Class: Yast::SuSEFirewall4NetworkClass

Inherits:
Module
  • Object
show all
Includes:
Logger
Defined in:
../../src/modules/SuSEFirewall4Network.rb

Constant Summary

SSH_PACKAGE =
"openssh"
SSH_SERVICES =
["service:sshd"]
VNC_SERVICES =
["service:vnc-httpd", "service:vnc-server"]

Instance Method Summary (collapse)

Instance Method Details

- (Boolean) AnyInterfacesHandledByFirewall

Returns whether any network interfaces are handled firewall either explicitly mentioning them in any firewall zone or implicitly by using string 'any' in firewall zones that would assign any interface unassigned to any zone to that zone as a fallback.

Returns:

  • (Boolean)

    if any interface is handled by firewall



189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
# File '../../src/modules/SuSEFirewall4Network.rb', line 189

def AnyInterfacesHandledByFirewall
  interfaces = []

  Builtins.foreach(SuSEFirewall.GetKnownFirewallZones) do |zone|
    interfaces = Convert.convert(
      Builtins.union(
        interfaces,
        SuSEFirewall.GetInterfacesInZoneSupportingAnyFeature(zone)
      ),
      :from => "list",
      :to   => "list <string>"
    )
  end

  Ops.greater_than(Builtins.size(interfaces), 0)
end

- (Object) ChangedByUser(changed)

Function sets that a firewall proposal was changed by user by editing firewall zone of network interface (applicable during 2nd stage of installation only)

Parameters:

  • boolean

    whether proposal was changed by user



257
258
259
260
261
# File '../../src/modules/SuSEFirewall4Network.rb', line 257

def ChangedByUser(changed)
  SuSEFirewallProposal.SetChangedByUser(changed) if Stage.cont

  nil
end

- (Boolean) Enabled1stStage

Returns whether firewall is supposed to be enabled

Returns:

  • (Boolean)

    whether enabled



279
280
281
# File '../../src/modules/SuSEFirewall4Network.rb', line 279

def Enabled1stStage
  @firewall_enabled_1st_stage
end

- (Object) EnabledSsh1stStage

Returns whether SSH port is supposed to be open in firewall



292
293
294
# File '../../src/modules/SuSEFirewall4Network.rb', line 292

def EnabledSsh1stStage
  @ssh_enabled_1st_stage
end

- (Object) EnabledSshd

Returns whether sshd will be enabled



312
313
314
# File '../../src/modules/SuSEFirewall4Network.rb', line 312

def EnabledSshd
  @sshd_enabled
end

- (Object) EnabledVnc1stStage

Returns whether VNC ports are supposed to be open in firewall



325
326
327
# File '../../src/modules/SuSEFirewall4Network.rb', line 325

def EnabledVnc1stStage
  @vnc_enabled_1st_stage
end

- (Object) FirewallZonesComboBoxItems

Function returns list of items for combo box with all known firewall zones. There's also an item for “” (no zone or fw off).

Returns:

  • item list for CWM



120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
# File '../../src/modules/SuSEFirewall4Network.rb', line 120

def FirewallZonesComboBoxItems
  list_items = []
  protected_from_internal = SuSEFirewall.GetProtectFromInternalZone
  nozone = IsOn() ?
    # item in combo box Firewall Zone
    _("Automatically Assigned Zone") :
    # item in combo box Firewall Zone
    _("Firewall Disabled")
  list_items = Builtins.add(list_items, ["", nozone])

  # Listing all known zones
  Builtins.foreach(SuSEFirewall.GetKnownFirewallZones) do |zone_shortname|
    # Getting zone name for zone
    # Informing user about Unprotected inetrnal zone
    zone_name = Ops.add(
      SuSEFirewall.GetZoneFullName(zone_shortname),
      zone_shortname == "INT" && !protected_from_internal ?
        # TRANSLATORS: Part of combo box item -> "Internal Zone (Unprotected)"
        " " +
          _("(Unprotected)") :
        ""
    )
    list_items = Builtins.add(list_items, [zone_shortname, zone_name])
  end

  deep_copy(list_items)
end

- (String) GetZoneOfInterface(interface)

Function returns the firewall zone of interface, “” if no zone includes the interface. Error is reported when interface is found in multiple firewall zones, then the first appearance is returned. If firewall is off, “” is returned.

Parameters:

  • interface (String)

Returns:

  • (String)

    zone



177
178
179
180
181
# File '../../src/modules/SuSEFirewall4Network.rb', line 177

def GetZoneOfInterface(interface)
  return "" if !IsOn()
  zoi = SuSEFirewall.GetZoneOfInterface(interface)
  zoi == nil ? "" : zoi
end

- (Boolean) IsInstalled

Returns whether the firewall package is installed

Returns:

  • (Boolean)

    if installed



265
266
267
# File '../../src/modules/SuSEFirewall4Network.rb', line 265

def IsInstalled
  SuSEFirewall.SuSEFirewallIsInstalled
end

- (Boolean) IsOn

Returns whether enabled and started

Returns:

  • (Boolean)

    whether enabled and started



79
80
81
# File '../../src/modules/SuSEFirewall4Network.rb', line 79

def IsOn
  SuSEFirewall.GetEnableService && SuSEFirewall.GetStartService
end

- (Boolean) IsProtectedByFirewall(interface)

Function returns if interface is protected by firewall. It means: Firewall is Running and Enabled. Interface is included in any protected firewall zone (means EXT, DMZ or INT).

Parameters:

  • interface (String)

Returns:

  • (Boolean)

    if it is protected



154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
# File '../../src/modules/SuSEFirewall4Network.rb', line 154

def IsProtectedByFirewall(interface)
  interface_zone = SuSEFirewall.GetZoneOfInterface(interface)

  # interface is mentioned in uprotected zone
  if interface_zone == "INT" && !SuSEFirewall.GetProtectFromInternalZone
    Builtins.y2warning(
      "Interface '%1' is mentioned in uprotected zone '%2'",
      interface,
      "INT"
    )
  end

  # firewall must be running and enabled, interface must be in any zone
  IsOn() && interface_zone != nil
end

- (Object) main



45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
# File '../../src/modules/SuSEFirewall4Network.rb', line 45

def main
  textdomain "network"

  Yast.import "SuSEFirewall"
  Yast.import "SuSEFirewallProposal"
  Yast.import "Stage"
  Yast.import "ServicesProposal"
  Yast.import "Linuxrc"
  Yast.import "ProductFeatures"
  Yast.import "Pkg"

  @firewall_enabled_1st_stage = false
  @ssh_enabled_1st_stage = false
  @sshd_enabled = false
  @vnc_enabled_1st_stage = false
end

- (Object) prepare_proposal

Sets the values of the initial proposal based on the product features, the packages selected for installation and the installation method



85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
# File '../../src/modules/SuSEFirewall4Network.rb', line 85

def prepare_proposal
  # variables from control file
  default_firewall = ProductFeatures.GetBooleanFeature("globals", "enable_firewall")
  default_fw_ssh = ProductFeatures.GetBooleanFeature("globals", "firewall_enable_ssh")
  default_sshd = ProductFeatures.GetBooleanFeature("globals", "enable_sshd")

  log.info "Default firewall values: enable_firewall=#{default_firewall}, "\
           "enable_ssh=#{default_fw_ssh}, enable_sshd=#{default_sshd}"

  # Enabling SuSEFirewall only makes sense if it's going to be
  # installed (bnc#881250)
  if Pkg.IsSelected(SuSEFirewall.FIREWALL_PACKAGE)
    SuSEFirewall4Network.SetEnabled1stStage(default_firewall)
  else
    SuSEFirewall4Network.SetEnabled1stStage(false)
  end

  # we're installing over SSH, propose opening SSH port (bnc#535206)
  if Linuxrc.usessh
    SuSEFirewall4Network.SetSshEnabled1stStage(true)
    SuSEFirewall4Network.SetSshdEnabled(true)
  else
    SuSEFirewall4Network.SetSshEnabled1stStage(default_fw_ssh)
    SuSEFirewall4Network.SetSshdEnabled(default_sshd)
  end

  # we're installing over VNC, propose opening VNC port (bnc#734264)
  SuSEFirewall4Network.SetVncEnabled1stStage(true) if Linuxrc.vnc
end

- (Boolean) ProtectByFirewall(interface, zone, protect_status)

Functions sets protection of interface by the protect-status.
protect==true -> add interface into selected firewall zone, sets firewall to be started and enabled when booting.
protect==false -> removes interface from all firewall zones, if there are no other interfaces protected by firewall, stops it and removes it from boot process.

Parameters:

  • interface (String)
  • zone (String)

    (makes sense for protect_status==true)

  • protect_status (Boolean)

Returns:

  • (Boolean)

    if successful



217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
# File '../../src/modules/SuSEFirewall4Network.rb', line 217

def ProtectByFirewall(interface, zone, protect_status)
  # Adding protection
  if protect_status == true
    Builtins.y2milestone(
      "Enabling firewall because of '%1' interface",
      interface
    )
    SuSEFirewall.AddInterfaceIntoZone(interface, zone)
    SuSEFirewall.SetEnableService(true)
    SuSEFirewall.SetStartService(true) 
    # Removing protection
  else
    # removing from all known zones
    Builtins.foreach(SuSEFirewall.GetKnownFirewallZones) do |remove_from_zone|
      SuSEFirewall.RemoveInterfaceFromZone(interface, remove_from_zone)
    end
    # if there are no other interfaces in configuration, stop firewall
    # and remove it from boot process
    if !AnyInterfacesHandledByFirewall()
      Builtins.y2milestone(
        "Disabling firewall, no interfaces are protected."
      )
      SuSEFirewall.SetEnableService(false)
      SuSEFirewall.SetStartService(false)
    end
  end

  true
end

- (Boolean) Read

Function reads configuration of SuSEFirewall.

Returns:

  • (Boolean)

    if successful



65
66
67
68
# File '../../src/modules/SuSEFirewall4Network.rb', line 65

def Read
  Builtins.y2milestone("Reading the firewall configuration")
  SuSEFirewall.Read
end

- (Object) SetEnabled1stStage(enabled)

Sets whether firewall should be enabled

Parameters:

  • boolean

    new state



271
272
273
274
275
# File '../../src/modules/SuSEFirewall4Network.rb', line 271

def SetEnabled1stStage(enabled)
  @firewall_enabled_1st_stage = enabled

  nil
end

- (Object) SetSshdEnabled(enabled)

Sets whether start sshd

Parameters:

  • boolean

    new state



298
299
300
301
302
303
304
305
306
307
308
309
# File '../../src/modules/SuSEFirewall4Network.rb', line 298

def SetSshdEnabled(enabled)
  @sshd_enabled = enabled

  # bnc#887688 Needed for AutoYast export functionality at the end
  # of installation (clone_finish)
  enabled ?
    ServicesProposal.enable_service('sshd')
    :
    ServicesProposal.disable_service('sshd')

  nil
end

- (Object) SetSshEnabled1stStage(enabled)

Sets whether SSH port should be opened in firewall

Parameters:

  • boolean

    new state



285
286
287
288
289
# File '../../src/modules/SuSEFirewall4Network.rb', line 285

def SetSshEnabled1stStage(enabled)
  @ssh_enabled_1st_stage = enabled

  nil
end

- (Object) SetVncEnabled1stStage(enabled)

Sets whether VNC ports should be opened in firewall

Parameters:

  • boolean

    new state



318
319
320
321
322
# File '../../src/modules/SuSEFirewall4Network.rb', line 318

def SetVncEnabled1stStage(enabled)
  @vnc_enabled_1st_stage = enabled

  nil
end

- (Object) UnconfiguredIsBlocked

that are not in any zone

Returns:

  • Whether the UI should warn about interfaces



249
250
251
# File '../../src/modules/SuSEFirewall4Network.rb', line 249

def UnconfiguredIsBlocked
  !SuSEFirewall.IsAnyNetworkInterfaceSupported
end

- (Boolean) Write

Function writes configuration of SuSEFirewall.

Returns:

  • (Boolean)

    if successful



73
74
75
76
# File '../../src/modules/SuSEFirewall4Network.rb', line 73

def Write
  Builtins.y2milestone("Writing the firewall configuration")
  SuSEFirewall.Write
end