--- loncom/configuration/Firewall.pm 2011/05/14 22:34:12 1.10 +++ loncom/configuration/Firewall.pm 2019/06/09 02:35:45 1.18 @@ -1,7 +1,7 @@ # The LearningOnline Network with CAPA # Firewall configuration to allow internal LON-CAPA communication between servers # -# $Id: Firewall.pm,v 1.10 2011/05/14 22:34:12 raeburn Exp $ +# $Id: Firewall.pm,v 1.18 2019/06/09 02:35:45 raeburn Exp $ # # The LearningOnline Network with CAPA # @@ -35,22 +35,69 @@ package LONCAPA::Firewall; use strict; use lib '/home/httpd/perl/lib'; use LONCAPA::Configuration; +use LONCAPA; + +sub uses_firewalld { + my ($distro) = @_; + if ($distro eq '') { + $distro = &get_distro(); + } + my ($inuse,$checkfirewalld); + if ($distro =~ /^(suse|sles)([\d\.]+)$/) { + if (($1 eq 'sles') && ($2 >= 15)) { + $checkfirewalld = 1; + } + } elsif ($distro =~ /^fedora(\d+)$/) { + if ($1 >= 18) { + $checkfirewalld = 1; + } + } elsif ($distro =~ /^(?:centos|rhes|scientific)(\d+)/) { + if ($1 >= 7) { + $checkfirewalld = 1; + } + } + if ($checkfirewalld) { + my ($loaded,$active); + if (open(PIPE,"systemctl status firewalld 2>&1 |")) { + while () { + chomp(); + if (/^\s*Loaded:\s+(\w+)/) { + $loaded = $1; + } + if (/^\s*Active\s+(\w+)/) { + $active = $1; + } + } + close(PIPE); + } + if (($loaded eq 'loaded') || ($active eq 'active')) { + $inuse = 1; + } + } + return $inuse; +} sub firewall_open_port { - my ($iptables,$fw_chains,$lond_port,$iphost,$ports) = @_; + my ($iptables,$fw_chains,$lond_port,$iphost,$ports,$firewalld) = @_; return 'inactive firewall' if (!&firewall_is_active()); return 'port number unknown' if !$lond_port; return 'invalid firewall chain' unless (ref($fw_chains) eq 'ARRAY'); - my (@opened,@chains,@badchains,@okchains); - foreach my $chain (@{$fw_chains}) { - if ($chain =~ /^([\w\-]+)$/) { - push(@okchains,$1); - } else { - push(@badchains,$chain); + my (@opened,@okchains,$zone); + if ($firewalld) { + $zone = &get_default_zone(); + return 'invalid zone' if ($zone eq ''); + } else { + my @badchains; + foreach my $chain (@{$fw_chains}) { + if ($chain =~ /^([\w\-]+)$/) { + push(@okchains,$1); + } else { + push(@badchains,$chain); + } + } + if (!@okchains) { + return 'None of the chain names has the expected format.'."\n"; } - } - if (!@okchains) { - return 'None of the chain names has the expected format'."\n"; } if (ref($ports) ne 'ARRAY') { return 'List of ports to open needed.'; @@ -60,7 +107,7 @@ sub firewall_open_port { if ($portnum =~ /^(\d+)$/) { $port = $1; } else { - print "Skipped non-numeric port: $portnum\n"; + print "Skipped non-numeric port: $portnum.\n"; next; } print "Opening firewall access on port $port.\n"; @@ -73,9 +120,17 @@ sub firewall_open_port { if (ref($iphost) eq 'HASH') { if (keys(%{$iphost}) > 0) { my %curropen; - foreach my $fw_chain (@okchains) { - &firewall_close_anywhere($iptables,$fw_chain,$port); - my $current = &firewall_is_port_open($iptables,$fw_chain,$port,$lond_port,$iphost,\%curropen); + if ($firewalld) { + &firewall_close_anywhere($iptables,$zone,$port,$firewalld); + my $current = &firewall_is_port_open($iptables,$zone,$port, + $lond_port,$iphost,\%curropen, + $firewalld); + } else { + foreach my $fw_chain (@okchains) { + &firewall_close_anywhere($iptables,$fw_chain,$port); + my $current = &firewall_is_port_open($iptables,$fw_chain,$port, + $lond_port,$iphost,\%curropen); + } } foreach my $key (keys(%{$iphost})) { my $ip = ''; @@ -83,45 +138,65 @@ sub firewall_open_port { if (($1<=255) && ($2<=255) && ($3<=255) && ($4<=255)) { $ip = "$1.$2.$3.$4"; } else { + print "IP address: $key does not have expected format.\n"; next; } } else { + print "IP address: $key does not have expected format.\n"; next; } if ($curropen{$ip}) { push(@lond_port_curropen,$ip); } else { - foreach my $fw_chain (@okchains) { - my $firewall_command = - "$iptables -I $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT"; - system($firewall_command); - my $return_status = $?>>8; - if ($return_status == 1) { - unless(grep(/^\Q$ip\E$/,@port_error)) { - push (@port_error,$ip); + if ($firewalld) { + my $cmd = 'firewall-cmd --zone='.$zone.' --add-rich-rule \'rule family="ipv4" source address="'.$ip.'/32" port port="'.$port.'" protocol="tcp" accept\''; + if (open(PIPE,"$cmd |")) { + my $result = ; + chomp($result); + close(PIPE); + if ($result eq 'success') { + push(@lond_port_open,$ip); + } else { + push(@port_error,$ip); + } + } + } else { + foreach my $fw_chain (@okchains) { + my $firewall_command = + "$iptables -I $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT"; + system($firewall_command); + my $return_status = $?>>8; + if ($return_status == 1) { + unless(grep(/^\Q$ip\E$/,@port_error)) { + push(@port_error,$ip); + } + } elsif ($return_status == 2) { + push(@{$command_error{$fw_chain}},$ip); + } elsif ($return_status == 0) { + push(@lond_port_open,$ip); + last; } - } elsif ($return_status == 2) { - push(@{$command_error{$fw_chain}},$ip); - } elsif ($return_status == 0) { - push(@lond_port_open,$ip); - last; } } } } + } else { + print "no key found in $iphost hash ref\n"; } + } else { + print "$iphost is not a reference to a hash\n"; } if (@lond_port_curropen) { unless (grep(/^\Q$port\E$/,@opened)) { push(@opened,$port); } - print "Port already open for ".scalar(@lond_port_curropen)." IP addresses\n"; + print "Port already open for ".scalar(@lond_port_curropen)." IP addresses.\n"; } if (@lond_port_open) { unless (grep(/^\Q$port\E$/,@opened)) { push(@opened,$port); } - print "Port opened for ".scalar(@lond_port_open)." IP addresses\n"; + print "Port opened for ".scalar(@lond_port_open)." IP addresses.\n"; } if (@port_error) { print "Error opening port for following IP addresses: ".join(', ',@port_error)."\n"; @@ -138,30 +213,50 @@ sub firewall_open_port { } } } else { - my (@port_errors,%command_errors); - foreach my $fw_chain (@okchains) { - my $firewall_command = - "$iptables -I $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT"; - system($firewall_command); - my $return_status = $?>>8; - if ($return_status == 1) { - push(@port_errors,$fw_chain); - } elsif ($return_status == 2) { - $command_errors{$fw_chain} = $firewall_command; - } elsif ($return_status == 0) { - push(@opened,$port); - last; + if ($firewalld) { + my ($port_error); + my $cmd = 'firewall-cmd --zone='.$zone.' --add-rich-rule \'rule family="ipv4" port port="'.$port.'" protocol="tcp" accept\''; + if (open(PIPE,"$cmd |")) { + my $result = ; + chomp($result); + close(PIPE); + if ($result eq 'success') { + push(@opened,$port); + } else { + $port_error = $port; + } + } else { + $port_error = $port; } - } - unless (grep(/^\Q$port\E$/,@opened)) { - if (@port_errors) { - print "Error opening port for chains: ". - join(', ',@port_errors).".\n"; - } - if (keys(%command_errors)) { - foreach my $fw_chain (sort(keys(%command_errors))) { - print "Bad command error opening port for chain: $fw_chain. Command was\n". - " ".$command_errors{$fw_chain}."\n"; + if ($port_error) { + print "Error opening port: $port\n"; + } + } else { + my (@port_errors,%command_errors); + foreach my $fw_chain (@okchains) { + my $firewall_command = + "$iptables -I $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT"; + system($firewall_command); + my $return_status = $?>>8; + if ($return_status == 1) { + push(@port_errors,$fw_chain); + } elsif ($return_status == 2) { + $command_errors{$fw_chain} = $firewall_command; + } elsif ($return_status == 0) { + push(@opened,$port); + last; + } + } + unless (grep(/^\Q$port\E$/,@opened)) { + if (@port_errors) { + print "Error opening port for chains: ". + join(', ',@port_errors).".\n"; + } + if (keys(%command_errors)) { + foreach my $fw_chain (sort(keys(%command_errors))) { + print "Bad command error opening port for chain: $fw_chain. Command was\n". + " ".$command_errors{$fw_chain}."\n"; + } } } } @@ -176,14 +271,48 @@ sub firewall_open_port { } sub firewall_is_port_open { - my ($iptables,$fw_chain,$port,$lond_port,$iphost,$curropen) = @_; + my ($iptables,$fw_chain,$port,$lond_port,$iphost,$curropen,$firewalld) = @_; # for lond port returns number of source IPs for which firewall port is open # for other ports returns 1 if the firewall port is open, 0 if not. - # - # check if firewall is active or installed - return if (! &firewall_is_active()); + # if firewalld is in use, checks for rich rules only. my $count = 0; + return $count if (! &firewall_is_active()); + if ($firewalld) { + my $zone = &get_default_zone(); + return $count if ($zone eq ''); + if ($port eq $lond_port) { + if (open(PIPE,"firewall-cmd --zone=$zone --list-rich-rules |")) { + while() { + chomp(); + if (/\Qrule family="ipv4" source address="\E([\d.]+)\Q\/32" port port="$port" protocol="tcp" accept\E/) { + my $ip = $1; + if ($iphost->{$ip}) { + $count ++; + if (ref($curropen) eq 'HASH') { + $curropen->{$ip} ++; + } + } + } + } + close(PIPE); + } + } else { + if (open(PIPE,"firewall-cmd --zone=$zone --list-rich-rules |")) { + while() { + if (/\Qrule family="ipv4" port port="$port" protocol="tcp" accept\E/) { + $count ++; + last; + } + } + close(PIPE); + } + } + return $count; + } + return $count unless ($fw_chain !~ /^[\w-]+$/); if (open(PIPE,"$iptables -L $fw_chain -n |")) { + # check if firewall is active or installed + return if (! &firewall_is_active()); while() { if ($port eq $lond_port) { if (ref($iphost) eq 'HASH') { @@ -197,11 +326,9 @@ sub firewall_is_port_open { } } } - } else { - if (/tcp dpt\:\Q$port\E/) { - $count ++; - last; - } + } elsif (/tcp dpt\:\Q$port\E/) { + $count ++; + last; } } close(PIPE); @@ -210,28 +337,46 @@ sub firewall_is_port_open { } sub firewall_is_active { + my $status = 0; if (-e '/proc/net/ip_tables_names') { - return 1; - } else { - return 0; + if (open(PIPE,'cat /proc/net/ip_tables_names |')) { + while() { + chomp(); + if (/^filter$/) { + $status = 1; + last; + } + } + close(PIPE); + } + } + unless ($status) { + $status = &uses_firewalld(); } + return $status; } sub firewall_close_port { - my ($iptables,$fw_chains,$lond_port,$iphost,$ports) = @_; + my ($iptables,$fw_chains,$lond_port,$iphost,$ports,$firewalld) = @_; return 'inactive firewall' if (!&firewall_is_active()); return 'port number unknown' if !$lond_port; return 'invalid firewall chain' unless (ref($fw_chains) eq 'ARRAY'); - my (@opened,@chains,@badchains,@okchains); - foreach my $chain (@{$fw_chains}) { - if ($chain =~ /^([\w\-]+)$/) { - push(@okchains,$1); - } else { - push(@badchains,$chain); + my (@okchains,$zone); + if ($firewalld) { + $zone = &get_default_zone(); + return 'no default zone' if ($zone eq ''); + } else { + my @badchains; + foreach my $chain (@{$fw_chains}) { + if ($chain =~ /^([\w\-]+)$/) { + push(@okchains,$1); + } else { + push(@badchains,$chain); + } + } + if (!@okchains) { + return 'None of the chain names has the expected format.'."\n"; } - } - if (!@okchains) { - return 'None of the chain names has the expected format'."\n"; } if (ref($ports) ne 'ARRAY') { return 'List of ports to close needed.'; @@ -244,21 +389,20 @@ sub firewall_close_port { print "Skipped non-numeric port: $portnum\n"; next; } - print "Closing firewall access on port $port\n"; + print "Closing firewall access on port $port.\n"; if (($port ne '') && ($port eq $lond_port)) { - foreach my $fw_chain (@okchains) { - my (@port_error,@command_error,@lond_port_close); - my %to_close; - if (open(PIPE, "$iptables -n -L $fw_chain |")) { - while () { - chomp(); - next unless (/dpt:\Q$port\E\s*$/); - if (/^ACCEPT\s+tcp\s+\-{2}\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+/) { + my $output; + if ($firewalld) { + my (%to_close,@port_error,@lond_port_close); + my $cmd = 'firewall-cmd --list-rich-rules'; + if (open(PIPE,"$cmd |")) { + while() { + if (/\Qrule family="ipv4" source address="\E([\d.]+)\Q\/32" port port="$port" protocol="tcp" accept\E/) { my $ip = $1; my $keepopen = 0; if (ref($iphost) eq 'HASH') { if (exists($iphost->{$ip})) { - $keepopen = 1; + $keepopen = 1; } } unless ($keepopen) { @@ -269,58 +413,137 @@ sub firewall_close_port { close(PIPE); } if (keys(%to_close) > 0) { - foreach my $ip (keys(%to_close)) { - my $firewall_command = - "$iptables -D $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT"; - system($firewall_command); - my $return_status = $?>>8; - if ($return_status == 1) { - push (@port_error,$ip); - } elsif ($return_status == 2) { - push(@command_error,$ip); - } elsif ($return_status == 0) { - push(@lond_port_close,$ip); + foreach my $ip (sort(keys(%to_close))) { + my $cmd = 'firewall-cmd --zone='.$zone.' --remove-rich-rule \'rule family="ipv4" source address="'.$ip.'/32" port port="'.$port.'" protocol="tcp" accept\''; + if (open(PIPE,"$cmd |")) { + my $result = ; + chomp($result); + close(PIPE); + if ($result eq 'success') { + push(@lond_port_close,$ip); + } else { + push(@port_error,$ip); + } + } else { + push(@port_error,$ip); } } } if (@lond_port_close) { - print "Port closed for ".scalar(@lond_port_close)." IP addresses\n"; + $output .= "Port closed for ".scalar(@lond_port_close)." IP addresses.\n"; } if (@port_error) { - print "Error closing port for following IP addresses: ".join(', ',@port_error)."\n"; + $output .= "Error closing port for following IP addresses: ".join(', ',@port_error)."\n"; } - if (@command_error) { - print "Bad command error opening port for following IP addresses: ". - join(', ',@command_error)."\n". - 'Command was: "'."$iptables -D $fw_chain -p tcp -s ".'$ip'." -d 0/0 --dport $port -j ACCEPT".'", where $ip is IP address'."\n"; + } else { + foreach my $fw_chain (@okchains) { + my (%to_close,@port_error,@command_error,@lond_port_close); + if (open(PIPE, "$iptables -n -L $fw_chain |")) { + while () { + chomp(); + next unless (/dpt:\Q$port\E/); + if (/^ACCEPT\s+tcp\s+\-{2}\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+/) { + my $ip = $1; + my $keepopen = 0; + if (ref($iphost) eq 'HASH') { + if (exists($iphost->{$ip})) { + $keepopen = 1; + } + } + unless ($keepopen) { + $to_close{$ip} = $port; + } + } + } + close(PIPE); + } + if (keys(%to_close) > 0) { + foreach my $ip (keys(%to_close)) { + my $firewall_command = + "$iptables -D $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT"; + system($firewall_command); + my $return_status = $?>>8; + if ($return_status == 1) { + push(@port_error,$ip); + } elsif ($return_status == 2) { + push(@command_error,$ip); + } elsif ($return_status == 0) { + push(@lond_port_close,$ip); + } + } + } + if (@lond_port_close) { + $output .= "Port closed for ".scalar(@lond_port_close)." IP addresses.\n"; + } + if (@port_error) { + $output .= "Error closing port for following IP addresses: ".join(', ',@port_error)."\n"; + } + if (@command_error) { + $output .= "Bad command error opening port for following IP addresses: ". + join(', ',@command_error)."\n". + 'Command was: "'."$iptables -D $fw_chain -p tcp -s ".'$ip'." -d 0/0 --dport $port -j ACCEPT".'", where $ip is IP address'."\n"; + } } } + if ($output) { + print $output; + } else { + print "No IP addresses required discontinuation of access.\n"; + } } else { - foreach my $fw_chain (@okchains) { - my (@port_error,@command_error,@lond_port_close); + if ($firewalld) { my $to_close; - if (open(PIPE, "$iptables -n -L $fw_chain |")) { - while () { - chomp(); - next unless (/dpt:\Q$port\E\s*$/); + if (open(PIPE,"firewall-cmd --list-rich-rules |")) { + while() { + next unless (/\Qrule family="ipv4" port port="$port" protocol="tcp" accept\E/); $to_close = 1; + last; } close(PIPE); } if ($to_close) { - my $firewall_command = - "$iptables -D $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT"; - system($firewall_command); - my $return_status = $?>>8; - if ($return_status == 1) { - # Error - print "Error closing port for chain: $fw_chain.\n"; - } elsif ($return_status == 2) { - # Bad command - print "Bad command error closing port. Command was\n". - " ".$firewall_command."\n"; + my $cmd = 'firewall-cmd --zone='.$zone.' --remove-rich-rule \'rule family="ipv4" port port="'.$port.'" protocol="tcp" accept\''; + if (open(PIPE,"$cmd|")) { + my $result = ; + chomp($result); + close(PIPE); + if ($result eq 'success') { + print "Port: $port closed in zone: $zone.\n"; + } else { + print "Error closing port: $port in zone: $zone.\n"; + } } else { - print "Port closed for chain $fw_chain.\n"; + print "Error closing port: $port in zone: $zone.\n"; + } + } + } else { + foreach my $fw_chain (@okchains) { + my (@port_error,@command_error,@lond_port_close); + my $to_close; + if (open(PIPE, "$iptables -n -L $fw_chain |")) { + while () { + chomp(); + next unless (/dpt:\Q$port\E/); + $to_close = 1; + last; + } + close(PIPE); + } + if ($to_close) { + my $firewall_command = + "$iptables -D $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT"; + system($firewall_command); + my $return_status = $?>>8; + if ($return_status == 1) { + # Error + print "Error closing port: $port for chain: $fw_chain.\n"; + } elsif ($return_status == 2) { + # Bad command + print "Bad command error closing port. Command was\n". + " ".$firewall_command."\n"; + } else { + print "Port closed for chain $fw_chain.\n"; + } } } } @@ -330,8 +553,47 @@ sub firewall_close_port { } sub firewall_close_anywhere { - my ($iptables,$fw_chain,$port) = @_; - if (open(PIPE, "$iptables --line-numbers -n -L $fw_chain |")) { + my ($iptables,$fw_chain,$port,$firewalld) = @_; + my $zone; + if ($firewalld) { + $zone = &get_default_zone(); + if ($zone eq '') { + print 'no default zone'; + return; + } + } else { + unless ($fw_chain =~ /^([\w\-]+)$/) { + print 'invalid chain'; + return; + } + } + if ($firewalld) { + my $to_close; + my $cmd = 'firewall-cmd --list-ports'; + if (open(PIPE,"$cmd |")) { + my $currports = ; + close(PIPE); + chomp($currports); + if (grep(/^\Q$port\E\/tcp/,split(/\s+/,$currports))) { + $to_close = 1; + } + } + if ($to_close) { + my $cmd = 'firewall-cmd --zone='.$zone.' --remove-port='.$port.'/tcp'; + if (open(PIPE,"$cmd |")) { + my $result = ; + chomp($result); + close(PIPE); + if ($result eq 'success') { + print 'Port '.$port.' closed for source "anywhere"'."\n"; + } else { + print 'Error closing port '.$port.' for source "anywhere".'."\n"; + } + } else { + print 'Error closing port '.$port.' for source "anywhere".'."\n"; + } + } + } elsif (open(PIPE, "$iptables --line-numbers -n -L $fw_chain |")) { while () { next unless (/dpt:\Q$port\E/); chomp(); @@ -340,7 +602,7 @@ sub firewall_close_anywhere { system($firewall_command); my $return_status = $?>>8; if ($return_status == 1) { - print 'Error closing port '.$port.' for source "anywhere"'."\n"; + print 'Error closing port '.$port.' for source "anywhere".'."\n"; } elsif ($return_status == 2) { print 'Bad command error closing port '.$port.' for source "anywhere". Command was'."\n". ' '.$firewall_command."\n"; @@ -368,16 +630,28 @@ sub get_lond_port { } sub get_fw_chains { - my ($iptables) = @_; - my $distro; - if (open(PIPE,"/home/httpd/perl/distprobe|")) { - $distro = ; - close(PIPE); + my ($iptables,$distro) = @_; + if ($distro eq '') { + $distro = &get_distro(); } my @fw_chains; my $suse_config = "/etc/sysconfig/SuSEfirewall2"; my $ubuntu_config = "/etc/ufw/ufw.conf"; - if (-e $suse_config) { + my $firewalld = &uses_firewalld($distro); + if ($firewalld) { + my ($dist,$version) = ($distro =~ /^([\D]+)(\d+)$/); + if ((($dist eq 'rhes') || ($dist eq 'centos')) && + ($version >= 8)) { + push(@fw_chains,'INPUT'); + } else { + my $zone = &get_default_zone(); + if ($zone ne '') { + push(@fw_chains,'IN_'.$zone.'_allow'); + } else { + push(@fw_chains,'IN_public_allow'); + } + } + } elsif (-e $suse_config) { push(@fw_chains,'input_ext'); } else { my @posschains; @@ -386,17 +660,23 @@ sub get_fw_chains { } else { if ($distro =~ /^(debian|ubuntu|suse|sles)/) { @posschains = ('INPUT'); - } else { - @posschains = ('RH-Firewall-1-INPUT','INPUT'); + } elsif ($distro =~ /^(fedora|rhes|centos|scientific)(\d+)$/) { + if ((($1 eq 'fedora') && ($2 > 15)) || (($1 ne 'fedora') && ($2 >= 7))) { + @posschains = ('INPUT'); + } else { + @posschains = ('RH-Firewall-1-INPUT','INPUT'); + } } if (!-e '/etc/sysconfig/iptables') { if (!-e '/var/lib/iptables') { unless ($distro =~ /^(debian|ubuntu)/) { - print("Unable to find iptables file containing static definitions\n"); + print("Unable to find iptables file containing static definitions.\n"); } } - if ($distro =~ /^(fedora|rhes|centos|scientific)/) { - push(@fw_chains,'RH-Firewall-1-INPUT'); + if ($distro =~ /^(fedora|rhes|centos|scientific)(\d+)$/) { + unless ((($1 eq 'fedora') && ($2 > 15)) || (($1 ne 'fedora') && ($2 >= 7))) { + push(@fw_chains,'RH-Firewall-1-INPUT'); + } } } } @@ -425,6 +705,18 @@ sub get_fw_chains { return @fw_chains; } +sub get_default_zone { + my $cmd = 'firewall-cmd --get-default-zone'; + my $zone; + if (open(PIPE,"$cmd |")) { + my $result = ; + chomp($result); + close(PIPE); + ($zone) = ($result =~ /^(\w+)$/); + } + return $zone; +} + sub get_pathto_iptables { my $iptables; if (-e '/sbin/iptables') { @@ -432,11 +724,20 @@ sub get_pathto_iptables { } elsif (-e '/usr/sbin/iptables') { $iptables = '/usr/sbin/iptables'; } else { - print("Unable to find iptables command\n"); + print("Unable to find iptables command.\n"); } return $iptables; } +sub get_distro { + my $distro; + if (open(PIPE,"/home/httpd/perl/distprobe |")) { + $distro = ; + close(PIPE); + } + return $distro; +} + 1; __END__ @@ -451,6 +752,7 @@ B - dynamic opening/c use lib '/home/httpd/lib/perl/'; use LONCAPA::Firewall; + LONCAPA::Firewall::uses_firewalld(); LONCAPA::Firewall::firewall_open_port(); LONCAPA::Firewall::firewall_close_port(); LONCAPA::Firewall::firewall_is_port_open(); @@ -470,19 +772,25 @@ The following methods are available: =over 4 -=item LONCAPA::Firewall::firewall_open_port( $iptables,$fw_chains,$lond_port,$iphost,$port ); +=item LONCAPA::Firewall::uses_firewalld( $distro ); + +=back + +=over 4 + +=item LONCAPA::Firewall::firewall_open_port( $iptables,$fw_chains,$lond_port,$iphost,$ports,$firewalld ); =back =over 4 -=item LONCAPA::Firewall::firewall_close_port( $iptables,$fw_chains,$lond_port,$iphost,$ports ); +=item LONCAPA::Firewall::firewall_close_port( $iptables,$fw_chains,$lond_port,$iphost,$ports,$firewalld ); =back =over 4 -=item LONCAPA::Firewall::firewall_is_port_open( $iptables,$fw_chain,$port,$lond_port,$iphost,$curropen ); +=item LONCAPA::Firewall::firewall_is_port_open( $iptables,$fw_chain,$port,$lond_port,$iphost,$curropen,$firewalld ); =back @@ -494,7 +802,7 @@ The following methods are available: =over 4 -=item LONCAPA::Firewall::firewall_close_anywhere( $iptables,$fw_chain,$port ); +=item LONCAPA::Firewall::firewall_close_anywhere( $iptables,$fw_chain,$port,$firewalld ); =back @@ -506,7 +814,7 @@ The following methods are available: =over 4 -=item LONCAPA::Firewall::get_fw_chains(); +=item LONCAPA::Firewall::get_fw_chains( $iptables,$distro ); =back @@ -514,6 +822,13 @@ The following methods are available: =item LONCAPA::Firewall::get_pathto_iptables(); +=back + +=over 4 + +=item LONCAPA::Firewall::get_distro(); + +=back =head1 AUTHORS