From 2342548148763cca0579da98ed0a682d22beb49d Mon Sep 17 00:00:00 2001

From: Eric Garver <e@erig.me>

Date: Fri, 1 Jun 2018 09:37:34 -0400

Subject: [PATCH 2/5] firewall/core/io/functions: add check_config()

This is a utility function to run checks on all the configuration files.

(cherry picked from commit 4164148b88f1882eabde4eeb4cc9a45506aff0fa)

---

 po/POTFILES.in                    |  1 +

 src/Makefile.am                   |  1 +

 src/firewall/core/io/functions.py | 84 +++++++++++++++++++++++++++++++++++++++

 3 files changed, 86 insertions(+)

 create mode 100644 src/firewall/core/io/functions.py

diff --git a/po/POTFILES.in b/po/POTFILES.in

index 12cdbf2c6929..2332f8acc4eb 100644

--- a/po/POTFILES.in

+++ b/po/POTFILES.in

@@ -70,6 +70,7 @@ src/firewall/core/prog.py

 src/firewall/core/watcher.py

 src/firewall/core/io/__init__.py

 src/firewall/core/io/firewalld_conf.py

+src/firewall/core/io/functions.py

 src/firewall/core/io/icmptype.py

 src/firewall/core/io/io_object.py

 src/firewall/core/io/service.py

diff --git a/src/Makefile.am b/src/Makefile.am

index b249c2e5fd46..b44ae0c1eca4 100644

--- a/src/Makefile.am

+++ b/src/Makefile.am

@@ -34,6 +34,7 @@ nobase_dist_python_DATA = \

 	firewall/core/__init__.py \

 	firewall/core/io/direct.py \

 	firewall/core/io/firewalld_conf.py \

+	firewall/core/io/functions.py \

 	firewall/core/io/helper.py \

 	firewall/core/io/icmptype.py \

 	firewall/core/io/ifcfg.py \

diff --git a/src/firewall/core/io/functions.py b/src/firewall/core/io/functions.py

new file mode 100644

index 000000000000..7509a5390e12

--- /dev/null

+++ b/src/firewall/core/io/functions.py

@@ -0,0 +1,84 @@

+# -*- coding: utf-8 -*-

+#

+# Copyright (C) 2018 Red Hat, Inc.

+#

+# Authors:

+# Eric Garver <egarver@redhat.com>

+#

+# This program is free software; you can redistribute it and/or modify

+# it under the terms of the GNU General Public License as published by

+# the Free Software Foundation; either version 2 of the License, or

+# (at your option) any later version.

+#

+# This program is distributed in the hope that it will be useful,

+# but WITHOUT ANY WARRANTY; without even the implied warranty of

+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+# GNU General Public License for more details.

+#

+# You should have received a copy of the GNU General Public License

+# along with this program.  If not, see <http://www.gnu.org/licenses/>.

+#

+

+import os

+

+from firewall import config

+from firewall.errors import FirewallError

+

+from firewall.core.io.zone import zone_reader

+from firewall.core.io.service import service_reader

+from firewall.core.io.ipset import ipset_reader

+from firewall.core.io.icmptype import icmptype_reader

+from firewall.core.io.helper import helper_reader

+from firewall.core.io.direct import Direct

+from firewall.core.io.lockdown_whitelist import LockdownWhitelist

+from firewall.core.io.firewalld_conf import firewalld_conf

+

+def check_config(fw=None):

+    readers = {

+        "ipset" : (ipset_reader, [config.FIREWALLD_IPSETS, config.ETC_FIREWALLD_IPSETS]),

+        "helper" : (helper_reader, [config.FIREWALLD_HELPERS, config.ETC_FIREWALLD_HELPERS]),

+        "icmptype" : (icmptype_reader, [config.FIREWALLD_ICMPTYPES, config.ETC_FIREWALLD_ICMPTYPES]),

+        "service" : (service_reader, [config.FIREWALLD_SERVICES, config.ETC_FIREWALLD_SERVICES]),

+        "zone" : (zone_reader, [config.FIREWALLD_ZONES, config.ETC_FIREWALLD_ZONES]),

+    }

+    for reader in readers.keys():

+        for dir in readers[reader][1]:

+            if not os.path.isdir(dir):

+                continue

+            for file in sorted(os.listdir(dir)):

+                if file.endswith(".xml"):

+                    try:

+                        obj = readers[reader][0](file, dir)

+                        if fw and reader == "zone":

+                            obj.fw_config = fw.config

+                        obj.check_config(obj.export_config())

+                    except FirewallError as error:

+                        raise FirewallError(error.code, "'%s': %s" % (file, error.msg))

+                    except Exception as msg:

+                        raise Exception("'%s': %s" % (file, msg))

+    if os.path.isfile(config.FIREWALLD_DIRECT):

+        try:

+            obj = Direct(config.FIREWALLD_DIRECT)

+            obj.read()

+            obj.check_config(obj.export_config())

+        except FirewallError as error:

+            raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_DIRECT, error.msg))

+        except Exception as msg:

+            raise Exception("'%s': %s" % (config.FIREWALLD_DIRECT, msg))

+    if os.path.isfile(config.LOCKDOWN_WHITELIST):

+        try:

+            obj = LockdownWhitelist(config.LOCKDOWN_WHITELIST)

+            obj.read()

+            obj.check_config(obj.export_config())

+        except FirewallError as error:

+            raise FirewallError(error.code, "'%s': %s" % (config.LOCKDOWN_WHITELIST, error.msg))

+        except Exception as msg:

+            raise Exception("'%s': %s" % (config.LOCKDOWN_WHITELIST, msg))

+    if os.path.isfile(config.FIREWALLD_CONF):

+        try:

+            obj = firewalld_conf(config.FIREWALLD_CONF)

+            obj.read()

+        except FirewallError as error:

+            raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_CONF, error.msg))

+        except Exception as msg:

+            raise Exception("'%s': %s" % (config.FIREWALLD_CONF, msg))

-- 

2.16.3