Class: Yast::SuSEFirewallClass

Inherits:
Module
  • Object
show all
Includes:
Logger
Defined in:
../../src/modules/SuSEFirewall.rb

Constant Summary

CONFIG_FILE =
"/etc/sysconfig/SuSEfirewall2"

Instance Method Summary (collapse)

Instance Method Details

- (Boolean) ActivateConfiguration

Function which stops firewall. Then firewall is started immediately when firewall is wanted to be started: SetStartService(boolean).

Returns:

  • (Boolean)

    if successful



2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635
2636
2637
2638
# File '../../src/modules/SuSEFirewall.rb', line 2587

def ActivateConfiguration
  # just disabled
  return true if !SuSEFirewallIsInstalled()

  # starting firewall during second stage can cause deadlock in systemd - bnc#798620
  # Moreover, it is not needed. Firewall gets started via dependency on multi-user.target
  # when second stage is over.
  if Mode.installation
    Builtins.y2milestone( "Do not touch firewall services during installation")

    return true
  end

  # Firewall should start after Write()
  if GetStartService()
    # Not started - start it
    if !IsStarted()
      Builtins.y2milestone("Starting firewall services")
      return StartServices() 
      # Started - restart it
    else
      # modified - restart it, or ...
      # bugzilla #186186
      # If any RPC service is configured to be allowed, always restart the firewall
      # Some of these service's ports might have been reallocated (when SuSEFirewall
      # is used from outside, e.g., yast2-nfs-server)
      if GetModified() || AnyRPCServiceInConfiguration()
        Builtins.y2milestone("Stopping firewall services")
        StopServices()
        Builtins.y2milestone("Starting firewall services")
        return StartServices() 
        # not modified - skip restart
      else
        Builtins.y2milestone(
          "Configuration hasn't modified, skipping restarting services"
        )
        return true
      end
    end 
    # Firewall should stop after Write()
  else
    # started - stop
    if IsStarted()
      Builtins.y2milestone("Stopping firewall services")
      return StopServices() 
      # stopped - skip stopping
    else
      Builtins.y2milestone("Firewall has been stopped already")
      return true
    end
  end
end

- (Object) AddAllowedBroadcast(needed_ports, zone)

Local function adds list of ports to ports accepting broadcast

Parameters:

  • list (string)

    of ports



712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
# File '../../src/modules/SuSEFirewall.rb', line 712

def AddAllowedBroadcast(needed_ports, zone)
  needed_ports = deep_copy(needed_ports)
  # changing only if ports are not allowed
  if !IsBroadcastAllowed(needed_ports, zone)
    SetModified()

    allowed_ports = GetBroadcastAllowedPorts()
    list_ports_allowed = Ops.get(allowed_ports, zone, [])

    # ports to be allowed one by one
    Builtins.foreach(needed_ports) do |allow_this_port|
      # at first: remove all aliases of ports yet mentioned in zone
      aliases_of_port = PortAliases.GetListOfServiceAliases(allow_this_port)
      list_ports_allowed = Builtins.filter(list_ports_allowed) do |just_allowed|
        !Builtins.contains(aliases_of_port, just_allowed)
      end
      # at second: add only one
      list_ports_allowed = Builtins.add(list_ports_allowed, allow_this_port)
    end
    Ops.set(allowed_ports, zone, list_ports_allowed)

    # save it using function
    SetBroadcastAllowedPorts(allowed_ports)
  end

  nil
end

- (Object) AddAllowedPortsOrServices(add_ports, protocol, zone)

Local function allows ports for requested protocol and zone.

Parameters:

  • list (string)

    ports to be added

  • protocol (String)
  • zone (String)


884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
# File '../../src/modules/SuSEFirewall.rb', line 884

def AddAllowedPortsOrServices(add_ports, protocol, zone)
  add_ports = deep_copy(add_ports)
  if Ops.less_than(Builtins.size(add_ports), 1)
    Builtins.y2warning(
      "Undefined list of %1 services/ports for service",
      protocol
    )
    return
  end

  SetModified()

  # all allowed ports
  allowed_services = GetAllowedServicesForZoneProto(zone, protocol)

  allowed_services = Convert.convert(
    Builtins.union(allowed_services, add_ports),
    :from => "list",
    :to   => "list <string>"
  )
  allowed_services = PortRanges.FlattenServices(allowed_services, protocol)

  SetAllowedServicesForZoneProto(allowed_services, zone, protocol)

  nil
end

- (Object) AddForwardIntoMasqueradeRule(source_net, forward_to_ip, protocol, req_port, redirect_to_port, requested_ip)

Adds forward into masquerade rule.

AddForwardIntoMasqueradeRule (“0/0”, “192.168.32.1”, “TCP”, “80”, “8080”, “10.0.0.1”)

Parameters:

  • source_net (String)
  • forward_to_ip (String)
  • protocol (String)
  • req_port (String)
  • redirect_to_port (String)
  • requested_ip (String)


3199
3200
3201
3202
3203
3204
3205
3206
3207
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
# File '../../src/modules/SuSEFirewall.rb', line 3199

def AddForwardIntoMasqueradeRule(source_net, forward_to_ip, protocol, req_port, redirect_to_port, requested_ip)
  SetModified()

  masquerade_rules = Ops.get_string(@SETTINGS, "FW_FORWARD_MASQ", "")

  masquerade_rules = Ops.add(
    Ops.add(
      Ops.add(
        Ops.add(
          Ops.add(
            Ops.add(
              Ops.add(
                Ops.add(masquerade_rules, masquerade_rules != "" ? " " : ""),
                source_net
              ),
              ","
            ),
            forward_to_ip
          ),
          ","
        ),
        protocol
      ),
      ","
    ),
    req_port
  )

  if redirect_to_port != "" || requested_ip != ""
    if requested_ip != ""
      masquerade_rules = Ops.add(
        Ops.add(
          Ops.add(Ops.add(masquerade_rules, ","), redirect_to_port),
          ","
        ),
        requested_ip
      ) 
      # port1 -> port2 are same
    elsif redirect_to_port != req_port
      masquerade_rules = Ops.add(
        Ops.add(masquerade_rules, ","),
        redirect_to_port
      )
    end
  end

  Ops.set(@SETTINGS, "FW_FORWARD_MASQ", masquerade_rules)

  nil
end

- (Object) AddInterfaceIntoZone(interface, zone)

Functions adds interface into defined zone. All appearances of interface in other zones are removed.

Examples:

AddInterfaceIntoZone (“eth5”, “DMZ”)

Parameters:

  • interface (String)
  • zone (String)


1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
# File '../../src/modules/SuSEFirewall.rb', line 1744

def AddInterfaceIntoZone(interface, zone)
  SetModified()

  current_zone = GetZoneOfInterface(interface)

  DecreaseVerbosity()
  # removing all appearances of interface in zones, excepting current_zone==new_zone
  while current_zone != nil && current_zone != zone
    # interface is in any zone already, removing it at first
    RemoveInterfaceFromZone(interface, current_zone) if current_zone != zone
    current_zone = GetZoneOfInterface(interface)
  end
  IncreaseVerbosity()

  Builtins.y2milestone(
    "Adding interface '%1' into '%2' zone.",
    interface,
    zone
  )
  interfaces_in_zone = Builtins.splitstring(
    Ops.get_string(@SETTINGS, Ops.add("FW_DEV_", zone), ""),
    " "
  )
  interfaces_in_zone = Builtins.toset(
    Builtins.add(interfaces_in_zone, interface)
  )
  Ops.set(
    @SETTINGS,
    Ops.add("FW_DEV_", zone),
    Builtins.mergestring(interfaces_in_zone, " ")
  )

  nil
end

- (Boolean) AddService(service, protocol, interface)

Function adds service into selected zone (or zone of interface) for selected protocol. Function take care about port-aliases, first of all, removes all of them.

AddService (“ssh”, “TCP”, “EXT”) AddService (“ssh”, “TCP”, “dsl0”)

Parameters:

  • service/port (String)
  • protocol (String)

    TCP, UDP, RPC, IP

  • string

    zone name or interface name

Returns:

  • (Boolean)

    success



1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
# File '../../src/modules/SuSEFirewall.rb', line 1939

def AddService(service, protocol, interface)
  success = false
  Builtins.y2milestone(
    "Adding service %1, protocol %2 to %3",
    service,
    protocol,
    interface
  )

  if !IsSupportedProtocol(protocol)
    Builtins.y2error("Unknown protocol: %1", protocol)
    return false
  end

  zones_affected = []

  # "all" means for all known zones
  if interface == "all"
    zones_affected = GetKnownFirewallZones() 

    # zone or interface name
  else
    # is probably an interface name
    if !IsKnownZone(interface)
      # interface is probably interface-name, checking for respective zone
      interface = GetZoneOfInterface(interface)
      # interface is not assigned to any zone
      if interface == nil
        # TRANSLATORS: Error message, %1 = interface name (like eth0)
        Report.Error(
          Builtins.sformat(
            _(
              "Interface '%1' is not assigned to any firewall zone.\nRun YaST2 Firewall and assign it.\n"
            ),
            interface
          )
        )
        Builtins.y2warning(
          "Interface '%1' is not assigned to any firewall zone",
          interface
        )
        return false
      end
    end
    zones_affected = [interface]
  end

  SetModified()

  # Adding service support into each mentioned zone
  Builtins.foreach(zones_affected) do |zone|
    # If there isn't already
    if !ArePortsOrServicesAllowed([service], protocol, zone, true)
      AddAllowedPortsOrServices([service], protocol, zone)
    else
      Builtins.y2milestone(
        "Port %1 has been already allowed in %2",
        service,
        zone
      )
    end
  end

  true
end

- (Object) AddServiceDefinedByPackageIntoZone(service, zone)

Adds service defined by package (FATE #300687) into list of enabled services.

AddServiceDefinedByPackageIntoZone (“service:irc-server”, “EXT”);

Parameters:

  • string

    service_id

  • zone (String)


956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
# File '../../src/modules/SuSEFirewall.rb', line 956

def AddServiceDefinedByPackageIntoZone(service, zone)
  return nil if !IsKnownZone(zone)

  if service == nil
    Builtins.y2error("Service Id can't be nil!")
    return nil
  elsif Builtins.regexpmatch(service, "^service:.*")
    service = Builtins.regexpsub(service, "^service:(.*)", "\\1")
  end

  # services defined by package are listed without "service:" which is here
  # just to distinguish between dynamic and static definitions
  supported_services = Builtins.splitstring(
    Ops.get_string(@SETTINGS, Ops.add("FW_CONFIGURATIONS_", zone), ""),
    " "
  )
  # Adding the service
  supported_services = Builtins.toset(
    Builtins.add(supported_services, service)
  )
  Ops.set(
    @SETTINGS,
    Ops.add("FW_CONFIGURATIONS_", zone),
    Builtins.mergestring(supported_services, " ")
  )

  SetModified()

  nil
end

- (Object) AddServiceSupportIntoZone(service, zone)

Local function adds well-known service's support into zone. It first of all removes the current support for service with port-aliases.

Parameters:

  • service (String)

    id

  • zone (String)


1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
# File '../../src/modules/SuSEFirewall.rb', line 1038

def AddServiceSupportIntoZone(service, zone)
  needed = SuSEFirewallServices.GetNeededPortsAndProtocols(service)
  # unknown service
  if needed == nil
    Builtins.y2error("Undefined service '%1'", service)
    return nil
  end

  SetModified()

  # FATE #300687: Ports for SuSEfirewall added via packages
  if SuSEFirewallServices.ServiceDefinedByPackage(service)
    AddServiceDefinedByPackageIntoZone(service, zone)

    return nil
  end

  # Removing service ports first (and also port aliases for TCP and UDP)
  if IsServiceSupportedInZone(service, zone) == true
    RemoveServiceSupportFromZone(service, zone)
  end

  Builtins.foreach(@service_defined_by) do |key|
    needed_ports = Ops.get(needed, key, [])
    next if needed_ports == []
    if key == "tcp_ports"
      AddAllowedPortsOrServices(needed_ports, "TCP", zone)
    elsif key == "udp_ports"
      AddAllowedPortsOrServices(needed_ports, "UDP", zone)
    elsif key == "rpc_ports"
      AddAllowedPortsOrServices(needed_ports, "RPC", zone)
    elsif key == "ip_protocols"
      AddAllowedPortsOrServices(needed_ports, "IP", zone)
    elsif "broadcast_ports" == key
      AddAllowedBroadcast(needed_ports, zone)
    else
      Builtins.y2error("Unknown key '%1'", key)
    end
  end

  nil
end

- (Object) AddSpecialInterfaceIntoZone(interface, zone)

Functions adds special string into defined zone.

Parameters:

  • interface (String)
  • zone (String)


3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
# File '../../src/modules/SuSEFirewall.rb', line 3043

def AddSpecialInterfaceIntoZone(interface, zone)
  SetModified()

  Builtins.y2milestone(
    "Adding special string '%1' into '%2' zone.",
    interface,
    zone
  )
  interfaces_in_zone = Builtins.splitstring(
    Ops.get_string(@SETTINGS, Ops.add("FW_DEV_", zone), ""),
    " "
  )
  interfaces_in_zone = Builtins.toset(
    Builtins.add(interfaces_in_zone, interface)
  )
  Ops.set(
    @SETTINGS,
    Ops.add("FW_DEV_", zone),
    Builtins.mergestring(interfaces_in_zone, " ")
  )

  nil
end

- (Object) AddXenSupport

Function adds a special interface 'xenbr+' into the FW_FORWARD_ALWAYS_INOUT_DEV variable.



3367
3368
3369
3370
3371
3372
3373
# File '../../src/modules/SuSEFirewall.rb', line 3367

def AddXenSupport
  Builtins.y2milestone(
    "The whole functionality is currently handled by SuSEfirewall2 itself"
  )

  nil
end

- (Boolean) AnyRPCServiceInConfiguration

Function returns whether some RPC service is allowed in the configuration. These services reallocate their ports when restarted. See details in bugzilla bug #186186.

Returns:

  • (Boolean)

    some_RPC_service_used



2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
# File '../../src/modules/SuSEFirewall.rb', line 2558

def AnyRPCServiceInConfiguration
  ret = false

  Builtins.foreach(GetKnownFirewallZones()) do |fw_zone|
    fw_rule = Builtins.sformat("FW_SERVICES_%1_RPC", fw_zone)
    listed_services = Ops.get_string(@SETTINGS, fw_rule) do
      GetDefaultValue(fw_rule)
    end
    # easy case
    next if listed_services == nil || listed_services == ""
    # something listed but it still might be empty definition
    services_list = Builtins.splitstring(listed_services, " \n\t")
    services_list = Builtins.filter(services_list) do |service|
      service != ""
    end
    if Ops.greater_than(Builtins.size(listed_services), 0)
      ret = true
      raise Break
    end
  end

  Builtins.y2milestone("Some RPC service found: %1", ret)
  ret
end

- (Object) ArePortsOrServicesAllowed(needed_ports, protocol, zone, check_for_aliases)



2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
# File '../../src/modules/SuSEFirewall.rb', line 2082

def ArePortsOrServicesAllowed(needed_ports, protocol, zone, check_for_aliases)
  needed_ports = deep_copy(needed_ports)
  are_allowed = true

  if Ops.less_than(Builtins.size(needed_ports), 1)
    Builtins.y2warning(
      "Undefined list of %1 services/ports for service",
      protocol
    )
    return true
  end

  allowed_ports = {}
  # BTW: only TCP and UDP ports can have aliases and only TCP and UDP ports can have port ranges
  if check_for_aliases
    allowed_ports = PortRanges.DividePortsAndPortRanges(
      GetAllowedServicesForZoneProto(zone, protocol),
      true
    )
  else
    Ops.set(
      allowed_ports,
      "ports",
      GetAllowedServicesForZoneProto(zone, protocol)
    )
  end

  Builtins.foreach(needed_ports) do |needed_port|
    if !Builtins.contains(Ops.get(allowed_ports, "ports", []), needed_port) &&
        !PortRanges.PortIsInPortranges(
          needed_port,
          Ops.get(allowed_ports, "port_ranges", [])
        )
      are_allowed = false
      raise Break
    end
  end

  are_allowed
end

- (Object) CheckKernelModules



3551
3552
3553
3554
3555
3556
3557
3558
3559
3560
3561
3562
3563
3564
3565
3566
3567
3568
3569
3570
3571
3572
3573
3574
3575
3576
3577
3578
3579
3580
3581
3582
3583
3584
3585
3586
3587
# File '../../src/modules/SuSEFirewall.rb', line 3551

def CheckKernelModules
  needs_additional_module = false

  Builtins.foreach(GetKnownFirewallZones()) do |one_zone|
    if Ops.greater_or_equal(
        Builtins.size(GetServicesAcceptRelated(one_zone)),
        0
      )
      Builtins.y2milestone("Some ServicesAcceptRelated are defined")
      needs_additional_module = true
      raise Break
    end
  end

  if needs_additional_module
    k_modules = Builtins.splitstring(
      Ops.get_string(@SETTINGS, "FW_LOAD_MODULES", ""),
      " "
    )

    if !Builtins.contains(k_modules, @broadcast_related_module)
      Builtins.y2warning(
        "FW_LOAD_MODULES doesn't contain %1, adding",
        @broadcast_related_module
      )
      k_modules = Builtins.add(k_modules, @broadcast_related_module)
      Ops.set(
        @SETTINGS,
        "FW_LOAD_MODULES",
        Builtins.mergestring(k_modules, " ")
      )
      SetModified()
    end
  end

  nil
end

- (Object) ConvertToServicesDefinedByPackages

Converts old built-in service definitions to services defined by packages.

See Also:

  • 399217


3638
3639
3640
3641
3642
3643
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674
3675
3676
3677
3678
3679
3680
3681
3682
3683
3684
3685
3686
3687
3688
3689
3690
3691
3692
3693
3694
3695
3696
3697
3698
3699
3700
3701
3702
3703
3704
3705
3706
3707
3708
3709
3710
3711
3712
3713
3714
3715
3716
3717
3718
3719
3720
3721
3722
3723
3724
3725
3726
3727
3728
3729
3730
3731
3732
3733
3734
3735
3736
3737
3738
3739
3740
3741
3742
3743
3744
3745
3746
3747
3748
# File '../../src/modules/SuSEFirewall.rb', line 3638

def ConvertToServicesDefinedByPackages
  return if @already_converted

  if FileUtils.Exists(@converted_to_services_dbp_file)
    @already_converted = true
    return
  end

  # $[ zone : $[ protocol : [ list of ports ] ] ]
  current_conf = {}

  Builtins.foreach(GetKnownFirewallZones()) do |zone|
    Ops.set(current_conf, zone, {})
    Builtins.foreach(@supported_protocols) do |protocol|
      Ops.set(
        current_conf,
        [zone, protocol],
        GetAllowedServicesForZoneProto(zone, protocol)
      )
      Ops.set(
        current_conf,
        [zone, "broadcast"],
        Builtins.splitstring(GetBroadcastConfiguration(zone), " \n")
      )
    end
  end

  Builtins.y2milestone("Current conf: %1", current_conf)

  Builtins.foreach(GetKnownFirewallZones()) do |zone|
    Builtins.foreach(SuSEFirewallServices.OLD_SERVICES) do |old_service_id, old_service_def|
      Builtins.y2milestone("Checking %1 in %2 zone", old_service_id, zone)
      if Ops.get_list(old_service_def, "tcp_ports", []) != [] &&
          ArePortsOrServicesAllowed(
            Ops.get_list(old_service_def, "tcp_ports", []),
            "TCP",
            zone,
            true
          ) != true
        next
      end
      if Ops.get_list(old_service_def, "udp_ports", []) != [] &&
          ArePortsOrServicesAllowed(
            Ops.get_list(old_service_def, "udp_ports", []),
            "UDP",
            zone,
            true
          ) != true
        next
      end
      if Ops.get_list(old_service_def, "rpc_ports", []) != [] &&
          ArePortsOrServicesAllowed(
            Ops.get_list(old_service_def, "rpc_ports", []),
            "RPC",
            zone,
            false
          ) != true
        next
      end
      if Ops.get_list(old_service_def, "ip_protocols", []) != [] &&
          ArePortsOrServicesAllowed(
            Ops.get_list(old_service_def, "ip_protocols", []),
            "IP",
            zone,
            false
          ) != true
        next
      end
      if Ops.get_list(old_service_def, "broadcast_ports", []) != [] &&
          IsBroadcastAllowed(
            Ops.get_list(old_service_def, "broadcast_ports", []),
            zone
          ) != true
        next
      end
      if Ops.get_list(old_service_def, "convert_to", []) == []
        Builtins.y2milestone(
          "Service %1 supported, but it doesn't have any replacement",
          old_service_id
        )
        next
      end
      replaced = false
      Builtins.foreach(Ops.get_list(old_service_def, "convert_to", [])) do |replacement|
        if SuSEFirewallServices.IsKnownService(replacement)
          Builtins.y2milestone(
            "Old service %1 matches %2",
            old_service_id,
            replacement
          )
          RemoveOldAllowedServiceFromZone(old_service_def, zone)
          SetServicesForZones([replacement], [zone], true)
          replaced = true
          raise Break
        end
      end
      if !replaced
        Builtins.y2warning(
          "Old service %1 matches %2 but none are installed",
          old_service_id,
          Ops.get_list(old_service_def, "convert_to", [])
        )
      end
    end
  end

  Builtins.y2milestone("Converting done")
  @already_converted = true

  nil
end

- (Object) DecreaseVerbosity

Local function for decreasing the verbosity level.



341
342
343
344
345
# File '../../src/modules/SuSEFirewall.rb', line 341

def DecreaseVerbosity
  @verbose_level = Ops.subtract(@verbose_level, 1)

  nil
end

- (Boolean) DisableServices

Functions disables services needed for SuSEFirewall in /etc/inet.d/

Returns:

  • (Boolean)

    result



1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
# File '../../src/modules/SuSEFirewall.rb', line 1394

def DisableServices
  return false if !SuSEFirewallIsInstalled()

  if Service.Disable(@firewall_service)
    return true
  else
    # TRANSLATORS: a popup error message
    Report.LongError(Service.Error)
    return false
  end
end

- (Boolean) EnableServices

Functions enables services needed for SuSEFirewall in /etc/inet.d/

Returns:

  • (Boolean)

    result



1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
# File '../../src/modules/SuSEFirewall.rb', line 1377

def EnableServices
  all_ok = true

  return false if !SuSEFirewallIsInstalled()

  if !Service.Enable(@firewall_service)
    all_ok = true
    # TRANSLATORS: a popup error message
    Report.LongError(Service.Error)
  end

  all_ok
end

- (Hash{String => Object}) Export

Function for getting exported SuSEFirewall configuration

Returns:

  • (Hash{String => Object})

    with configuration



1446
1447
1448
# File '../../src/modules/SuSEFirewall.rb', line 1446

def Export
  deep_copy(@SETTINGS)
end

- (Object) FillUpEmptyConfig

Fills the configuration with default settings, adjusts internal variables that firewall cannot be configured.



2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
# File '../../src/modules/SuSEFirewall.rb', line 2434

def FillUpEmptyConfig
  # do not call it again
  @configuration_has_been_read = true

  # Default settings, services are disabled
  @SETTINGS = deep_copy(@DEFAULT_SETTINGS)
  Ops.set(@SETTINGS, "enable_firewall", false)
  Ops.set(@SETTINGS, "start_firewall", false)

  # Cannot be configured, packages weren't installed
  @fw_service_can_be_configured = false

  nil
end

- (String) GetAcceptExpertRules(zone)

Returns list of rules describing protocols and ports that are allowed to be accessed from listed hosts. All is returned as a single string. Zone needs to be defined.

Parameters:

  • zone (String)

Returns:

  • (String)

    with rules



3383
3384
3385
3386
3387
3388
3389
3390
3391
3392
3393
# File '../../src/modules/SuSEFirewall.rb', line 3383

def GetAcceptExpertRules(zone)
  zone = Builtins.toupper(zone)

  # Check for zone
  if !Builtins.contains(GetKnownFirewallZones(), zone)
    Builtins.y2error("Unknown firewall zone: %1", zone)
    return nil
  end

  Ops.get_string(@SETTINGS, Ops.add("FW_SERVICES_ACCEPT_", zone), "")
end

- (Array<String>) GetAdditionalServices(protocol, zone)

This powerful function returns list of services/ports which are not assigned to any fully-supported known-services. This function doesn't check for services defined by packages. They are listed by a different way.

GetAdditionalServices(“TCP”, “EXT”) -> [“53”, “128”]

Returns:

  • (Array<String>)

    of additional (unassigned) services



2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
# File '../../src/modules/SuSEFirewall.rb', line 2781

def GetAdditionalServices(protocol, zone)
  additional_services = []

  if !IsSupportedProtocol(protocol)
    Builtins.y2error("Unknown protocol '%1'", protocol)
    return nil
  end
  if !IsKnownZone(zone)
    Builtins.y2error("Unknown zone '%1'", zone)
    return nil
  end

  # all ports or services allowed in zone for protocol
  all_allowed_services = GetAllowedServicesForZoneProto(zone, protocol)

  # all ports or services used by known service
  all_used_services = []

  # trying all possible (known) services
  Builtins.foreach(SuSEFirewallServices.GetSupportedServices) do |service_id, service_name|
    # only when the service is allowed in zone - remove all its needed ports
    if IsServiceSupportedInZone(service_id, zone) == true
      # all needed ports etc for service/protocol
      needed_all = []
      if protocol == "TCP"
        needed_all = SuSEFirewallServices.GetNeededTCPPorts(service_id)
      elsif protocol == "UDP"
        needed_all = SuSEFirewallServices.GetNeededUDPPorts(service_id)
      elsif protocol == "RPC"
        needed_all = SuSEFirewallServices.GetNeededRPCPorts(service_id)
      elsif protocol == "IP"
        needed_all = SuSEFirewallServices.GetNeededIPProtocols(service_id)
      end
      Builtins.foreach(needed_all) do |remove_port|
        # all used services and their aliases
        all_used_services = Convert.convert(
          Builtins.union(
            all_used_services,
            PortAliases.GetListOfServiceAliases(remove_port)
          ),
          :from => "list",
          :to   => "list <string>"
        )
      end
    end
  end

  # some services are used by known defined-services
  if Ops.greater_than(Builtins.size(all_used_services), 0)
    all_used_services = Builtins.toset(all_used_services)
    # removing all used services from all allowed
    all_allowed_services = Builtins.filter(all_allowed_services) do |port|
      !Builtins.contains(all_used_services, port)
    end
  end

  # well, actually it returns list of services not-assigned to any well-known service
  deep_copy(all_allowed_services)
end

- (Array<String>) GetAllDialUpInterfaces

Function returns list of dial-up interfaces.

Examples:

GetAllDialUpInterfaces() -> [“modem0”, “dsl5”]

Returns:

  • (Array<String>)

    of dial-up interface names



1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
# File '../../src/modules/SuSEFirewall.rb', line 1677

def GetAllDialUpInterfaces
  dial_up_interfaces = []
  Builtins.foreach(GetAllKnownInterfaces()) do |interface|
    if Ops.get(interface, "type") == "dial_up"
      dial_up_interfaces = Builtins.add(
        dial_up_interfaces,
        Ops.get(interface, "id", "")
      )
    end
  end

  deep_copy(dial_up_interfaces)
end

- (Array<Hash{String => String>}) GetAllKnownInterfaces

Function returns list of maps of known interfaces.

Structure:

[ $[ "id":"modem0", "name":"Askey 815C", "type":"dialup", "zone":"EXT" ], ... ]

Returns:

  • (Array<Hash{String => String>})
  • (Array<Hash{String => String>})

    of all interfaces



1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
# File '../../src/modules/SuSEFirewall.rb', line 1581

def GetAllKnownInterfaces
  known_interfaces = []

  # All dial-up interfaces
  dialup_interfaces = NetworkInterfaces.List("dialup")
  dialup_interfaces = [] if dialup_interfaces == nil

  # bugzilla #303858 - wrong values from NetworkInterfaces
  dialup_interfaces = Builtins.filter(dialup_interfaces) do |one_iface|
    if one_iface == nil || one_iface == ""
      Builtins.y2error("Wrong interface definition '%1'", one_iface)
      next false
    end
    true
  end

  dialup_interfaces = Builtins.filter(dialup_interfaces) do |interface|
    interface != "" && !Builtins.issubstring(interface, "lo") &&
      !Builtins.issubstring(interface, "sit")
  end

  # All non-dial-up interfaces
  non_dialup_interfaces = NetworkInterfaces.List("")
  non_dialup_interfaces = [] if non_dialup_interfaces == nil

  # bugzilla #303858 - wrong values from NetworkInterfaces
  non_dialup_interfaces = Builtins.filter(non_dialup_interfaces) do |one_iface|
    if one_iface == nil || one_iface == ""
      Builtins.y2error("Wrong interface definition '%1'", one_iface)
      next false
    end
    true
  end

  non_dialup_interfaces = Builtins.filter(non_dialup_interfaces) do |interface|
    interface != "" && !Builtins.issubstring(interface, "lo") &&
      !Builtins.issubstring(interface, "sit") &&
      !Builtins.contains(dialup_interfaces, interface)
  end

  Builtins.foreach(dialup_interfaces) do |interface|
    known_interfaces = Builtins.add(
      known_interfaces,
      {
        "id"   => interface,
        "type" => "dialup",
        # using function to get name
        "name" => NetworkInterfaces.GetValue(
          interface,
          "NAME"
        ),
        "zone" => GetZoneOfInterface(interface)
      }
    )
  end

  Builtins.foreach(non_dialup_interfaces) do |interface|
    known_interfaces = Builtins.add(
      known_interfaces,
      {
        "id"   => interface,
        # using function to get name
        "name" => NetworkInterfaces.GetValue(
          interface,
          "NAME"
        ),
        "zone" => GetZoneOfInterface(interface)
      }
    )
  end

  deep_copy(known_interfaces)
end

- (Array<String>) GetAllNonDialUpInterfaces

Function returns list of non-dial-up interfaces.

Examples:

GetAllNonDialUpInterfaces() -> [“eth1”, “eth2”]

Returns:

  • (Array<String>)

    of non-dial-up interface names



1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
# File '../../src/modules/SuSEFirewall.rb', line 1659

def GetAllNonDialUpInterfaces
  non_dial_up_interfaces = []
  Builtins.foreach(GetAllKnownInterfaces()) do |interface|
    if Ops.get(interface, "type") != "dial_up"
      non_dial_up_interfaces = Builtins.add(
        non_dial_up_interfaces,
        Ops.get(interface, "id", "")
      )
    end
  end

  deep_copy(non_dial_up_interfaces)
end

- (Array<String>) GetAllowedServicesForZoneProto(zone, protocol)

Function returns list of allowed services for zone and protocol

Parameters:

  • zone (String)
  • protocol (String)

Returns:

  • (Array<String>)

    of allowed services/ports



509
510
511
512
513
514
515
516
517
518
# File '../../src/modules/SuSEFirewall.rb', line 509

def GetAllowedServicesForZoneProto(zone, protocol)
  Builtins.splitstring(
    Ops.get_string(
      @SETTINGS,
      Ops.add(Ops.add(Ops.add("FW_SERVICES_", zone), "_"), protocol),
      ""
    ),
    " "
  )
end

- (Hash{String => Array<String>}) GetBroadcastAllowedPorts

Local function return map of allowed ports (without aliases). If any list for zone is defined but empty, all allowed UDP ports for this zone also accept broadcast packets. This function returns only ports that are mentioned in configuration, it doesn't return ports that are listed in some service (defined by package) which is enabled.

Structure:

Returns:

  • (Hash{String => Array<String>})

    strings are allowed ports or port ranges



583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
# File '../../src/modules/SuSEFirewall.rb', line 583

def GetBroadcastAllowedPorts
  allowed_ports = {}

  Builtins.foreach(GetKnownFirewallZones()) do |zone|
    broadcast = GetBroadcastConfiguration(zone)
    # no broadcast allowed for this zone
    if broadcast == "no"
      Ops.set(allowed_ports, zone, []) 
      # BNC #694782: "yes" is automatically translated by SuSEfirewall2
    elsif broadcast == "yes"
      Ops.set(allowed_ports, zone, ["yes"]) 
      # only listed ports allows broadcast
    else
      Ops.set(allowed_ports, zone, Builtins.splitstring(broadcast, " "))
      Ops.set(
        allowed_ports,
        zone,
        Builtins.filter(Builtins.splitstring(broadcast, " ")) do |not_space|
          not_space != ""
        end
      )
    end
  end

  Builtins.y2debug("Allowed Broadcast Ports: %1", allowed_ports)

  deep_copy(allowed_ports)
end

- (String) GetBroadcastConfiguration(zone)

Local function returns configuration string for broadcast packets.

Returns:

  • (String)

    with broadcast configuration



541
542
543
# File '../../src/modules/SuSEFirewall.rb', line 541

def GetBroadcastConfiguration(zone)
  Ops.get_string(@SETTINGS, Ops.add("FW_ALLOW_FW_BROADCAST_", zone), "no")
end

- (String) GetConfigurationStringZone(zone_string)

Local function returns zone name (shortname) for configuration string. For instance “EXT” for “ext” zone.

Parameters:

  • string

    zone configuration string

Returns:

  • (String)

    zone shortname



496
497
498
499
500
501
502
# File '../../src/modules/SuSEFirewall.rb', line 496

def GetConfigurationStringZone(zone_string)
  if IsKnownZone(Builtins.toupper(zone_string))
    # zones in SuSEFirewall configuration are identified by lowercased zone shorters
    return Builtins.toupper(zone_string)
  end
  nil
end

- (String) GetDefaultValue(variable)

Local function for returning default values (if defined) for sysconfig variables.

Parameters:

  • string

    sysconfig variable

Returns:

  • (String)

    default value



360
361
362
# File '../../src/modules/SuSEFirewall.rb', line 360

def GetDefaultValue(variable)
  Ops.get(@DEFAULT_SETTINGS, variable, "")
end

- (Boolean) GetEnableService

Function which returns whether SuSEfirewall should be enabled in /etc/init.d/ starting scripts during the Write() process

Returns:

  • (Boolean)

    if the firewall should start

See Also:

  • #Write()
  • #EnableServices()


1310
1311
1312
# File '../../src/modules/SuSEFirewall.rb', line 1310

def GetEnableService
  Ops.get_boolean(@SETTINGS, "enable_firewall", false)
end

- (Array<String>) GetFirewallInterfaces

Function returns all interfaces already configured in firewall.

Returns:

  • (Array<String>)

    of configured interfaces



1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
# File '../../src/modules/SuSEFirewall.rb', line 1804

def GetFirewallInterfaces
  firewall_configured_devices = []

  Builtins.foreach(GetKnownFirewallZones()) do |zone|
    firewall_configured_devices = Convert.convert(
      Builtins.union(firewall_configured_devices, GetInterfacesInZone(zone)),
      :from => "list",
      :to   => "list <string>"
    )
  end

  Builtins.toset(firewall_configured_devices)
end

- (Hash{String => Array<String>}) GetFirewallInterfacesMap

Function returns map of interfaces in zones.

Structure:

map $[zone : [list of interfaces]]

GetFirewallInterfacesMap() -> $[“DMZ”:[], “EXT”:, “INT”:[“eth1”, “eth2”]]

Returns:

  • (Hash{String => Array<String>})

    interface in zones



2966
2967
2968
2969
2970
2971
2972
2973
2974
2975
2976
2977
2978
2979
2980
2981
2982
2983
2984
2985
# File '../../src/modules/SuSEFirewall.rb', line 2966

def GetFirewallInterfacesMap
  firewall_interfaces_now = {}

  # list of all known interfaces
  known_interfaces = GetListOfKnownInterfaces()

  # searching each zone
  Builtins.foreach(GetKnownFirewallZones()) do |zone|
    # filtering non-existing interfaces
    Ops.set(
      firewall_interfaces_now,
      zone,
      Builtins.filter(GetInterfacesInZone(zone)) do |interface|
        Builtins.contains(known_interfaces, interface)
      end
    )
  end

  deep_copy(firewall_interfaces_now)
end

- (Array<String>) GetFirewallKernelModules

Returns list of additional kernel modules, that are loaded by firewall on startup. For instance “ip_conntrack_ftp” and “ip_nat_ftp” for FTP service.

Returns:

  • (Array<String>)

    of kernel modules

See Also:

  • option nr. 32 (FW_LOAD_MODULES)


3421
3422
3423
3424
3425
3426
3427
3428
3429
3430
# File '../../src/modules/SuSEFirewall.rb', line 3421

def GetFirewallKernelModules
  k_modules = Builtins.splitstring(
    Ops.get_string(@SETTINGS, "FW_LOAD_MODULES", ""),
    " \t\n"
  )

  k_modules = Builtins.filter(k_modules) { |one_module| one_module != "" }

  Builtins.toset(k_modules)
end

- (String) GetIgnoreLoggingBroadcast(zone)

Function returns yes/no - ingoring broadcast for zone

// Does not logg ignored broadcast packets GetIgnoreLoggingBroadcast (“EXT”) -> “yes”

Parameters:

  • zone (String)

Returns:

  • (String)

    “yes” or “no”



3332
3333
3334
3335
3336
3337
3338
3339
# File '../../src/modules/SuSEFirewall.rb', line 3332

def GetIgnoreLoggingBroadcast(zone)
  if !IsKnownZone(zone)
    Builtins.y2error("Unknown zone '%1'", zone)
    return nil
  end

  Ops.get_string(@SETTINGS, Ops.add("FW_IGNORE_FW_BROADCAST_", zone), "no")
end

- (Array<String>) GetInterfacesInZone(zone)

Function returns list of known interfaces in requested zone. Special strings like 'any' or 'auto' and unknown interfaces are removed from list.

Examples:

GetInterfacesInZone (“DMZ”) -> [“eth4”, “eth5”]

Parameters:

  • zone (String)

Returns:

  • (Array<String>)

    of interfaces



1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
# File '../../src/modules/SuSEFirewall.rb', line 1785

def GetInterfacesInZone(zone)
  interfaces_in_zone = Builtins.splitstring(
    Ops.get_string(@SETTINGS, Ops.add("FW_DEV_", zone), ""),
    " "
  )

  known_interfaces_now = GetListOfKnownInterfaces()

  # filtering special strings
  interfaces_in_zone = Builtins.filter(interfaces_in_zone) do |interface|
    interface != "" && Builtins.contains(known_interfaces_now, interface)
  end

  deep_copy(interfaces_in_zone)
end

- (Array<String>) GetInterfacesInZoneSupportingAnyFeature(zone)

Function returns list of known interfaces in requested zone. Special string 'any' in EXT zone covers all interfaces without any zone assignment.

Parameters:

  • zone (String)

Returns:

  • (Array<String>)

    of interfaces



1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
# File '../../src/modules/SuSEFirewall.rb', line 1853

def GetInterfacesInZoneSupportingAnyFeature(zone)
  interfaces_in_zone = GetInterfacesInZone(zone)

  # 'any' in EXT zone, add all interfaces without zone to this one
  interfaces_covered_by_any = InterfacesSupportedByAnyFeature(zone)
  if Ops.greater_than(Builtins.size(interfaces_covered_by_any), 0)
    interfaces_in_zone = Convert.convert(
      Builtins.union(interfaces_in_zone, interfaces_covered_by_any),
      :from => "list",
      :to   => "list <string>"
    )
  end

  deep_copy(interfaces_in_zone)
end

- (Array<String>) GetKnownFirewallZones

Function returns list of known firewall zones (shortnames)

Examples:

GetKnownFirewallZones() -> [“DMZ”, “EXT”, “INT”]

Returns:

  • (Array<String>)

    of firewall zones



287
288
289
# File '../../src/modules/SuSEFirewall.rb', line 287

def GetKnownFirewallZones
  deep_copy(@known_firewall_zones)
end

- (Array<Hash{String => String>}) GetListOfForwardsIntoMasquerade

Function returns list of rules of forwarding ports to masqueraded IPs.

Structure:

list [$[ key: value ]]

GetListOfForwardsIntoMasquerade() -> [ $[ “forward_to”:“172.24.233.1”, “protocol”:“tcp”, “req_ip”:“192.168.0.3”, “req_port”:“355”, “source_net”:“192.168.0.0/20”, “to_port”:“533”], … ]

Returns:

  • (Array<Hash{String => String>})

    list of rules



3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149
# File '../../src/modules/SuSEFirewall.rb', line 3110

def GetListOfForwardsIntoMasquerade
  list_of_rules = []

  Builtins.foreach(
    Builtins.splitstring(
      Ops.get_string(@SETTINGS, "FW_FORWARD_MASQ", ""),
      " "
    )
  ) do |forward_rule|
    next if forward_rule == ""
    # Format: <source network>,<ip to forward to>,<protocol>,<port>[,redirect port,[destination ip]]
    fw_rul = Builtins.splitstring(forward_rule, ",")
    # first four parameters has to be defined
    if Ops.get(fw_rul, 0, "") == "" || Ops.get(fw_rul, 1, "") == "" ||
        Ops.get(fw_rul, 2, "") == "" ||
        Ops.get(fw_rul, 3, "") == ""
      Builtins.y2warning(
        "Wrong definition of redirect rule: '%1', part of '%2'",
        forward_rule,
        Ops.get_string(@SETTINGS, "FW_FORWARD_MASQ", "")
      )
    end
    list_of_rules = Builtins.add(
      list_of_rules,
      {
        "source_net" => Ops.get(fw_rul, 0, ""),
        "forward_to" => Ops.get(fw_rul, 1, ""),
        "protocol"   => Builtins.tolower(Ops.get(fw_rul, 2, "")),
        "req_port"   => Builtins.tolower(Ops.get(fw_rul, 3, "")),
        # to_port is req_port when undefined
        "to_port"    => Builtins.tolower(
          Ops.get(fw_rul, 4, Ops.get(fw_rul, 3, ""))
        ),
        "req_ip"     => Builtins.tolower(Ops.get(fw_rul, 5, ""))
      }
    )
  end

  deep_copy(list_of_rules)
end

- (Array<String>) GetListOfKnownInterfaces

Function returns list of all known interfaces.

Examples:

GetListOfKnownInterfaces() -> [“eth1”, “eth2”, “modem0”, “dsl5”]

Returns:

  • (Array<String>)

    of interfaces



1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
# File '../../src/modules/SuSEFirewall.rb', line 1695

def GetListOfKnownInterfaces
  interfaces = []

  Builtins.foreach(GetAllKnownInterfaces()) do |interface_map|
    interfaces = Builtins.add(
      interfaces,
      Ops.get_string(interface_map, "id", "")
    )
  end

  deep_copy(interfaces)
end

- (Array<String>) GetListOfSuSEFirewallVariables

Function return list of variables needed for SuSEFirewall's settings.

Returns:

  • (Array<String>)

    of names of variables



329
330
331
# File '../../src/modules/SuSEFirewall.rb', line 329

def GetListOfSuSEFirewallVariables
  deep_copy(@SuSEFirewall_variables)
end

- (String) GetLoggingSettings(rule)

Function returns actual state of logging for rule taken as parameter.

GetLoggingSettings(“ACCEPT”) -> “CRIT” GetLoggingSettings(“DROP”) -> “CRIT”

Parameters:

  • rule (String)

    definition 'ACCEPT' or 'DROP'

Returns:

  • (String)

    'ALL', 'CRIT', or 'NONE'



3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280
3281
3282
# File '../../src/modules/SuSEFirewall.rb', line 3258

def GetLoggingSettings(rule)
  ret_val = nil

  if rule == "ACCEPT"
    if Ops.get_string(@SETTINGS, "FW_LOG_ACCEPT_ALL", "no") == "yes"
      ret_val = "ALL"
    elsif Ops.get_string(@SETTINGS, "FW_LOG_ACCEPT_CRIT", "yes") == "yes"
      ret_val = "CRIT"
    else
      ret_val = "NONE"
    end
  elsif rule == "DROP"
    if Ops.get_string(@SETTINGS, "FW_LOG_DROP_ALL", "no") == "yes"
      ret_val = "ALL"
    elsif Ops.get_string(@SETTINGS, "FW_LOG_DROP_CRIT", "yes") == "yes"
      ret_val = "CRIT"
    else
      ret_val = "NONE"
    end
  else
    Builtins.y2error("Possible rules are only 'ACCEPT' or 'DROP'")
  end

  ret_val
end

- (Boolean) GetMasquerade

Function returns actual state of Masquerading support.

Returns:

  • (Boolean)

    if supported



3070
3071
3072
3073
# File '../../src/modules/SuSEFirewall.rb', line 3070

def GetMasquerade
  Ops.get_string(@SETTINGS, "FW_MASQUERADE", "no") == "yes" &&
    Ops.get_string(@SETTINGS, "FW_ROUTE", "no") == "yes"
end

- (Boolean) GetModified

Functions returns whether any firewall's configuration was modified.

Returns:

  • (Boolean)

    if the configuration was modified



1132
1133
1134
1135
1136
# File '../../src/modules/SuSEFirewall.rb', line 1132

def GetModified
  # Changed SuSEFirewall or
  # Changed SuSEFirewallServices (needs resatrting as well)
  @modified || SuSEFirewallServices.GetModified
end

- (Boolean) GetProtectFromInternalZone

Function returns if firewall is protected from internal zone.

Returns:

  • (Boolean)

    if protected from internal



1178
1179
1180
# File '../../src/modules/SuSEFirewall.rb', line 1178

def GetProtectFromInternalZone
  Ops.get_string(@SETTINGS, "FW_PROTECT_FROM_INT", "no") == "yes"
end

- (String) GetProtocolTranslatedName(protocol)

Returns translated protocol name. Translation is provided from SuSEfirewall2 sysconfig format to l10n format.

Parameters:

  • string

    string from sysconfig (e.g., rpc)

Returns:

  • (String)

    translated string (e.g., RPC)



3480
3481
3482
3483
3484
3485
3486
3487
3488
3489
3490
3491
3492
# File '../../src/modules/SuSEFirewall.rb', line 3480

def GetProtocolTranslatedName(protocol)
  protocol = Builtins.tolower(protocol)

  if protocol == ""
    return ""
  elsif Ops.get(@protocol_translations, protocol) == nil
    Builtins.y2error("Unknown protocol: %1", protocol)
    # table item, %1 stands for the buggy protocol name
    return Builtins.sformat(_("Unknown protocol (%1)"), protocol)
  else
    return Ops.get(@protocol_translations, protocol, "")
  end
end

- (Hash <String, Hash{String => Boolean>}) GetServices(services)

Function returns map of supported services in all firewall zones.

Structure:

Returns $[service : $[ zone_name : supported_status]]

Examples:

// Firewall in not protected from internal zone, that's why
// all services report that they are enabled in INT zone
GetServices (["samba-server", "service:irc-server"]) -> $[
  "samba-server" : $["DMZ":false, "EXT":false, "INT":true],
  "service:irc-server" : $["DMZ":false, "EXT":true, "INT":true]
]

Parameters:

  • list (string)

    of services

Returns:

  • (Hash <String, Hash{String => Boolean>})


2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
# File '../../src/modules/SuSEFirewall.rb', line 2303

def GetServices(services)
  services = deep_copy(services)
  # $[ service : $[ firewall_zone : status ]]
  services_status = {}

  # for all services requested
  Builtins.foreach(services) do |service|
    Ops.set(services_status, service, {})
    # for all zones in configuration
    Builtins.foreach(GetKnownFirewallZones()) do |zone|
      Ops.set(
        services_status,
        [service, zone],
        IsServiceSupportedInZone(service, zone)
      )
    end
  end

  deep_copy(services_status)
end

- (Array<String>) GetServicesAcceptRelated(zone)

Returns list of FW_SERVICES_ACCEPT_RELATED_*: Services to allow that are considered RELATED by the connection tracking engine, e.g., SLP browsing reply or Samba browsing reply.

GetServicesAcceptRelated (“EXT”) -> [“0/0,udp,427”, “0/0,udp,137”]

Parameters:

  • zone (String)

Returns:

  • (Array<String>)

    list of definitions

See Also:

  • #SetServicesAcceptRelated()


3505
3506
3507
3508
3509
3510
3511
3512
3513
3514
3515
3516
3517
3518
3519
# File '../../src/modules/SuSEFirewall.rb', line 3505

def GetServicesAcceptRelated(zone)
  if !IsKnownZone(zone)
    Builtins.y2error("Uknown zone '%1'", zone)
    return []
  end

  Builtins.splitstring(
    Ops.get_string(
      @SETTINGS,
      Ops.add("FW_SERVICES_ACCEPT_RELATED_", zone),
      ""
    ),
    " \t\n"
  )
end

- (Hash <String, Hash{String => Boolean} >) GetServicesInZones(services)

Function returns map of supported services all network interfaces.

Structure:

Returns $[service : $[ interface : supported_status ]]

GetServicesInZones ([“service:irc-server”]) -> $[“service:irc-server”:$] // No such service “something” GetServicesInZones ([“something”])) -> $[“something”:$] GetServicesInZones ([“samba-server”]) -> $[“samba-server”:$]

Parameters:

  • list (string)

    of services

Returns:

  • (Hash <String, Hash{String => Boolean} >)


2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
# File '../../src/modules/SuSEFirewall.rb', line 2250

def GetServicesInZones(services)
  services = deep_copy(services)
  # list of interfaces for each zone
  interface_in_zone = {}

  Builtins.foreach(GetListOfKnownInterfaces()) do |interface|
    # zone of interface
    zone_used = GetZoneOfInterface(interface)
    # interface can be unassigned
    next if zone_used == nil || zone_used == ""
    Ops.set(
      interface_in_zone,
      zone_used,
      Builtins.add(Ops.get(interface_in_zone, zone_used, []), interface)
    )
  end

  # $[ service : $[ network_interface : status ]]
  services_status = {}

  # for all services requested
  Builtins.foreach(services) do |service|
    Ops.set(services_status, service, {})
    # for all zones in configuration
    Builtins.foreach(interface_in_zone) do |zone, interfaces|
      status = IsServiceSupportedInZone(service, zone)
      # for all interfaces in zone
      Builtins.foreach(interfaces) do |interface|
        Ops.set(services_status, [service, interface], status)
      end
    end
  end

  deep_copy(services_status)
end

- (Array<String>) GetSpecialInterfacesInZone(zone)

Function returns list of special strings like 'any' or 'auto' and uknown interfaces.

GetSpecialInterfacesInZone(“EXT”) -> [“any”, “unknown-1”, “wrong-3”]

Parameters:

  • zone (String)

Returns:

  • (Array<String>)

    special strings or unknown interfaces



2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006
3007
3008
# File '../../src/modules/SuSEFirewall.rb', line 2994

def GetSpecialInterfacesInZone(zone)
  interfaces_in_zone = Builtins.splitstring(
    Ops.get_string(@SETTINGS, Ops.add("FW_DEV_", zone), ""),
    " "
  )

  known_interfaces_now = GetInterfacesInZone(zone)

  # filtering known interfaces and spaces
  interfaces_in_zone = Builtins.filter(interfaces_in_zone) do |interface|
    interface != "" && !Builtins.contains(known_interfaces_now, interface)
  end

  deep_copy(interfaces_in_zone)
end

- (Boolean) GetStartService

Function which returns if SuSEfirewall2 should start in Write process. In fact it means that SuSEfirewall2 will at the end.

Returns:

  • (Boolean)

    if the firewall should start



1272
1273
1274
# File '../../src/modules/SuSEFirewall.rb', line 1272

def GetStartService
  Ops.get_boolean(@SETTINGS, "start_firewall", false)
end

- (Boolean) GetSupportRoute

Function returns if firewall supports routing.

Returns:

  • (Boolean)

    if route is supported



1200
1201
1202
# File '../../src/modules/SuSEFirewall.rb', line 1200

def GetSupportRoute
  Ops.get_string(@SETTINGS, "FW_ROUTE", "no") == "yes"
end

- (String) GetTrustIPsecAs

Function returns the trust level of IPsec packets. See SetTrustIPsecAs() for more information.

Returns:

  • (String)

    zone or “no”



1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
# File '../../src/modules/SuSEFirewall.rb', line 1239

def GetTrustIPsecAs
  # do not trust
  if Ops.get(@SETTINGS, "FW_IPSEC_TRUST") == "no"
    return "no" 
    # default value for 'yes" ~= "INT"
  elsif Ops.get(@SETTINGS, "FW_IPSEC_TRUST") == "yes"
    return "INT"
  else
    zone = GetConfigurationStringZone(
      Ops.get_string(@SETTINGS, "FW_IPSEC_TRUST", "")
    )
    # trust as named zone (if known)
    if IsKnownZone(zone)
      return zone 
      # unknown zone, change to default value
    else
      SetModified()
      defaultv = GetDefaultValue("FW_IPSEC_TRUST")
      Builtins.y2warning(
        "Trust IPsec as '%1' (unknown zone) changed to '%2'",
        Ops.get_string(@SETTINGS, "FW_IPSEC_TRUST", ""),
        defaultv
      )
      SetTrustIPsecAs(defaultv)
      return "no"
    end
  end
end

- (String) GetZoneConfigurationString(zone)

Local function returns configuration string used in configuration for zone. For instance “ext” for “EXT” zone.

Parameters:

  • zone (String)

    shortname

Returns:

  • (String)

    zone configuration string



483
484
485
486
487
488
489
# File '../../src/modules/SuSEFirewall.rb', line 483

def GetZoneConfigurationString(zone)
  if IsKnownZone(zone)
    # zones in SuSEFirewall configuration are identified by lowercased zone shorters
    return Builtins.tolower(zone)
  end
  nil
end

- (String) GetZoneFullName(zone)

Function returns localized name of the zone identified by zone shortname.

Examples:

LANG=en_US GetZoneFullName ("EXT") -> "External Zone"
LANG=cs_CZ GetZoneFullName ("EXT") -> "Externí Zóna"

Parameters:

  • string

    short name

Returns:

  • (String)

    zone name



1155
1156
1157
1158
# File '../../src/modules/SuSEFirewall.rb', line 1155

def GetZoneFullName(zone)
  # TRANSLATORS: Firewall zone full-name, used as combo box item or dialog title
  Ops.get(@zone_names, zone, _("Unknown Zone"))
end

- (String) GetZoneOfInterface(interface)

Function returns the firewall zone of interface, nil if no zone includes the interface. Error is reported when interface is found in multiple firewall zones, then the first appearance is returned.

Examples:

GetZoneOfInterface (“eth-id-01:11:DA:9C:8A:2F”) -> “DMZ”

Parameters:

  • interface (String)

Returns:

  • (String)

    zone



1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
# File '../../src/modules/SuSEFirewall.rb', line 1485

def GetZoneOfInterface(interface)
  interface_zone = []

  Builtins.foreach(GetKnownFirewallZones()) do |zone|
    if IsInterfaceInZone(interface, zone)
      interface_zone = Builtins.add(interface_zone, zone)
    end
  end

  # Fallback handling for 'any' in the FW_DEV_* configuration
  if interface == @special_all_interface_string &&
      Builtins.size(interface_zone) == 0
    interface_zone = [@special_all_interface_zone]
  end

  if IsVerbose() && Ops.greater_than(Builtins.size(interface_zone), 1)
    # TRANSLATORS: Error message, %1 = interface name (like eth0)
    Report.Error(
      Builtins.sformat(
        _(
          "Interface '%1' is included in multiple firewall zones.\n" +
            "Continuing with configuration can produce errors.\n" +
            "\n" +
            "It is recommended to leave the configuration and repair it manually in\n" +
            "the file '/etc/sysconfig/SuSEFirewall'."
        ),
        interface
      )
    )
  end

  # return the first existence of interface in zones
  # if it is not presented anywhere, nil is returned
  Ops.get_string(interface_zone, 0)
end

- (Array<String>) GetZonesOfInterfaces(interfaces)

Function returns list of zones of requested interfaces

GetZonesOfInterfaces ([“eth1”,“eth4”]) -> [“DMZ”, “EXT”]

Parameters:

  • interfaces (Array<String>)

Returns:

  • (Array<String>)

    firewall zones



1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
# File '../../src/modules/SuSEFirewall.rb', line 1528

def GetZonesOfInterfaces(interfaces)
  interfaces = deep_copy(interfaces)
  zones = []
  zone = ""

  Builtins.foreach(interfaces) do |interface|
    zone = GetZoneOfInterface(interface)
    zones = Builtins.add(zones, zone) if zone != nil
  end

  Builtins.toset(zones)
end

- (Array<String>) GetZonesOfInterfacesWithAnyFeatureSupported(interfaces)

Function returns list of zones of requested interfaces. Special string 'any' in 'EXT' zone is supported.

GetZonesOfInterfaces ([“eth1”,“eth4”]) -> [“EXT”]

Parameters:

  • interfaces (Array<String>)

Returns:

  • (Array<String>)

    firewall zones



1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
# File '../../src/modules/SuSEFirewall.rb', line 1549

def GetZonesOfInterfacesWithAnyFeatureSupported(interfaces)
  interfaces = deep_copy(interfaces)
  zones = []
  zone = ""

  # 'any' in 'EXT'
  interfaces_covered_by_any = GetInterfacesInZoneSupportingAnyFeature(
    @special_all_interface_zone
  )

  Builtins.foreach(interfaces) do |interface|
    # interface is covered by 'any' in 'EXT'
    if Builtins.contains(interfaces_covered_by_any, interface)
      zone = @special_all_interface_zone
    else
      # interface is explicitely mentioned in some zone
      zone = GetZoneOfInterface(interface)
    end
    zones = Builtins.add(zones, zone) if zone != nil
  end

  Builtins.toset(zones)
end

- (Boolean) HaveService(service, protocol, interface)

Function returns if requested service is allowed in respective zone. Function takes care for service's aliases (only for TCP and UDP). Service is defined by set of parameters such as port and protocol.

HaveService (“ssh”, “TCP”, “EXT”) -> true HaveService (“ssh”, “TCP”, “modem0”) -> false HaveService (“53”, “UDP”, “dsl”) -> false

Parameters:

  • service (String)

    (service name, port name, port alias or port number)

  • protocol (String)

    TCP, UDP, RCP or IP

  • interface (String)

    name (like modem0), firewall zone (like “EXT”) or “any” for all zones.

Returns:

  • (Boolean)

    if service is allowed



1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
# File '../../src/modules/SuSEFirewall.rb', line 1882

def HaveService(service, protocol, interface)
  if !IsSupportedProtocol(protocol)
    Builtins.y2error("Unknown protocol: %1", protocol)
    return nil
  end

  # definition of searched zones
  zones = []

  # "any" for all zones, this is ugly
  if interface == "any"
    zones = GetKnownFirewallZones() 
    # string interface is the zone name
  elsif IsKnownZone(interface)
    zones = Builtins.add(zones, interface) 
    # interface is the interface name
  else
    interface = GetZoneOfInterface(interface)
    zones = Builtins.add(zones, interface) if interface != nil
  end

  # SuSEFirewall feature FW_PROTECT_FROM_INT
  # should not be protected and searched zones include also internal (or the zone IS internal, sure)
  if !GetProtectFromInternalZone() &&
      Builtins.contains(zones, @int_zone_shortname)
    Builtins.y2milestone(
      "Checking for service '%1', in '%2', PROTECT_FROM_INTERNAL='no' => allowed",
      service,
      interface
    )
    return true
  end

  # Check and return whether the service (port) is supported anywhere
  ret = false
  Builtins.foreach(zones) do |zone|
    # This function can also handle port ranges
    if ArePortsOrServicesAllowed([service], protocol, zone, true)
      ret = true
      raise Break
    end
  end

  ret
end

- (Object) Import(import_settings)

Function for setting SuSEFirewall configuration from input

Parameters:

  • map (string, any)

    with configuration



1453
1454
1455
1456
1457
1458
1459
1460
# File '../../src/modules/SuSEFirewall.rb', line 1453

def Import(import_settings)
  import_settings = deep_copy(import_settings)
  SetModified()

  @SETTINGS = deep_copy(import_settings)

  nil
end

- (Object) IncreaseVerbosity

Local function for increasing the verbosity level.



334
335
336
337
338
# File '../../src/modules/SuSEFirewall.rb', line 334

def IncreaseVerbosity
  @verbose_level = Ops.add(@verbose_level, 1)

  nil
end

- (Array<String>) InterfacesSupportedByAnyFeature(zone)

Returns list of interfaces not mentioned in any zone and covered by the special string 'any' in zone 'EXT' if such string exists there and the zone is EXT. If the feature 'any' is not set, function returns empty list.

Parameters:

  • zone (String)

Returns:

  • (Array<String>)

    of interfaces covered by special string 'any'

See Also:

  • #IsAnyNetworkInterfaceSupported()


1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
# File '../../src/modules/SuSEFirewall.rb', line 1825

def InterfacesSupportedByAnyFeature(zone)
  result = []

  if zone == @special_all_interface_zone && IsAnyNetworkInterfaceSupported()
    known_interfaces_now = GetListOfKnownInterfaces()
    configured_interfaces = GetFirewallInterfaces()
    Builtins.foreach(known_interfaces_now) do |one_interface|
      if !Builtins.contains(configured_interfaces, one_interface)
        Builtins.y2milestone(
          "Interface '%1' supported by special string '%2' in zone '%3'",
          one_interface,
          @special_all_interface_string,
          @special_all_interface_zone
        )
        result = Builtins.add(result, one_interface)
      end
    end
  end

  deep_copy(result)
end

- (Boolean) IsAnyNetworkInterfaceSupported

Function returns whether the feature 'any' network interface is supported in the firewall configuration. The string 'any' must be in the 'EXT' zone. Updated: Currently returns only 'true' as every unasigned interface is automatically assigned to the EXT zone by SuSEfirewall2.

Returns:

  • (Boolean)

    is_supported whether the feature is supported or not



321
322
323
324
# File '../../src/modules/SuSEFirewall.rb', line 321

def IsAnyNetworkInterfaceSupported
  # Currently unasigned interfaces belong to the EXT zone by dafault
  true
end

- (Boolean) IsBroadcastAllowed(needed_ports, zone)

Function returns if broadcast is allowed for needed ports in zone.

Examples:

IsBroadcastAllowed ([“port-xyz”, “53”], “EXT”) -> true

Parameters:

  • list (string)

    ports

  • zone (String)

Returns:

  • (Boolean)

    if is allowed



638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
# File '../../src/modules/SuSEFirewall.rb', line 638

def IsBroadcastAllowed(needed_ports, zone)
  needed_ports = deep_copy(needed_ports)
  if Builtins.size(needed_ports) == 0
    Builtins.y2warning("Unknown service with no needed ports!")
    return nil
  end

  # getting broadcast allowed ports
  allowed_ports_map = GetBroadcastAllowedPorts()

  # Divide allowed port ranges and aliases (also with their port aliases)
  allowed_ports_divided = PortRanges.DividePortsAndPortRanges(
    Ops.get(allowed_ports_map, zone, []),
    true
  )

  # If there are no allowed ports at all
  if Ops.get(allowed_ports_divided, "ports", []) == [] &&
      Ops.get(allowed_ports_divided, "port_ranges", []) == []
    return false
  end
  # clean up the memory a bit
  allowed_ports_map = nil

  is_allowed = true
  # checking all needed ports;
  Builtins.foreach(needed_ports) do |needed_port|
    # allowed ports don't contain the needed one and also portranges don't
    if !Builtins.contains(
        Ops.get(allowed_ports_divided, "ports", []),
        needed_port
      ) &&
        !PortRanges.PortIsInPortranges(
          needed_port,
          Ops.get(allowed_ports_divided, "port_ranges", [])
        )
      is_allowed = false
      raise Break
    end
  end

  is_allowed
end

- (Boolean) IsEnabled

Function determines if all SuSEFirewall scripts are enabled in init scripts /etc/init.d/ now. For configuration “enabled” status use GetEnableService().

Returns:

  • (Boolean)

    if enabled



1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
# File '../../src/modules/SuSEFirewall.rb', line 1412

def IsEnabled
  return false if !SuSEFirewallIsInstalled()

  if Service.Enabled(@firewall_service)
    Builtins.y2milestone("Firewall service is enabled")
    return true
  else
    Builtins.y2milestone("Firewall service is not enabled")
    return false
  end
end

- (Boolean) IsInterfaceInZone(interface, zone)

Function returns if the interface is in zone.

Examples:

IsInterfaceInZone (“eth-id-01:11:DA:9C:8A:2F”, “INT”) -> false

Parameters:

  • interface (String)
  • string

    firewall zone

Returns:

  • (Boolean)

    is in zone



1469
1470
1471
1472
1473
1474
1475
# File '../../src/modules/SuSEFirewall.rb', line 1469

def IsInterfaceInZone(interface, zone)
  interfaces = Builtins.splitstring(
    Ops.get_string(@SETTINGS, Ops.add("FW_DEV_", zone), ""),
    " "
  )
  Builtins.contains(interfaces, interface)
end

- (Boolean) IsKnownZone(zone)

Local function returns if zone (shortname like “EXT”) is supported by firewall. Undefined zones are, for sure, unsupported.

Parameters:

  • zone (String)

    shortname

Returns:

  • (Boolean)

    if zone is known and supported.



465
466
467
468
469
470
471
472
473
474
475
476
# File '../../src/modules/SuSEFirewall.rb', line 465

def IsKnownZone(zone)
  is_zone = false

  Builtins.foreach(GetKnownFirewallZones()) do |known_zone|
    if known_zone == zone
      is_zone = true
      raise Break
    end
  end

  is_zone
end

- (Boolean) IsOtherFirewallRunning

Function returns if any other firewall then SuSEfirewall2 is currently running on the system. It uses command iptables to get information about just active iptables rules and compares the output with current status of SuSEfirewall2.

Returns:

  • (Boolean)

    if other firewall is running



2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
# File '../../src/modules/SuSEFirewall.rb', line 2905

def IsOtherFirewallRunning
  any_firewall_running = true

  # grep must return at least blank lines, else it returns 'exit 1' instead of 'exit 0'
  command = "iptables -L -n | grep -v \"^\\(Chain\\|target\\)\""

  iptables = Convert.to_map(
    SCR.Execute(path(".target.bash_output"), command)
  )
  if Ops.get_integer(iptables, "exit", 0) == 0
    iptables_list = Builtins.splitstring(
      Ops.get_string(iptables, "stdout", ""),
      "\n"
    )
    iptables_list = Builtins.filter(iptables_list) do |iptable_rule|
      iptable_rule != ""
    end

    Builtins.y2milestone(
      "Count of active iptables now: %1",
      Builtins.size(iptables_list)
    )

    # none iptables rules
    if Ops.greater_than(Builtins.size(iptables_list), 0)
      any_firewall_running = true 
      # any iptables rules exist
    else
      any_firewall_running = false
    end 
    # error running command
  else
    Builtins.y2error(
      "Services Command: %1 (Exit %2) -> %3",
      command,
      Ops.get(iptables, "exit"),
      Ops.get(iptables, "stderr")
    )
    return nil
  end

  # any firewall is running but it is not a SuSEfirewall2
  if any_firewall_running && !IsStarted()
    Builtins.y2warning("Any other firewall is running...")
    return true
  end
  # no firewall is running or the running firewall is SuSEfirewall2
  false
end

- (Boolean) IsServiceDefinedByPackageSupportedInZone(service, zone)

Returns whether a service is mentioned in FW_CONFIGURATIONS_. These services are defined by random packages.

IsServiceDefinedByPackageSupportedInZone (“service:sshd”, “EXT”) -> true

Parameters:

  • service, (String)

    e.g., “service:sshd”

  • zone, (String)

    e.g., “EXT”

Returns:

  • (Boolean)

    if service is supported in zone



2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
# File '../../src/modules/SuSEFirewall.rb', line 2132

def IsServiceDefinedByPackageSupportedInZone(service, zone)
  return nil if !IsKnownZone(zone)

  if service == nil
    Builtins.y2error("Service Id can't be nil!")
    return nil
  elsif Builtins.regexpmatch(service, "^service:.*")
    service = Builtins.regexpsub(service, "^service:(.*)", "\\1")
  end

  # services defined by package are listed without "service:" which is here
  # just to distinguish between dynamic and static definitions
  supported_services = Builtins.splitstring(
    Ops.get_string(@SETTINGS, Ops.add("FW_CONFIGURATIONS_", zone), ""),
    " "
  )
  Builtins.contains(supported_services, service)
end

- (Boolean) IsServiceSupportedInZone(service, zone)

Function returns if service is supported (allowed) in zone. Service must be defined in the SuSEFirewallServices. Works transparently also with services defined by packages. Such service starts with “service:” prefix.

// All ports defined by dns-server service in SuSEFirewallServices module // are enabled in the respective zone IsServiceSupportedInZone (“dns-server”, “EXT”) -> true // irc-server definition exists on the system and the irc-server // is mentioned in FW_CONFIGURATIONS_EXT variable of SuSEfirewall2 IsServiceSupportedInZone (“service:irc-server”, “EXT”) -> true

Parameters:

  • service (String)

    id

  • zone (String)

Returns:

  • (Boolean)

    if supported

See Also:

  • Module SuSEFirewallServices


2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
# File '../../src/modules/SuSEFirewall.rb', line 2167

def IsServiceSupportedInZone(service, zone)
  return nil if !IsKnownZone(zone)

  needed = SuSEFirewallServices.GetNeededPortsAndProtocols(service)

  # SuSEFirewall feature FW_PROTECT_FROM_INT
  # should not be protected and searched zones include also internal (or the zone IS internal, sure)
  if zone == @int_zone_shortname && !GetProtectFromInternalZone()
    Builtins.y2milestone(
      "Checking for service '%1', in '%2', PROTECT_FROM_INTERNAL='no' => allowed",
      service,
      zone
    )
    return true
  end

  # FATE #300687: Ports for SuSEfirewall added via packages
  if SuSEFirewallServices.ServiceDefinedByPackage(service)
    supported = IsServiceDefinedByPackageSupportedInZone(service, zone)
    return supported
  end

  # starting with nil value, any false means that the service is not supported
  service_is_supported = nil
  Builtins.foreach(@service_defined_by) do |key|
    needed_ports = Ops.get(needed, key, [])
    next if needed_ports == []
    if key == "tcp_ports"
      service_is_supported = ArePortsOrServicesAllowed(
        needed_ports,
        "TCP",
        zone,
        true
      )
    elsif key == "udp_ports"
      service_is_supported = ArePortsOrServicesAllowed(
        needed_ports,
        "UDP",
        zone,
        true
      )
    elsif key == "rpc_ports"
      service_is_supported = ArePortsOrServicesAllowed(
        needed_ports,
        "RPC",
        zone,
        false
      )
    elsif key == "ip_protocols"
      service_is_supported = ArePortsOrServicesAllowed(
        needed_ports,
        "IP",
        zone,
        false
      )
    elsif "broadcast_ports" == key
      # testing for allowed broadcast ports
      service_is_supported = IsBroadcastAllowed(needed_ports, zone)
    else
      Builtins.y2error("Unknown key '%1'", key)
    end
    # service is not supported, we don't have to do more tests
    raise Break if service_is_supported == false
  end

  service_is_supported
end

- (Boolean) IsStarted

Function determines if at least one SuSEFirewall script is started now. For configuration “started” status use GetStartService().

Returns:

  • (Boolean)

    if started



1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
# File '../../src/modules/SuSEFirewall.rb', line 1428

def IsStarted
  return false if !SuSEFirewallIsInstalled()

  return true if Mode.testsuite

  Builtins.y2milestone("Checking firewall status...")
  if Service.Status(@firewall_service) == 0
    Builtins.y2milestone("Firewall service is started")
    return true
  else
    Builtins.y2milestone("Firewall service is stopped")
    return false
  end
end

- (Boolean) IsSupportedProtocol(protocol)

Local function returns if protocol is supported by firewall. Protocol name must be in upper-cases.

Parameters:

  • protocol (String)

Returns:

  • (Boolean)

    if protocol is supported



456
457
458
# File '../../src/modules/SuSEFirewall.rb', line 456

def IsSupportedProtocol(protocol)
  Builtins.contains(@supported_protocols, protocol)
end

- (Boolean) IsVerbose

Local function returns if other functions should produce verbose output. like popups, reporting errors, etc.

Returns:

  • (Boolean)

    is_verbose



351
352
353
354
# File '../../src/modules/SuSEFirewall.rb', line 351

def IsVerbose
  # verbose level must be above zero to be verbose
  Ops.greater_than(@verbose_level, 0)
end

- (Object) main



41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
# File '../../src/modules/SuSEFirewall.rb', line 41

def main
  textdomain "base"

  Yast.import "Mode"
  Yast.import "Service"
  Yast.import "NetworkInterfaces"
  Yast.import "SuSEFirewallServices"
  Yast.import "PortAliases"
  Yast.import "Report"
  Yast.import "Message"
  Yast.import "Progress"
  Yast.import "PortRanges"
  Yast.import "PackageSystem"
  Yast.import "FileUtils"
  Yast.import "Directory"
  Yast.import "Stage"
  Yast.import "Pkg"

  # <!-- SuSEFirewall VARIABLES //-->

  @FIREWALL_PACKAGE = "SuSEfirewall2"

  # configuration hasn't been read for the default
  # this should reduce the readings to only ONE
  @configuration_has_been_read = false

  # String which includes all interfaces not-defined in any zone
  @special_all_interface_string = "any"

  # Maximal number of port number, they are in the interval 1-65535 included
  @max_port_number = PortRanges.max_port_number

  # Zone which works with the special_all_interface_string string
  @special_all_interface_zone = "EXT"

  # firewall settings map
  @SETTINGS = {}

  # configuration was modified when true
  @modified = false

  # defines if SuSEFirewall is running
  @is_running = false

  # default settings for SuSEFirewall
  @DEFAULT_SETTINGS = {
    "FW_LOG_ACCEPT_ALL"          => "no",
    "FW_LOG_ACCEPT_CRIT"         => "yes",
    "FW_LOG_DROP_ALL"            => "no",
    "FW_LOG_DROP_CRIT"           => "yes",
    "FW_PROTECT_FROM_INT"        => "no",
    "FW_ROUTE"                   => "no",
    "FW_MASQUERADE"              => "no",
    "FW_ALLOW_FW_TRACEROUTE"     => "yes",
    "FW_ALLOW_PING_FW"           => "yes",
    "FW_ALLOW_FW_BROADCAST_EXT"  => "no",
    "FW_ALLOW_FW_BROADCAST_INT"  => "no",
    "FW_ALLOW_FW_BROADCAST_DMZ"  => "no",
    "FW_IGNORE_FW_BROADCAST_EXT" => "yes",
    "FW_IGNORE_FW_BROADCAST_INT" => "no",
    "FW_IGNORE_FW_BROADCAST_DMZ" => "no",
    "FW_IPSEC_TRUST"             => "no"
  }

  # verbose_level -> if verbosity is more than 0, be verbose, starting in verbose mode
  @verbose_level = 1

  # list of known firewall zones
  @known_firewall_zones = ["INT", "DMZ", "EXT"]

  # map defines zone name for all known firewall zones
  @zone_names = {
    # TRANSLATORS: Firewall zone name - used in combo box or dialog title
    "EXT" => _(
      "External Zone"
    ),
    # TRANSLATORS: Firewall zone name - used in combo box or dialog title
    "INT" => _(
      "Internal Zone"
    ),
    # TRANSLATORS: Firewall zone name - used in combo box or dialog title
    "DMZ" => _(
      "Demilitarized Zone"
    )
  }

  # internal zone identification - useful for protect-from-internal
  @int_zone_shortname = "INT"

  # list of protocols supported in firewall, use only upper-cases
  @supported_protocols = ["TCP", "UDP", "RPC", "IP"]

  # list of keys in map of definition well-known services
  @service_defined_by = [
    "tcp_ports",
    "udp_ports",
    "rpc_ports",
    "ip_protocols",
    "broadcast_ports"
  ]

  # list of services currently allowed, which share ports (for instance RPC services)
  @allowed_conflict_services = {}

  @firewall_service = "SuSEfirewall2"

  @SuSEFirewall_variables = [
    # zones and interfaces
    "FW_DEV_INT",
    "FW_DEV_DMZ",
    "FW_DEV_EXT",
    # services in zones
    "FW_SERVICES_INT_TCP",
    "FW_SERVICES_INT_UDP",
    "FW_SERVICES_INT_RPC",
    "FW_SERVICES_INT_IP",
    "FW_SERVICES_DMZ_TCP",
    "FW_SERVICES_DMZ_UDP",
    "FW_SERVICES_DMZ_RPC",
    "FW_SERVICES_DMZ_IP",
    "FW_SERVICES_EXT_TCP",
    "FW_SERVICES_EXT_UDP",
    "FW_SERVICES_EXT_RPC",
    "FW_SERVICES_EXT_IP",
    "FW_PROTECT_FROM_INT",
    # global routing, masquerading
    "FW_ROUTE",
    "FW_MASQUERADE",
    "FW_FORWARD_MASQ",
    "FW_FORWARD_ALWAYS_INOUT_DEV",
    # broadcast packets
    "FW_ALLOW_FW_BROADCAST_EXT",
    "FW_ALLOW_FW_BROADCAST_INT",
    "FW_ALLOW_FW_BROADCAST_DMZ",
    "FW_IGNORE_FW_BROADCAST_EXT",
    "FW_IGNORE_FW_BROADCAST_INT",
    "FW_IGNORE_FW_BROADCAST_DMZ",
    # FATE #300970: Support for 'Samba & friends' browsing
    "FW_SERVICES_ACCEPT_RELATED_EXT",
    "FW_SERVICES_ACCEPT_RELATED_INT",
    "FW_SERVICES_ACCEPT_RELATED_DMZ",
    # logging
    "FW_LOG_DROP_CRIT",
    "FW_LOG_DROP_ALL",
    "FW_LOG_ACCEPT_CRIT",
    "FW_LOG_ACCEPT_ALL",
    # IPsec support
    "FW_IPSEC_TRUST",
    # Custom rulezz
    #     net,protocol[,dport][,sport]
    "FW_SERVICES_ACCEPT_EXT",
    "FW_SERVICES_ACCEPT_INT",
    "FW_SERVICES_ACCEPT_DMZ",
    # Custom kernel modules, e.g., for FTP
    "FW_LOAD_MODULES",
    # Services defined in /usr/share/SuSEfirewall2/services/ directory
    # FATE #300687: Ports for SuSEfirewall added via packages
    "FW_CONFIGURATIONS_EXT",
    "FW_CONFIGURATIONS_INT",
    "FW_CONFIGURATIONS_DMZ"
  ]

  @one_line_per_record = [
    "FW_FORWARD_MASQ",
    "FW_SERVICES_ACCEPT_EXT",
    "FW_SERVICES_ACCEPT_INT",
    "FW_SERVICES_ACCEPT_DMZ"
  ]

  # FATE #300970: Firewall support for SMB browsing
  @broadcast_related_module = "nf_conntrack_netbios_ns"


  # Variable for ReportOnlyOnce() function
  @report_only_once = []

  # <!-- SuSEFirewall LOCAL FUNCTIONS //-->

  # <!-- SuSEFirewall GLOBAL FUNCTIONS //-->

  # bnc #388773
  # By default needed packages are just checked, not installed
  @check_and_install_package = false

  # Are needed packages (SuSEfirewall2) installed?
  @needed_packages_installed = nil

  # Configuration has been read and it's useful
  @fw_service_can_be_configured = false

  # old internal services definitions are converted to new services defined by packages
  # but only once
  @converted_to_services_dbp_file = Ops.add(
    Directory.vardir,
    "/yast2-firewall-already-converted-to-sdbp"
  )

  # services have been already converted
  @already_converted = false

  @protocol_translations = {
    # protocol name
    "tcp"   => _("TCP"),
    # protocol name
    "udp"   => _("UDP"),
    # protocol name
    "_rpc_" => _("RPC"),
    # protocol name
    "ip"    => _("IP")
  }
end

- (Boolean) Read

Function for reading SuSEFirewall configuration. Fills internal variables only.

Returns:

  • (Boolean)

    if successful



2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
# File '../../src/modules/SuSEFirewall.rb', line 2453

def Read
  # Do not read it again and again
  # to avoid rewriting changes already made
  if @configuration_has_been_read
    Builtins.y2milestone(
      "SuSEfirewall2 configuration has been read already."
    )
    return @fw_service_can_be_configured
  end

  # bnc #887406
  if !FileUtils.Exists(CONFIG_FILE) || !SuSEFirewallIsInstalled()
    log.warn "No firewall config -> firewall can't be read"
    FillUpEmptyConfig()
    return false
  end

  # Can be configured, packages were installed
  @fw_service_can_be_configured = true

  # Progress only for normal configuration
  have_progress = Mode.normal

  if have_progress
    # TRANSLATORS: Dialog caption
    read_caption = _("Initializing Firewall Configuration")

    Progress.New(
      read_caption,
      " ",
      3,
      [
        # TRANSLATORS: Progress step
        _("Check for network devices"),
        # TRANSLATORS: Progress step
        _("Read current configuration"),
        # TRANSLATORS: Progress step
        _("Check possibly conflicting services"),
      ],
      [
        # TRANSLATORS: Progress step
        _("Checking for network devices..."),
        # TRANSLATORS: Progress step
        _("Reading current configuration..."),
        # TRANSLATORS: Progress step
        _("Checking possibly conflicting services..."),
        Message.Finished
      ],
      ""
    )

    Progress.NextStage
  end

  # Always call NI::Read, bnc #396646
  NetworkInterfaces.Read

  if Mode.installation
    # Allways modified for installation, allways save the final state
    # fixing bug #67355
    # SetModified();
    make_parser_happy = true
  end

  Progress.NextStage if have_progress

  # get default configuration for autoinstallation
  # if (Mode::installation() || Mode::autoinst()) {
  if Mode.autoinst
    ReadDefaultConfiguration() 
    # read current configuration for another cases
  else
    ReadCurrentConfiguration()
  end

  Progress.NextStage if have_progress

  # checking if any possibly conficting services were turned on in configuration
  # filling internal values for later checkings
  # CheckAllPossiblyConflictingServices();
  # -- Function has been turned off as we don't support services defined by YaST itself anymore --

  Builtins.y2milestone(
    "Firewall configuration has been read: %1.",
    @SETTINGS
  )
  # to read configuration only once
  @configuration_has_been_read = true

  Progress.NextStage if have_progress

  # bnc #399217
  # Converting built-in service definitions to services defined by packages
  ConvertToServicesDefinedByPackages()

  Progress.Finish if have_progress

  true
end

- (Object) ReadCurrentConfiguration

Local function reads current configuration and fills internal values.



2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
# File '../../src/modules/SuSEFirewall.rb', line 2419

def ReadCurrentConfiguration
  @SETTINGS = {}

  # is firewall enabled in /etc/init.d/ ?
  Ops.set(@SETTINGS, "enable_firewall", IsEnabled())
  # is firewall started now?
  Ops.set(@SETTINGS, "start_firewall", IsStarted())

  ReadSysconfigSuSEFirewall(GetListOfSuSEFirewallVariables())

  nil
end

- (Object) ReadDefaultConfiguration

Local function sets the default configuration and fills internal values.



2410
2411
2412
2413
2414
2415
2416
# File '../../src/modules/SuSEFirewall.rb', line 2410

def ReadDefaultConfiguration
  @SETTINGS = {}

  ResetSysconfigSuSEFirewall(GetListOfSuSEFirewallVariables())

  nil
end

- (Object) ReadSysconfigSuSEFirewall(variables)

Local function for reading list of sysconfig variables into internal variables.

Parameters:

  • list (string)

    of sysconfig variables



367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
# File '../../src/modules/SuSEFirewall.rb', line 367

def ReadSysconfigSuSEFirewall(variables)
  variables = deep_copy(variables)
  Builtins.foreach(variables) do |variable|
    value = Convert.to_string(
      SCR.Read(Builtins.add(path(".sysconfig.SuSEfirewall2"), variable))
    )
    # if value is undefined, get default value
    value = GetDefaultValue(variable) if value == nil || value == ""
    # BNC #426000
    # backslash at the end
    if Builtins.regexpmatch(value, "[ \t]*\\\\[ \t]*\n")
      rules = Builtins.splitstring(value, "\\ \t\n")
      rules = Builtins.filter(rules) do |one_rule|
        one_rule != nil && one_rule != ""
      end
      value = Builtins.mergestring(rules, " ")
    end
    # BNC #194419
    # replace all "\n" with " " in variables
    if Builtins.regexpmatch(value, "\n")
      value = Builtins.mergestring(Builtins.splitstring(value, "\n"), " ")
    end
    # replace all "\t" with " " in variables
    if Builtins.regexpmatch(value, "\t")
      value = Builtins.mergestring(Builtins.splitstring(value, "\t"), " ")
    end
    Ops.set(@SETTINGS, variable, value)
  end

  nil
end

- (Object) RemoveAllowedBroadcast(needed_ports, zone)

Local function removes list of ports from port allowing broadcast packets in zone.

Parameters:

  • list (of ports)

    to be removed

  • zone (String)


686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
# File '../../src/modules/SuSEFirewall.rb', line 686

def RemoveAllowedBroadcast(needed_ports, zone)
  needed_ports = deep_copy(needed_ports)
  SetModified()

  allowed_ports = GetBroadcastAllowedPorts()
  list_ports_allowed = Ops.get(allowed_ports, zone, [])

  # ports to be allowed one by one
  Builtins.foreach(needed_ports) do |allow_this_port|
    # remove all aliases of ports yet mentioned in zone
    aliases_of_port = PortAliases.GetListOfServiceAliases(allow_this_port)
    list_ports_allowed = Builtins.filter(list_ports_allowed) do |just_allowed|
      !Builtins.contains(aliases_of_port, just_allowed)
    end
  end
  Ops.set(allowed_ports, zone, list_ports_allowed)

  # save it using function
  SetBroadcastAllowedPorts(allowed_ports)

  nil
end

- (Object) RemoveAllowedPortsOrServices(remove_ports, protocol, zone, check_for_aliases)

Local function removes ports and their aliases (if check_for_aliases is true), for requested protocol and zone.

Parameters:

  • list (string)

    ports to be removed

  • protocol (String)
  • zone (String)
  • boolean

    check for port-aliases



773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
# File '../../src/modules/SuSEFirewall.rb', line 773

def RemoveAllowedPortsOrServices(remove_ports, protocol, zone, check_for_aliases)
  remove_ports = deep_copy(remove_ports)
  if Ops.less_than(Builtins.size(remove_ports), 1)
    Builtins.y2warning(
      "Undefined list of %1 services/ports for service",
      protocol
    )
    return
  end

  SetModified()

  # all allowed ports
  allowed_services = PortRanges.DividePortsAndPortRanges(
    GetAllowedServicesForZoneProto(zone, protocol),
    false
  )

  # removing all aliases of ports too, adding aliases into
  if check_for_aliases
    remove_ports_with_aliases = []
    Builtins.foreach(remove_ports) do |remove_port|
      # skip port ranges, they cannot have any port-alias
      if PortRanges.IsPortRange(remove_port)
        remove_ports_with_aliases = Builtins.add(
          remove_ports_with_aliases,
          remove_port
        )
        next
      end
      remove_these_ports = PortAliases.GetListOfServiceAliases(remove_port)
      remove_these_ports = [remove_port] if remove_these_ports == nil
      remove_ports_with_aliases = Convert.convert(
        Builtins.union(remove_ports_with_aliases, remove_these_ports),
        :from => "list",
        :to   => "list <string>"
      )
    end
    remove_ports = deep_copy(remove_ports_with_aliases)
  end
  remove_ports = Builtins.toset(remove_ports)

  # Remove ports only once (because of port aliases), any => integers and strings
  already_removed = []

  Builtins.foreach(remove_ports) do |remove_port|
    # Removing from normal ports
    Ops.set(
      allowed_services,
      "ports",
      Builtins.filter(Ops.get(allowed_services, "ports", [])) do |allowed_port|
        allowed_port != "" && allowed_port != remove_port
      end
    )
    # Removing also from port ranges
    if Ops.get(allowed_services, "port_ranges", []) != []
      # Removing a real port from port ranges
      if !PortRanges.IsPortRange(remove_port)
        remove_port_nr = PortAliases.GetPortNumber(remove_port)
        # Because of all port aliases
        if !Builtins.contains(already_removed, remove_port_nr)
          already_removed = Builtins.add(already_removed, remove_port_nr)
          Ops.set(
            allowed_services,
            "port_ranges",
            PortRanges.RemovePortFromPortRanges(
              remove_port_nr,
              Ops.get(allowed_services, "port_ranges", [])
            )
          )
        end 
        # Removing a port range from port ranges
      else
        if !Builtins.contains(already_removed, remove_port)
          # Just filtering the exact port range
          Ops.set(
            allowed_services,
            "port_ranges",
            Builtins.filter(Ops.get(allowed_services, "port_ranges", [])) do |one_port_range|
              one_port_range != remove_port
            end
          )
          already_removed = Builtins.add(already_removed, remove_port)
        end
      end
    end
  end

  allowed_services_all = Convert.convert(
    Builtins.union(
      Ops.get(allowed_services, "ports", []),
      Ops.get(allowed_services, "port_ranges", [])
    ),
    :from => "list",
    :to   => "list <string>"
  )
  allowed_services_all = PortRanges.FlattenServices(
    allowed_services_all,
    protocol
  )

  SetAllowedServicesForZoneProto(allowed_services_all, zone, protocol)

  nil
end

- (Object) RemoveForwardIntoMasqueradeRule(remove_item)

Function removes rule for forwarding into masquerade from the list of current rules returned by GetListOfForwardsIntoMasquerade().

See Also:

  • #GetListOfForwardsIntoMasquerade()


3157
3158
3159
3160
3161
3162
3163
3164
3165
3166
3167
3168
3169
3170
3171
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182
3183
# File '../../src/modules/SuSEFirewall.rb', line 3157

def RemoveForwardIntoMasqueradeRule(remove_item)
  SetModified()

  forward_rules = []

  row_counter = 0
  Builtins.foreach(
    Builtins.splitstring(
      Ops.get_string(@SETTINGS, "FW_FORWARD_MASQ", ""),
      " "
    )
  ) do |forward_rule|
    next if forward_rule == ""
    if row_counter != remove_item
      forward_rules = Builtins.add(forward_rules, forward_rule)
    end
    row_counter = Ops.add(row_counter, 1)
  end

  Ops.set(
    @SETTINGS,
    "FW_FORWARD_MASQ",
    Builtins.mergestring(forward_rules, " ")
  )

  nil
end

- (Object) RemoveInterfaceFromZone(interface, zone)

Function removes interface from defined zone.

Examples:

RemoveInterfaceFromZone (“modem0”, “EXT”)

Parameters:

  • interface (String)
  • zone (String)


1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
# File '../../src/modules/SuSEFirewall.rb', line 1713

def RemoveInterfaceFromZone(interface, zone)
  SetModified()

  Builtins.y2milestone(
    "Removing interface '%1' from '%2' zone.",
    interface,
    zone
  )

  interfaces_in_zone = Builtins.splitstring(
    Ops.get_string(@SETTINGS, Ops.add("FW_DEV_", zone), ""),
    " "
  )
  interfaces_in_zone = Builtins.filter(interfaces_in_zone) do |single_interface|
    single_interface != "" && single_interface != interface
  end
  Ops.set(
    @SETTINGS,
    Ops.add("FW_DEV_", zone),
    Builtins.mergestring(interfaces_in_zone, " ")
  )

  nil
end

- (Object) RemoveOldAllowedServiceFromZone(old_service_def, zone)

Removes old-service definitions before they are added as services defined by packages.



3591
3592
3593
3594
3595
3596
3597
3598
3599
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610
3611
3612
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625
3626
3627
3628
3629
3630
3631
3632
3633
# File '../../src/modules/SuSEFirewall.rb', line 3591

def RemoveOldAllowedServiceFromZone(old_service_def, zone)
  old_service_def = deep_copy(old_service_def)
  Builtins.y2milestone("Removing: %1 from zone %2", old_service_def, zone)

  if Ops.get_list(old_service_def, "tcp_ports", []) != []
    Builtins.foreach(Ops.get_list(old_service_def, "tcp_ports", [])) do |one_service|
      RemoveService(one_service, "TCP", zone)
    end
  end

  if Ops.get_list(old_service_def, "udp_ports", []) != []
    Builtins.foreach(Ops.get_list(old_service_def, "udp_ports", [])) do |one_service|
      RemoveService(one_service, "UDP", zone)
    end
  end

  if Ops.get_list(old_service_def, "rpc_ports", []) != []
    Builtins.foreach(Ops.get_list(old_service_def, "rpc_ports", [])) do |one_service|
      RemoveService(one_service, "RPC", zone)
    end
  end

  if Ops.get_list(old_service_def, "ip_protocols", []) != []
    Builtins.foreach(Ops.get_list(old_service_def, "ip_protocols", [])) do |one_service|
      RemoveService(one_service, "IP", zone)
    end
  end

  if Ops.get_list(old_service_def, "broadcast_ports", []) != []
    broadcast = GetBroadcastAllowedPorts()

    Ops.set(broadcast, zone, Builtins.filter(Ops.get(broadcast, zone, [])) do |one_port|
      !Builtins.contains(
        Ops.get_list(old_service_def, "broadcast_ports", []),
        one_port
      )
    end)

    SetBroadcastAllowedPorts(broadcast)
  end

  nil
end

- (Boolean) RemoveService(service, protocol, interface)

Function removes service from selected zone (or for interface) for selected protocol. Function takes care about port-aliases, removes all of them.

RemoveService (“22”, “TCP”, “DMZ”) -> true is the same as RemoveService (“ssh”, “TCP”, “DMZ”) -> true

Parameters:

  • service/port (String)
  • protocol (String)

    TCP, UDP, RPC, IP

  • string

    zone name or interface name

Returns:

  • (Boolean)

    success



2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
# File '../../src/modules/SuSEFirewall.rb', line 2017

def RemoveService(service, protocol, interface)
  success = false
  Builtins.y2milestone(
    "Removing service %1, protocol %2 from %3",
    service,
    protocol,
    interface
  )

  if !IsSupportedProtocol(protocol)
    Builtins.y2error("Unknown protocol: %1", protocol)
    return false
  end

  zones_affected = []

  # "all" means for all known zones
  if interface == "all"
    zones_affected = GetKnownFirewallZones() 

    # zone or interface name
  else
    if !IsKnownZone(interface)
      # interface is probably interface-name, checking for respective zone
      interface = GetZoneOfInterface(interface)
      # interface is not assigned to any zone
      if interface == nil
        # TRANSLATORS: Error message, %1 = interface name (like eth0)
        Report.Error(
          Builtins.sformat(
            _(
              "Interface '%1' is not assigned to any firewall zone.\nRun YaST2 Firewall and assign it.\n"
            ),
            interface
          )
        )
        Builtins.y2warning(
          "Interface '%1' is not assigned to any firewall zone",
          interface
        )
        return false
      end
    end
    zones_affected = [interface]
  end

  SetModified()


  # Adding service support into each mentioned zone
  Builtins.foreach(zones_affected) do |zone|
    # if the service is allowed
    if ArePortsOrServicesAllowed([service], protocol, zone, true)
      RemoveAllowedPortsOrServices([service], protocol, zone, true)
    else
      Builtins.y2milestone(
        "Port %1 has been already removed from %2",
        service,
        zone
      )
    end
  end

  true
end

- (Object) RemoveServiceDefinedByPackageFromZone(service, zone)

Removes service defined by package (FATE #300687) from enabled services.

RemoveServiceDefinedByPackageFromZone (“service:irc-server”, “EXT”);

Parameters:

  • string

    service_id

  • zone (String)


918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
# File '../../src/modules/SuSEFirewall.rb', line 918

def RemoveServiceDefinedByPackageFromZone(service, zone)
  return nil if !IsKnownZone(zone)

  if service == nil
    Builtins.y2error("Service Id can't be nil!")
    return nil
  elsif Builtins.regexpmatch(service, "^service:.*")
    service = Builtins.regexpsub(service, "^service:(.*)", "\\1")
  end

  # services defined by package are listed without "service:" which is here
  # just to distinguish between dynamic and static definitions
  supported_services = Builtins.splitstring(
    Ops.get_string(@SETTINGS, Ops.add("FW_CONFIGURATIONS_", zone), ""),
    " "
  )
  # Removing the service
  supported_services = Builtins.filter(supported_services) do |one_service|
    one_service != service
  end
  Ops.set(
    @SETTINGS,
    Ops.add("FW_CONFIGURATIONS_", zone),
    Builtins.mergestring(supported_services, " ")
  )

  SetModified()

  nil
end

- (Boolean) RemoveServiceFromProtocolZone(remove_service, protocol, zone)

Local function for removing (disallowing) single service/port for defined protocol and zone. Functions doesn't take care of port-aliases.

Parameters:

  • string

    service/port

  • protocol (String)
  • zone (String)

Returns:

  • (Boolean)

    success



748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
# File '../../src/modules/SuSEFirewall.rb', line 748

def RemoveServiceFromProtocolZone(remove_service, protocol, zone)
  SetModified()

  key = Ops.add(Ops.add(Ops.add("FW_SERVICES_", zone), "_"), protocol)

  allowed = Builtins.splitstring(Ops.get_string(@SETTINGS, key, ""), " ")
  allowed = Builtins.filter(allowed) do |single_service|
    single_service != "" && single_service != remove_service
  end
  Ops.set(
    @SETTINGS,
    key,
    Builtins.mergestring(Builtins.toset(allowed), " ")
  )

  true
end

- (Object) RemoveServiceSupportFromZone(service, zone)

Local function removes well-known service's support from zone. Allowed ports are removed with all of their port-aliases.

Parameters:

  • service (String)

    id

  • zone (String)


992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
# File '../../src/modules/SuSEFirewall.rb', line 992

def RemoveServiceSupportFromZone(service, zone)
  needed = SuSEFirewallServices.GetNeededPortsAndProtocols(service)
  # unknown service
  if needed == nil
    Builtins.y2error("Undefined service '%1'", service)
    return nil
  end

  # FATE #300687: Ports for SuSEfirewall added via packages
  if SuSEFirewallServices.ServiceDefinedByPackage(service)
    if IsServiceSupportedInZone(service, zone) == true
      RemoveServiceDefinedByPackageFromZone(service, zone)
    end

    return nil
  end

  SetModified()

  # Removing service ports (and also port aliases for TCP and UDP)
  Builtins.foreach(@service_defined_by) do |key|
    needed_ports = Ops.get(needed, key, [])
    next if needed_ports == []
    if key == "tcp_ports"
      RemoveAllowedPortsOrServices(needed_ports, "TCP", zone, true)
    elsif key == "udp_ports"
      RemoveAllowedPortsOrServices(needed_ports, "UDP", zone, true)
    elsif key == "rpc_ports"
      RemoveAllowedPortsOrServices(needed_ports, "RPC", zone, false)
    elsif key == "ip_protocols"
      RemoveAllowedPortsOrServices(needed_ports, "IP", zone, false)
    elsif "broadcast_ports" == key
      RemoveAllowedBroadcast(needed_ports, zone)
    else
      Builtins.y2error("Unknown key '%1'", key)
    end
  end

  nil
end

- (Object) RemoveSpecialInterfaceFromZone(interface, zone)

Function removes special string from defined zone.

Parameters:

  • interface (String)
  • zone (String)


3014
3015
3016
3017
3018
3019
3020
3021
3022
3023
3024
3025
3026
3027
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037
# File '../../src/modules/SuSEFirewall.rb', line 3014

def RemoveSpecialInterfaceFromZone(interface, zone)
  SetModified()

  Builtins.y2milestone(
    "Removing special string '%1' from '%2' zone.",
    interface,
    zone
  )

  interfaces_in_zone = Builtins.splitstring(
    Ops.get_string(@SETTINGS, Ops.add("FW_DEV_", zone), ""),
    " "
  )
  interfaces_in_zone = Builtins.filter(interfaces_in_zone) do |single_interface|
    single_interface != "" && single_interface != interface
  end
  Ops.set(
    @SETTINGS,
    Ops.add("FW_DEV_", zone),
    Builtins.mergestring(interfaces_in_zone, " ")
  )

  nil
end

- (Boolean) ReportOnlyOnce(what_to_report)

Report the error, warning, message only once. Stores the error, warning, message in memory. This is just a helper function that could avoid from filling y2log up with a lot of the very same messages - 'foreach()' is a very powerful builtin.

string error = sformat(“Port number %1 is invalid.”, port_nr); if (ReportOnlyOnce(error)) y2error(error);

Parameters:

  • string

    error, warning or message

Returns:

  • (Boolean)

    whether the message should be reported or not



302
303
304
305
306
307
308
309
# File '../../src/modules/SuSEFirewall.rb', line 302

def ReportOnlyOnce(what_to_report)
  if Builtins.contains(@report_only_once, what_to_report)
    return false
  else
    @report_only_once = Builtins.add(@report_only_once, what_to_report)
    return true
  end
end

- (Object) ResetModified

Do not use this function. Only for firewall installation proposal.



275
276
277
278
279
280
# File '../../src/modules/SuSEFirewall.rb', line 275

def ResetModified
  Builtins.y2milestone("Reseting firewall-modified to 'false'")
  @modified = false

  nil
end

- (Object) ResetReadFlag

Function resets flag which doesn't allow to read configuration from disk again. So you actually can reread the configuration from disk. Currently, only the first Read() call reads the configuration from disk.



1141
1142
1143
1144
1145
# File '../../src/modules/SuSEFirewall.rb', line 1141

def ResetReadFlag
  @configuration_has_been_read = false

  nil
end

- (Object) ResetSysconfigSuSEFirewall(variables)

Local function for reseting list of sysconfig variables in internal variables.

Parameters:

  • list (string)

    of sysconfig variables



402
403
404
405
406
407
408
409
410
# File '../../src/modules/SuSEFirewall.rb', line 402

def ResetSysconfigSuSEFirewall(variables)
  variables = deep_copy(variables)
  Builtins.foreach(variables) do |variable|
    # reseting means getting default variables
    Ops.set(@SETTINGS, variable, GetDefaultValue(variable))
  end

  nil
end

- (Boolean) SaveAndRestartService

Function for saving configuration and restarting firewall. Is is the same as Write() but write is allways forced.

Returns:

  • (Boolean)

    if successful



2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
# File '../../src/modules/SuSEFirewall.rb', line 2761

def SaveAndRestartService
  Builtins.y2milestone("Forced save and restart")
  SetModified()

  SetStartService(true)

  return false if !Write()

  true
end

- (Boolean) SetAcceptExpertRules(zone, expert_rules)

Sets expert allow rules for zone.

Parameters:

  • zone (String)
  • string

    whitespace-separated expert_rules

Returns:

  • (Boolean)

    if successful



3400
3401
3402
3403
3404
3405
3406
3407
3408
3409
3410
3411
3412
3413
# File '../../src/modules/SuSEFirewall.rb', line 3400

def SetAcceptExpertRules(zone, expert_rules)
  zone = Builtins.toupper(zone)

  # Check for zone
  if !Builtins.contains(GetKnownFirewallZones(), zone)
    Builtins.y2error("Unknown firewall zone: %1", zone)
    return false
  end

  Ops.set(@SETTINGS, Ops.add("FW_SERVICES_ACCEPT_", zone), expert_rules)
  SetModified()

  true
end

- (Object) SetAdditionalServices(protocol, zone, new_list_services)

Function sets additional ports/services from taken list. Firstly, all additional services are removed also with their aliases. Secondly new ports/protocols are added. It uses GetAdditionalServices() function to get the current state and then it removes what has been removed and adds what has been added.

SetAdditionalServices (“TCP”, “EXT”, [“53”, “128”])

Parameters:

  • protocol (String)
  • zone (String)
  • list (string)

    list of ports/protocols

See Also:

  • #GetAdditionalServices()


2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
# File '../../src/modules/SuSEFirewall.rb', line 2853

def SetAdditionalServices(protocol, zone, new_list_services)
  new_list_services = deep_copy(new_list_services)
  old_list_services = Builtins.toset(GetAdditionalServices(protocol, zone))
  new_list_services = Builtins.toset(new_list_services)

  if new_list_services != old_list_services
    SetModified()

    add_services = []
    remove_services = []

    # Add these services
    Builtins.foreach(new_list_services) do |service|
      if !Builtins.contains(old_list_services, service)
        add_services = Builtins.add(add_services, service)
      end
    end
    # Remove these services
    Builtins.foreach(old_list_services) do |service|
      if !Builtins.contains(new_list_services, service)
        remove_services = Builtins.add(remove_services, service)
      end
    end

    if Ops.greater_than(Builtins.size(remove_services), 0)
      Builtins.y2milestone(
        "Removing additional services %1/%2 from zone %3",
        remove_services,
        protocol,
        zone
      )
      RemoveAllowedPortsOrServices(remove_services, protocol, zone, true)
    end
    if Ops.greater_than(Builtins.size(add_services), 0)
      Builtins.y2milestone(
        "Adding additional services %1/%2 into zone %3",
        add_services,
        protocol,
        zone
      )
      AddAllowedPortsOrServices(add_services, protocol, zone)
    end
  end

  nil
end

- (Object) SetAllowedServicesForZoneProto(allowed_services, zone, protocol)

Function sets list of services as allowed ports for zone and protocol

Parameters:

  • list (string)

    of allowed ports/services

  • zone (String)
  • protocol (String)


525
526
527
528
529
530
531
532
533
534
535
536
# File '../../src/modules/SuSEFirewall.rb', line 525

def SetAllowedServicesForZoneProto(allowed_services, zone, protocol)
  allowed_services = deep_copy(allowed_services)
  SetModified()

  Ops.set(
    @SETTINGS,
    Ops.add(Ops.add(Ops.add("FW_SERVICES_", zone), "_"), protocol),
    Builtins.mergestring(Builtins.toset(allowed_services), " ")
  )

  nil
end

- (Object) SetBroadcastAllowedPorts(broadcast)

Function creates allowed-broadcast-ports string from broadcast map and saves it.

Parameters:

  • map (zone_string, list <string>)

    strings are allowed ports or port ranges

See Also:

  • for an example of data


616
617
618
619
620
621
622
623
624
625
626
627
628
629
# File '../../src/modules/SuSEFirewall.rb', line 616

def SetBroadcastAllowedPorts(broadcast)
  broadcast = deep_copy(broadcast)
  SetModified()

  Builtins.foreach(GetKnownFirewallZones()) do |zone|
    Ops.set(broadcast, zone, ["no"]) if Ops.get(broadcast, zone, []) == []
    SetBroadcastConfiguration(
      zone,
      Builtins.mergestring(Ops.get(broadcast, zone, []), " ")
    )
  end

  nil
end

- (Object) SetBroadcastConfiguration(zone, broadcast_configuration)

Local function saves configuration string for broadcast packets.

Parameters:

  • string

    with broadcast configuration



548
549
550
551
552
553
554
555
556
557
558
# File '../../src/modules/SuSEFirewall.rb', line 548

def SetBroadcastConfiguration(zone, broadcast_configuration)
  SetModified()

  Ops.set(
    @SETTINGS,
    Ops.add("FW_ALLOW_FW_BROADCAST_", zone),
    broadcast_configuration
  )

  nil
end

- (Object) SetEnableService(enable_service)

Function which sets if SuSEfirewall should start in Write process

Parameters:

  • boolean

    start_service at Write() process



1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
# File '../../src/modules/SuSEFirewall.rb', line 1317

def SetEnableService(enable_service)
  if !SuSEFirewallIsInstalled()
    Builtins.y2warning("Cannot set SetEnableService")
    return nil
  end

  if GetEnableService() != enable_service
    SetModified()

    Builtins.y2milestone("Setting enable-firewall to %1", enable_service)
    Ops.set(@SETTINGS, "enable_firewall", enable_service)
  else
    # without set modified
    Builtins.y2milestone(
      "enable-firewall has been already set to %1",
      enable_service
    )
    Ops.set(@SETTINGS, "enable_firewall", enable_service)
  end

  nil
end

- (Object) SetFirewallKernelModules(k_modules)

Sets list of additional kernel modules to be loaded by firewall on startup.

Examples:

SuSEFirewall::SetFirewallKernelModules ([“ip_conntrack_ftp”,“ip_nat_ftp”]);

Parameters:

  • list (string)

    of kernel modules

See Also:

  • option nr. 32


3439
3440
3441
3442
3443
3444
3445
3446
3447
3448
3449
3450
3451
3452
3453
3454
3455
3456
3457
3458
3459
3460
3461
3462
3463
3464
3465
3466
3467
3468
3469
3470
3471
3472
3473
# File '../../src/modules/SuSEFirewall.rb', line 3439

def SetFirewallKernelModules(k_modules)
  k_modules = deep_copy(k_modules)
  k_modules = Builtins.filter(k_modules) do |one_module|
    if one_module == nil
      Builtins.y2error(
        "List of modules %1 contains 'nil'! It will be ignored.",
        k_modules
      )
      next false
    elsif one_module == ""
      Builtins.y2warning(
        "List of modules %1 contains an empty string, it will be ignored.",
        k_modules
      )
      next false
    end
    if Builtins.regexpmatch(one_module, " ") ||
        Builtins.regexpmatch(one_module, "\t")
      Builtins.y2warning(
        "Additional module '%1' contains spaces. They will be evaluated as two or more modules later.",
        one_module
      )
    end
    true
  end

  Ops.set(
    @SETTINGS,
    "FW_LOAD_MODULES",
    Builtins.mergestring(k_modules, " ")
  )
  SetModified()

  nil
end

- (Object) SetIgnoreLoggingBroadcast(zone, bcast)

Function sets yes/no - ingoring broadcast for zone

// Do not log broadcast packetes from DMZ SetIgnoreLoggingBroadcast (“DMZ”, “yes”)

Parameters:

  • zone (String)
  • string

    ignore 'yes' or 'no'



3349
3350
3351
3352
3353
3354
3355
3356
3357
3358
3359
3360
# File '../../src/modules/SuSEFirewall.rb', line 3349

def SetIgnoreLoggingBroadcast(zone, bcast)
  if !IsKnownZone(zone)
    Builtins.y2error("Unknown zone '%1'", zone)
    return nil
  end

  SetModified()

  Ops.set(@SETTINGS, Ops.add("FW_IGNORE_FW_BROADCAST_", zone), bcast)

  nil
end

- (Object) SetInstallPackagesIfMissing(new_status)

By default SuSEfirewall2 packages are just checked whether they are installed. With this function, you can change the behavior to also offer installing the packages.

Parameters:

  • new_status, (Boolean)

    'true' if packages should be offered for installation



1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
# File '../../src/modules/SuSEFirewall.rb', line 1086

def SetInstallPackagesIfMissing(new_status)
  if new_status == nil
    Builtins.y2error("Wrong value: %1", new_status)
    return
  end

  @check_and_install_package = new_status

  if @check_and_install_package
    Builtins.y2milestone("SuSEfirewall2 packages will installed if missing")
  else
    Builtins.y2milestone(
      "SuSEfirewall2 packages will not be installed even if missing"
    )
  end

  nil
end

- (Object) SetLoggingSettings(rule, state)

Function sets state of logging for rule taken as parameter.

SetLoggingSettings (“ACCEPT”, “ALL”) SetLoggingSettings (“DROP”, “NONE”)

Parameters:

  • rule (String)

    definition 'ACCEPT' or 'DROP'

  • string

    new logging state 'ALL', 'CRIT', or 'NONE'



3292
3293
3294
3295
3296
3297
3298
3299
3300
3301
3302
3303
3304
3305
3306
3307
3308
3309
3310
3311
3312
3313
3314
3315
3316
3317
3318
3319
3320
3321
3322
# File '../../src/modules/SuSEFirewall.rb', line 3292

def SetLoggingSettings(rule, state)
  SetModified()

  if rule == "ACCEPT"
    if state == "ALL"
      Ops.set(@SETTINGS, "FW_LOG_ACCEPT_CRIT", "yes")
      Ops.set(@SETTINGS, "FW_LOG_ACCEPT_ALL", "yes")
    elsif state == "CRIT"
      Ops.set(@SETTINGS, "FW_LOG_ACCEPT_CRIT", "yes")
      Ops.set(@SETTINGS, "FW_LOG_ACCEPT_ALL", "no")
    else
      Ops.set(@SETTINGS, "FW_LOG_ACCEPT_CRIT", "no")
      Ops.set(@SETTINGS, "FW_LOG_ACCEPT_ALL", "no")
    end
  elsif rule == "DROP"
    if state == "ALL"
      Ops.set(@SETTINGS, "FW_LOG_DROP_CRIT", "yes")
      Ops.set(@SETTINGS, "FW_LOG_DROP_ALL", "yes")
    elsif state == "CRIT"
      Ops.set(@SETTINGS, "FW_LOG_DROP_CRIT", "yes")
      Ops.set(@SETTINGS, "FW_LOG_DROP_ALL", "no")
    else
      Ops.set(@SETTINGS, "FW_LOG_DROP_CRIT", "no")
      Ops.set(@SETTINGS, "FW_LOG_DROP_ALL", "no")
    end
  else
    Builtins.y2error("Possible rules are only 'ACCEPT' or 'DROP'")
  end

  nil
end

- (Object) SetMasquerade(enable)

Function sets Masquerade support.

Parameters:

  • boolean

    to support or not to support it



3078
3079
3080
3081
3082
3083
3084
3085
3086
3087
# File '../../src/modules/SuSEFirewall.rb', line 3078

def SetMasquerade(enable)
  SetModified()

  Ops.set(@SETTINGS, "FW_MASQUERADE", enable ? "yes" : "no")

  # routing is needed for masquerading, but we can't swithc it off when disabling masquerading
  Ops.set(@SETTINGS, "FW_ROUTE", "yes") if enable

  nil
end

- (Object) SetModified

Function sets internal variable, which indicates, that any “firewall settings were modified”, to “true”.



267
268
269
270
271
# File '../../src/modules/SuSEFirewall.rb', line 267

def SetModified
  @modified = true

  nil
end

- (Object) SetProtectFromInternalZone(set_protect)

Function sets if firewall should be protected from internal zone.

Parameters:

  • boolean

    set to be protected from internal zone



1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
# File '../../src/modules/SuSEFirewall.rb', line 1163

def SetProtectFromInternalZone(set_protect)
  SetModified()

  if set_protect
    Ops.set(@SETTINGS, "FW_PROTECT_FROM_INT", "yes")
  else
    Ops.set(@SETTINGS, "FW_PROTECT_FROM_INT", "no")
  end

  nil
end

- (Boolean) SetServices(services_ids, interfaces, new_status)

Function sets status for several services on several network interfaces.

SetServices ([“samba-server”, “service:irc-server”], [“eth1”, “modem0”], false) // Enabling services SetServices ([“samba-server”, “service:irc-server”], [“eth1”, “modem0”], true)

Examples:

// Disabling services

Parameters:

  • list (string)

    service ids

  • list (string)

    network interfaces

  • boolean

    new status of services

Returns:

  • (Boolean)

    if successfull

See Also:

  • #SetServicesForZones()


2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
# File '../../src/modules/SuSEFirewall.rb', line 2392

def SetServices(services_ids, interfaces, new_status)
  services_ids = deep_copy(services_ids)
  interfaces = deep_copy(interfaces)
  firewall_zones = GetZonesOfInterfacesWithAnyFeatureSupported(interfaces)
  if Builtins.size(firewall_zones) == 0
    Builtins.y2error(
      "Interfaces '%1' are not in any group if interfaces",
      interfaces
    )
    return false
  end

  SetModified()

  SetServicesForZones(services_ids, firewall_zones, new_status)
end

- (Object) SetServicesAcceptRelated(zone, ruleset)

Functions sets FW_SERVICES_ACCEPT_RELATED_*: Services to allow that are considered RELATED by the connection tracking engine, e.g., SLP browsing reply or Samba browsing reply.

SetServicesAcceptRelated (“EXT”, [“0/0,udp,427”, “0/0,udp,137”])

Parameters:

  • zone (String)
  • list (string)

    list of rules

See Also:

  • #GetServicesAcceptRelated()


3532
3533
3534
3535
3536
3537
3538
3539
3540
3541
3542
3543
3544
3545
3546
3547
3548
3549
3550
# File '../../src/modules/SuSEFirewall.rb', line 3532

def SetServicesAcceptRelated(zone, ruleset)
  ruleset = deep_copy(ruleset)
  if !IsKnownZone(zone)
    Builtins.y2error("Uknown zone '%1'", zone)
    return
  end

  ruleset = Builtins.filter(ruleset) { |one_rule| one_rule != nil }

  SetModified()

  Ops.set(
    @SETTINGS,
    Ops.add("FW_SERVICES_ACCEPT_RELATED_", zone),
    Builtins.mergestring(ruleset, "\n")
  )

  nil
end

- (Boolean) SetServicesForZones(services_ids, firewall_zones, new_status)

Function sets status for several services in several firewall zones.

SetServicesForZones ([“samba-server”, “service:irc-server”], [“DMZ”, “EXT”], false); SetServicesForZones ([“samba-server”, “service:irc-server”], [“EXT”, “DMZ”], true);

Parameters:

  • list (string)

    service ids

  • list (string)

    firewall zones (EXT|INT|DMZ…)

  • boolean

    new status of services

Returns:

  • (Boolean)

    if successfull

See Also:

  • #GetServicesInZones()
  • #GetServices()


2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
# File '../../src/modules/SuSEFirewall.rb', line 2337

def SetServicesForZones(services_ids, firewall_zones, new_status)
  services_ids = deep_copy(services_ids)
  firewall_zones = deep_copy(firewall_zones)
  # no groups == all groups
  if Builtins.size(firewall_zones) == 0
    firewall_zones = GetKnownFirewallZones()
  end

  # setting for each service
  Builtins.foreach(services_ids) do |service_id|
    Builtins.foreach(firewall_zones) do |firewall_zone|
      # zone must be known one
      if !IsKnownZone(firewall_zone)
        Builtins.y2error(
          "Zone '%1' is unknown firewall zone, skipping...",
          firewall_zone
        )
        next
      end
      SetModified()
      # setting new status
      if new_status == true
        Builtins.y2milestone(
          "Adding '%1' into '%2' zone",
          service_id,
          firewall_zone
        )
        AddServiceSupportIntoZone(service_id, firewall_zone)
      else
        Builtins.y2milestone(
          "Removing '%1' from '%2' zone",
          service_id,
          firewall_zone
        )
        RemoveServiceSupportFromZone(service_id, firewall_zone)
      end
    end
  end

  nil
end

- (Object) SetStartService(start_service)

Function which sets if SuSEfirewall should start in Write process.

Parameters:

  • start_service (Boolean)

    at Write() process

See Also:

  • #GetStartService()


1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
# File '../../src/modules/SuSEFirewall.rb', line 1280

def SetStartService(start_service)
  if !SuSEFirewallIsInstalled()
    Builtins.y2warning("Cannot set SetStartService")
    return nil
  end

  if GetStartService() != start_service
    SetModified()

    Builtins.y2milestone("Setting start-firewall to %1", start_service)
    Ops.set(@SETTINGS, "start_firewall", start_service)
  else
    # without set modified!
    Builtins.y2milestone(
      "start-firewall has been already set to %1",
      start_service
    )
    Ops.set(@SETTINGS, "start_firewall", start_service)
  end

  nil
end

- (Object) SetSupportRoute(set_route)

Function sets if firewall should support routing.

Parameters:

  • boolean

    set to support route or not



1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
# File '../../src/modules/SuSEFirewall.rb', line 1185

def SetSupportRoute(set_route)
  SetModified()

  if set_route
    Ops.set(@SETTINGS, "FW_ROUTE", "yes")
  else
    Ops.set(@SETTINGS, "FW_ROUTE", "no")
  end

  nil
end

- (Object) SetTrustIPsecAs(zone)

Function sets how firewall should trust successfully decrypted IPsec packets. It should be the zone name (shortname) or 'no' to trust packets the same as firewall trusts the zone from which IPsec packet came.

Parameters:

  • zone (String)

    or “no”



1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
# File '../../src/modules/SuSEFirewall.rb', line 1209

def SetTrustIPsecAs(zone)
  SetModified()

  # do not trust
  if zone == "no"
    Ops.set(@SETTINGS, "FW_IPSEC_TRUST", "no")
  else
    # trust IPsec is a known zone
    if IsKnownZone(zone)
      zone = GetZoneConfigurationString(zone)
      Ops.set(@SETTINGS, "FW_IPSEC_TRUST", zone) 
      # unknown zone, changing to default value
    else
      defaultv = GetDefaultValue("FW_IPSEC_TRUST")
      Builtins.y2warning(
        "Trust IPsec as '%1' (unknown zone) changed to '%2'",
        zone,
        defaultv
      )
      Ops.set(@SETTINGS, "FW_IPSEC_TRUST", defaultv)
    end
  end

  nil
end

- (Boolean) StartServices

Functions starts services needed for SuSEFirewall

Returns:

  • (Boolean)

    result



1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
# File '../../src/modules/SuSEFirewall.rb', line 1343

def StartServices
  return true if Mode.testsuite

  return false if !SuSEFirewallIsInstalled()

  if Service.Start(@firewall_service)
    Builtins.y2milestone("Started")
    return true
  else
    Builtins.y2error("Cannot start service %1", @firewall_service)
    return false
  end
end

- (Boolean) StopServices

Functions stops services needed for SuSEFirewall

Returns:

  • (Boolean)

    result



1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
# File '../../src/modules/SuSEFirewall.rb', line 1360

def StopServices
  return true if Mode.testsuite

  return false if !SuSEFirewallIsInstalled()

  if Service.Stop(@firewall_service)
    Builtins.y2milestone("Stopped")
    return true
  else
    Builtins.y2error("Could not stop service %1", @firewall_service)
    return false
  end
end

- (Boolean) SuSEFirewallIsInstalled

Returns whether all needed packages are installed (or selected for installation)

Returns:

  • (Boolean)

    whether SuSEfirewall2 is installed



1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
# File '../../src/modules/SuSEFirewall.rb', line 1109

def SuSEFirewallIsInstalled
  # Always recheck the status in inst-sys, user/solver might have change
  # the list of packages selected for installation
  # bnc#892935: in inst_finish, the package is already installed
  if Stage.initial
    @needed_packages_installed = Pkg.IsSelected(@FIREWALL_PACKAGE) || PackageSystem.Installed(@FIREWALL_PACKAGE)
    log.info "Selected for installation/installed -> #{@needed_packages_installed}"
  elsif @needed_packages_installed.nil?
    if Mode.normal
      @needed_packages_installed = PackageSystem.CheckAndInstallPackages([@FIREWALL_PACKAGE])
      log.info "CheckAndInstallPackages -> #{@needed_packages_installed}"
    else
      @needed_packages_installed = PackageSystem.Installed(@FIREWALL_PACKAGE)
      log.info "Installed -> #{@needed_packages_installed}"
    end
  end

  @needed_packages_installed
end

- (Boolean) Write

Function for writing and enabling configuration it is an union of WriteConfiguration() and ActivateConfiguration().

Returns:

  • (Boolean)

    if succesfull



2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
# File '../../src/modules/SuSEFirewall.rb', line 2744

def Write
  CheckKernelModules()

  # just disabled
  return true if !SuSEFirewallIsInstalled()

  return false if !WriteConfiguration()

  return false if !ActivateConfiguration()

  true
end

- (Boolean) WriteConfiguration

Function writes configuration into /etc/sysconfig/ and enables or disables firewall in /etc/init.d/ by the setting SetEnableService(boolean). This is a write-only configuration, firewall is never started only enabled or disabled.

Returns:

  • (Boolean)

    if successful



2646
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
# File '../../src/modules/SuSEFirewall.rb', line 2646

def WriteConfiguration
  # just disabled
  return true if !SuSEFirewallIsInstalled()

  # Progress only for normal configuration and command line
  have_progress = Mode.normal

  if have_progress
    # TRANSLATORS: Dialog caption
    write_caption = _("Writing Firewall Configuration")

    Progress.New(
      write_caption,
      " ",
      2,
      [
        # TRANSLATORS: Progress step
        _("Write firewall settings"),
        # TRANSLATORS: Progress step
        _("Adjust firewall service")
      ],
      [
        # TRANSLATORS: Progress step
        _("Writing firewall settings..."),
        # TRANSLATORS: Progress step
        _("Adjusting firewall service..."),
        # TRANSLATORS: Progress step
        Message.Finished
      ],
      ""
    )

    Progress.NextStage
  end

  # only modified configuration is written
  if GetModified()
    Builtins.y2milestone(
      "Firewall configuration has been changed. Writing: %1.",
      @SETTINGS
    )

    if !WriteSysconfigSuSEFirewall(GetListOfSuSEFirewallVariables())
      # TRANSLATORS: a popup error message
      Report.Error(_("Writing settings failed"))
      return false
    end
  else
    Builtins.y2milestone("Firewall settings weren't modified, skipping...")
  end

  Progress.NextStage if have_progress

  # Adjusting services
  if GetModified()
    # enabling firewall in /etc/init.d/
    if Ops.get_boolean(@SETTINGS, "enable_firewall", false)
      Builtins.y2milestone("Enabling firewall services")
      return false if !EnableServices() 
      # disabling firewall in /etc/init.d/
    else
      Builtins.y2milestone("Disabling firewall services")
      return false if !DisableServices()
    end
  else
    Builtins.y2milestone(
      "Firewall enable/disable wasn't modified, skipping..."
    )
  end

  Progress.NextStage if have_progress

  if @already_converted &&
      !FileUtils.Exists(@converted_to_services_dbp_file)
    Builtins.y2milestone(
      "Writing %1: %2",
      @converted_to_services_dbp_file,
      SCR.Write(path(".target.string"), @converted_to_services_dbp_file, "")
    )
  end

  Progress.Finish if have_progress

  true
end

- (Boolean) WriteOneRecordPerLine(key_name)

Returns whether records in variable should be written one record on one line.

Returns:

  • (Boolean)

    if wolpr



259
260
261
262
263
# File '../../src/modules/SuSEFirewall.rb', line 259

def WriteOneRecordPerLine(key_name)
  return true if key_name == nil && key_name == ""

  Builtins.contains(@one_line_per_record, key_name)
end

- (Boolean) WriteOnly

Helper function for the backward compatibility. See WriteConfiguration(). Remove from code ASAP.

Returns:

  • (Boolean)

    if succesful



2736
2737
2738
# File '../../src/modules/SuSEFirewall.rb', line 2736

def WriteOnly
  WriteConfiguration()
end

- (Boolean) WriteSysconfigSuSEFirewall(variables)

Local function for writing the list of internal variables into sysconfig. List of variables is list of keys in SETTINGS map, to sync configuration into the disk, use nil as the last list item.

Parameters:

  • list (string)

    of sysconfig variables

Returns:

  • (Boolean)

    if successful



418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
# File '../../src/modules/SuSEFirewall.rb', line 418

def WriteSysconfigSuSEFirewall(variables)
  variables = deep_copy(variables)
  write_status = true
  value = ""

  Builtins.foreach(variables) do |variable|
    # if variable is undefined, get default value
    value = Ops.get_string(@SETTINGS, variable) { GetDefaultValue(variable) }
    if WriteOneRecordPerLine(variable) == true
      value = Builtins.mergestring(Builtins.splitstring(value, " "), "\n")
    end
    write_status = SCR.Write(
      Builtins.add(path(".sysconfig.SuSEfirewall2"), variable),
      value
    )
    if !write_status
      Report.Error(
        Message.CannotWriteSettingsTo("/etc/sysconfig/SuSEFirewall2")
      )
      raise Break
    end
  end

  write_status = SCR.Write(path(".sysconfig.SuSEfirewall2"), nil)
  if !write_status
    Report.Error(
      Message.CannotWriteSettingsTo("/etc/sysconfig/SuSEFirewall2")
    )
  end

  write_status
end