Skip to content

Commit b835475

Browse files
BengangYBengangY
committed
CP-308800: Add firewalld control function
Signed-off-by: Bengang Yuan <[email protected]>
1 parent 1fbdaae commit b835475

File tree

3 files changed

+194
-10
lines changed

3 files changed

+194
-10
lines changed

‎ocaml/xapi/firewall.ml

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
(*
2+
* Copyright (c) Cloud Software Group, Inc.
3+
*
4+
* This program is free software; you can redistribute it and/or modify
5+
* it under the terms of the GNU Lesser General Public License as published
6+
* by the Free Software Foundation; version 2.1 only. with the special
7+
* exception on linking described in file LICENSE.
8+
*
9+
* This program is distributed in the hope that it will be useful,
10+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
11+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12+
* GNU Lesser General Public License for more details.
13+
*)
14+
15+
module D = Debug.Make (struct let name = "firewall" end)
16+
17+
open D
18+
19+
type firewall_status = Enabled | Disabled
20+
21+
type firewall_service =
22+
| Dlm
23+
| Nbd
24+
| Nrpe
25+
| Snmp
26+
| Ssh
27+
| Vxlan
28+
| Xapi_insecure
29+
| Xenha
30+
31+
let service_type_to_string = function
32+
| Dlm ->
33+
"dlm"
34+
| Nbd ->
35+
"nbd"
36+
| Nrpe ->
37+
"nrpe"
38+
| Snmp ->
39+
"snmp"
40+
| Ssh ->
41+
"ssh"
42+
| Vxlan ->
43+
"vxlan"
44+
| Xapi_insecure ->
45+
"xapi-insecure"
46+
| Xenha ->
47+
"xenha"
48+
49+
module type FIREWALL = sig
50+
val update_firewall_status :
51+
service:firewall_service -> status:firewall_status -> unit
52+
53+
val is_firewall_service_enabled : service:firewall_service -> bool
54+
end
55+
56+
module Firewalld : FIREWALL = struct
57+
let update_firewall_status ~service ~status =
58+
if !Xapi_globs.dynamic_control_firewalld_service then
59+
try
60+
let service_option =
61+
match status with
62+
| Enabled ->
63+
"--add-service"
64+
| Disabled ->
65+
"--remove-service"
66+
in
67+
Helpers.call_script !Xapi_globs.firewall_cmd
68+
[service_option; service_type_to_string service]
69+
|> ignore
70+
with e ->
71+
error "Failed to update firewall service status: %s"
72+
(Printexc.to_string e)
73+
74+
let is_firewall_service_enabled ~service =
75+
try
76+
let output =
77+
Helpers.call_script !Xapi_globs.firewall_cmd
78+
["--query-service"; service_type_to_string service]
79+
|> String.trim
80+
|> String.lowercase_ascii
81+
in
82+
let status = Scanf.sscanf output "%s" Fun.id in
83+
match status with "yes" -> true | _ -> false
84+
with e ->
85+
error "Failed to check firewall service status: %s" (Printexc.to_string e) ;
86+
false
87+
end
88+
89+
module Iptables : FIREWALL = struct
90+
let service_type_to_port_and_protocol = function
91+
| Xapi_insecure ->
92+
("80", "TCP")
93+
| _ ->
94+
failwith
95+
"service_type_to_port_and_protocol: Unsupported service type for \
96+
iptables"
97+
98+
let update_firewall_status ~service ~status =
99+
let op = match status with Enabled -> "open" | Disabled -> "close" in
100+
let port, protocol = service_type_to_port_and_protocol service in
101+
ignore
102+
@@ Helpers.call_script
103+
!Xapi_globs.firewall_port_config_script
104+
[op; port; protocol]
105+
106+
let is_firewall_service_enabled ~service =
107+
let port, protocol = service_type_to_port_and_protocol service in
108+
let script_output =
109+
Helpers.call_script
110+
!Xapi_globs.firewall_port_config_script
111+
["check"; port; protocol]
112+
in
113+
try Scanf.sscanf script_output "Port 80 open: %B" Fun.id
114+
with _ ->
115+
Helpers.internal_error
116+
"unexpected output from /etc/xapi.d/plugins/firewall-port: %s"
117+
script_output
118+
end
119+
120+
let firewall_provider (backend : string) : (module FIREWALL) =
121+
match backend with
122+
| "firewalld" ->
123+
(module Firewalld)
124+
| "iptables" ->
125+
(module Iptables)
126+
| _ ->
127+
Helpers.internal_error "unknown firewall backend: %s" backend

‎ocaml/xapi/firewall.mli

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
(*
2+
* Copyright (c) Cloud Software Group, Inc.
3+
*
4+
* This program is free software; you can redistribute it and/or modify
5+
* it under the terms of the GNU Lesser General Public License as published
6+
* by the Free Software Foundation; version 2.1 only. with the special
7+
* exception on linking described in file LICENSE.
8+
*
9+
* This program is distributed in the hope that it will be useful,
10+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
11+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12+
* GNU Lesser General Public License for more details.
13+
*)
14+
15+
type firewall_status = Enabled | Disabled
16+
17+
type firewall_service =
18+
| Dlm
19+
| Nbd
20+
| Nrpe
21+
| Snmp
22+
| Ssh
23+
| Vxlan
24+
| Xapi_insecure
25+
| Xenha
26+
27+
module type FIREWALL = sig
28+
val update_firewall_status :
29+
service:firewall_service -> status:firewall_status -> unit
30+
31+
val is_firewall_service_enabled : service:firewall_service -> bool
32+
end
33+
34+
module Firewalld : FIREWALL
35+
36+
module Iptables : FIREWALL
37+
38+
val firewall_provider : string -> (module FIREWALL)

‎ocaml/xapi/xapi_globs.ml

Lines changed: 29 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -861,6 +861,10 @@ let nbd_firewall_config_script =
861861

862862
let firewall_port_config_script = ref "/etc/xapi.d/plugins/firewall-port"
863863

864+
let firewall_cmd = ref "/usr/bin/firewall-cmd"
865+
866+
let firewall_cmd_wrapper = ref "/usr/bin/firewall-cmd-wrapper"
867+
864868
let nbd_client_manager_script =
865869
ref "/opt/xensource/libexec/nbd_client_manager.py"
866870

@@ -1317,6 +1321,12 @@ let ssh_monitor_service = ref "xapi-ssh-monitor"
13171321

13181322
let ssh_auto_mode_default = ref true
13191323

1324+
(* Firewall backend to use. iptables in XS 8, firewalld in XS 9. *)
1325+
let firewall_backend = ref "firewalld"
1326+
1327+
(* For firewalld, if dynamic control firewalld service. *)
1328+
let dynamic_control_firewalld_service = ref true
1329+
13201330
(* Fingerprint of default patch key *)
13211331
let citrix_patch_key =
13221332
"NERDNTUzMDMwRUMwNDFFNDI4N0M4OEVCRUFEMzlGOTJEOEE5REUyNg=="
@@ -1762,12 +1772,6 @@ let other_options =
17621772
, (fun () -> string_of_bool !validate_reusable_pool_session)
17631773
, "Enable validation of reusable pool sessions before use"
17641774
)
1765-
; ( "ssh-auto-mode"
1766-
, Arg.Bool (fun b -> ssh_auto_mode_default := b)
1767-
, (fun () -> string_of_bool !ssh_auto_mode_default)
1768-
, "Defaults to true; overridden to false via \
1769-
/etc/xapi.conf.d/ssh-auto-mode.conf(e.g., in XenServer 8)"
1770-
)
17711775
; ( "vm-sysprep-enabled"
17721776
, Arg.Set vm_sysprep_enabled
17731777
, (fun () -> string_of_bool !vm_sysprep_enabled)
@@ -1778,6 +1782,17 @@ let other_options =
17781782
, (fun () -> string_of_float !vm_sysprep_wait)
17791783
, "Time in seconds to wait for VM to recognise inserted CD"
17801784
)
1785+
; ( "firewall-backend"
1786+
, Arg.Set_string firewall_backend
1787+
, (fun () -> !firewall_backend)
1788+
, "Firewall backend. iptables (in XS 8) or firewalld (in XS 9 or later XS \
1789+
version)"
1790+
)
1791+
; ( "dynamic-control-firewalld-service"
1792+
, Arg.Bool (fun b -> dynamic_control_firewalld_service := b)
1793+
, (fun () -> string_of_bool !dynamic_control_firewalld_service)
1794+
, "Enable dynamic control firewalld service"
1795+
)
17811796
]
17821797

17831798
(* The options can be set with the variable xapiflags in /etc/sysconfig/xapi.
@@ -1912,10 +1927,14 @@ module Resources = struct
19121927
, "Executed after NBD-related networking changes to configure the \
19131928
firewall for NBD"
19141929
)
1915-
; ( "firewall-port-config"
1916-
, firewall_port_config_script
1917-
, "Executed when starting/stopping xapi-clusterd to configure firewall \
1918-
port"
1930+
; ( "firewall-cmd"
1931+
, firewall_cmd
1932+
, "Executed when enable/disable a service on a firewalld zone"
1933+
)
1934+
; ( "firewall-cmd-wrapper"
1935+
, firewall_cmd_wrapper
1936+
, "Executed when enable/disable a service on a firewalld zone and \
1937+
interface"
19191938
)
19201939
; ( "nbd_client_manager"
19211940
, nbd_client_manager_script

0 commit comments

Comments
 (0)