617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 |
# File '../../src/modules/SuSEFirewallServices.rb', line 617 def SetNeededPortsAndProtocols(service, store_definition) store_definition = deep_copy(store_definition) if !ServiceDefinedByPackage(service) Builtins.y2error("Service %1 is not defined by package", service) return nil end # fallback ReadServicesDefinedByRPMPackages() if !IsKnownService(service) if !IsKnownService(service) Builtins.y2error("Service %1 is unknown", service) return nil end # create the filename from service name filename = GetFilenameFromServiceDefinedByPackage(service) if filename == nil || filename == "" Builtins.y2error( "Can't operate with fileaname '%1' created from '%2'", filename, service ) return false end # full path to the filename filefullpath = Builtins.sformat( "%1/%2", @services_definitions_in, filename ) if !FileUtils.Exists(filefullpath) Builtins.y2error("File '%1' doesn't exist", filefullpath) return false end # Registering sysconfig agent for that file if !SCR.RegisterAgent( path(".firewall_service_definition"), term(:ag_ini, term(:SysConfigFile, filefullpath)) ) Builtins.y2error("Cannot register agent for %1", filefullpath) return false end ks_features_backward = Builtins.mapmap(@known_services_features) do |sysconfig_id, ycp_id| { ycp_id => sysconfig_id } end write_ok = true # we can have this service already in memory new_store_definition = deep_copy(store_definition) Builtins.foreach(store_definition) do |ycp_id, one_def| sysconfig_id = Ops.get(ks_features_backward, ycp_id) if sysconfig_id == nil Builtins.y2error("Unknown key '%1'", ycp_id) write_ok = false next end one_def = Builtins.filter(one_def) do |one_def_item| one_def_item != nil && one_def_item != "" && !Builtins.regexpmatch(one_def_item, "^ *$") end if !SCR.Write( Builtins.add(path(".firewall_service_definition"), sysconfig_id), Builtins.mergestring(one_def, " ") ) Builtins.y2error( "Cannot write %1 to %2", Builtins.mergestring(one_def, " "), Builtins.add(path(".firewall_service_definition"), sysconfig_id) ) write_ok = false next end # new definition of the service Ops.set(new_store_definition, ycp_id, one_def) end # flush the cache to the disk if write_ok if !SCR.Write(path(".firewall_service_definition"), nil) Builtins.y2error("Cannot write to disk!") write_ok = false else # not only store to disk but also to the memory Ops.set(@SERVICES, service, {}) if Ops.get(@SERVICES, service) == nil Ops.set(@SERVICES, service, new_store_definition) SetModified() end end # Unregistering sysconfig agent for that file SCR.UnregisterAgent(path(".firewall_service_definition")) Builtins.y2milestone( "Call SetNeededPortsAndProtocols(%1, ...) result is %2", service, write_ok ) write_ok end |