--- loncom/configuration/Firewall.pm	2010/03/25 01:47:45	1.6
+++ loncom/configuration/Firewall.pm	2018/10/24 02:08:04	1.15
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Firewall configuration to allow internal LON-CAPA communication between servers   
 #
-# $Id: Firewall.pm,v 1.6 2010/03/25 01:47:45 raeburn Exp $
+# $Id: Firewall.pm,v 1.15 2018/10/24 02:08:04 raeburn Exp $
 #
 # The LearningOnline Network with CAPA
 #
@@ -35,6 +35,47 @@ package LONCAPA::Firewall;
 use strict;
 use lib '/home/httpd/perl/lib';
 use LONCAPA::Configuration;
+use LONCAPA;
+
+sub uses_firewalld {
+    my ($distro) = @_;
+    if ($distro eq '') {
+        $distro = &get_distro();
+    }
+    my ($inuse, $checkfirewalld);
+    if ($distro =~ /^(suse|sles)([\d\.]+)$/) {
+        if (($1 eq 'sles') && ($2 >= 15)) {
+            $checkfirewalld = 1;
+        }
+    } elsif ($distro =~ /^fedora(\d+)$/) {
+        if ($1 >= 18) {
+            $checkfirewalld = 1;
+        }
+    } elsif ($distro =~ /^(?:centos|rhes|scientific)(\d+)/) {
+        if ($1 >= 7) {
+            $checkfirewalld = 1;
+        }
+    }
+    if ($checkfirewalld) {
+        my ($loaded,$active);
+        if (open(PIPE,"systemctl status firewalld |")) {
+            while (<PIPE>) {
+                chomp();
+                if (/^\s*Loaded:\s+(\w+)/) {
+                    $loaded = $1;
+                }
+                if (/^\s*Active\s+(\w+)/) {
+                    $active = $1;
+                }
+            }
+            close(PIPE);
+        }
+        if (($loaded eq 'loaded') || ($active eq 'active')) {
+            $inuse = 1;     
+        }
+    }
+    return $inuse;
+}
 
 sub firewall_open_port {
     my ($iptables,$fw_chains,$lond_port,$iphost,$ports) = @_;
@@ -50,17 +91,18 @@ sub firewall_open_port {
         }
     }
     if (!@okchains) {
-        return 'None of the chain names has the expected format'."\n";
+        return 'None of the chain names has the expected format.'."\n";
     }
     if (ref($ports) ne 'ARRAY') {
         return 'List of ports to open needed.';
     }
+    my $firewalld = &uses_firewalld();
     foreach my $portnum (@{$ports}) {
         my $port = '';
         if ($portnum =~ /^(\d+)$/) {
             $port = $1;
         } else {
-            print "Skipped non-numeric port: $portnum\n";
+            print "Skipped non-numeric port: $portnum.\n";
             next;
         }
         print "Opening firewall access on port $port.\n";
@@ -83,45 +125,68 @@ sub firewall_open_port {
                             if (($1<=255) && ($2<=255) && ($3<=255) && ($4<=255)) {
                                 $ip = "$1.$2.$3.$4";
                             } else {
+                                print "IP address: $key does not have expected format.\n";
                                 next;
                             }
                         } else {
+                            print "IP address: $key does not have expected format.\n";
                             next;
                         }
                         if ($curropen{$ip}) {
                             push(@lond_port_curropen,$ip);
                         } else {
                             foreach my $fw_chain (@okchains) {
-                                my $firewall_command =
-                                    "$iptables -I $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT";
-                                system($firewall_command);
-                                my $return_status = $?>>8;
-                                if ($return_status == 1) {
-                                    unless(grep(/^\Q$ip\E$/,@port_error)) {
+                                if ($firewalld) {
+                                    my $cmd = 'firewall-cmd --zone=public --add-rich-rule \'rule family="ipv4" source address="'.$ip.'/32" port port="'.$port.'" protocol="tcp" accept\'';
+                                    if (open(PIPE,"$cmd |")) {
+                                        my $result = <PIPE>;
+                                        chomp($result);
+                                        close(PIPE);
+                                        if ($result eq 'success') {
+                                            push(@lond_port_open,$ip);
+                                            last;
+                                        } else {
+                                            push (@port_error,$ip);
+                                        }
+                                    } else {
                                         push (@port_error,$ip);
                                     }
-                                } elsif ($return_status == 2) {
-                                    push(@{$command_error{$fw_chain}},$ip);
-                                } elsif ($return_status == 0) {
-                                    push(@lond_port_open,$ip);
-                                    last;
+                                } else {
+                                    my $firewall_command =
+                                        "$iptables -I $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT";
+                                    system($firewall_command);
+                                    my $return_status = $?>>8;
+                                    if ($return_status == 1) {
+                                        unless(grep(/^\Q$ip\E$/,@port_error)) {
+                                            push (@port_error,$ip);
+                                        }
+                                    } elsif ($return_status == 2) {
+                                        push(@{$command_error{$fw_chain}},$ip);
+                                    } elsif ($return_status == 0) {
+                                        push(@lond_port_open,$ip);
+                                        last;
+                                    }
                                 }
                             }
                         }
                     }
+                } else {
+                    print "no key found in $iphost hash ref\n";
                 }
+            } else {
+                print "$iphost is not a reference to a hash\n";
             }
             if (@lond_port_curropen) {
                 unless (grep(/^\Q$port\E$/,@opened)) {
                     push(@opened,$port);
                 }
-                print "Port already open for ".scalar(@lond_port_curropen)." IP addresses\n";
+                print "Port already open for ".scalar(@lond_port_curropen)." IP addresses.\n";
             }
             if (@lond_port_open) {
                 unless (grep(/^\Q$port\E$/,@opened)) {   
                     push(@opened,$port);
                 }
-                print "Port opened for ".scalar(@lond_port_open)." IP addresses\n";
+                print "Port opened for ".scalar(@lond_port_open)." IP addresses.\n";
             }
             if (@port_error) {
                 print "Error opening port for following IP addresses: ".join(', ',@port_error)."\n";
@@ -140,28 +205,45 @@ sub firewall_open_port {
         } else {
             my (@port_errors,%command_errors);
             foreach my $fw_chain (@okchains) {
-                my $firewall_command =
-                    "$iptables -I $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT";
-                system($firewall_command);
-                my $return_status = $?>>8;
-                if ($return_status == 1) {
-                    push(@port_errors,$fw_chain);
-                } elsif ($return_status == 2) {
-                    $command_errors{$fw_chain} = $firewall_command;
-                } elsif ($return_status == 0) {
-                    push(@opened,$port);
-                    last;
+                if ($firewalld) {
+                    my $cmd = 'firewall-cmd --zone=public --add-rich-rule \'rule family="ipv4" port port="'.$port.'" protocol="tcp" accept\'';
+                    if (open(PIPE,"$cmd |")) {
+                        my $result = <PIPE>;
+                        chomp($result);
+                        close(PIPE);
+                        if ($result eq 'success') {
+                            push(@opened,$port);
+                            last;
+                        } else {
+                            push(@port_errors,$fw_chain);
+                        }
+                    } else {
+                        push(@port_errors,$fw_chain);
+                    }
+                } else {
+                    my $firewall_command =
+                        "$iptables -I $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT";
+                    system($firewall_command);
+                    my $return_status = $?>>8;
+                    if ($return_status == 1) {
+                        push(@port_errors,$fw_chain);
+                    } elsif ($return_status == 2) {
+                        $command_errors{$fw_chain} = $firewall_command;
+                    } elsif ($return_status == 0) {
+                        push(@opened,$port);
+                        last;
+                    }
                 }
-            }
-            unless (grep(/^\Q$port\E$/,@opened)) {
-                if (@port_errors) {
-                    print "Error opening port for chains: ".
-                          join(', ',@port_errors).".\n";
-                }
-                if (keys(%command_errors)) {
-                    foreach my $fw_chain (sort(keys(%command_errors))) {
-                        print "Bad command error opening port for chain: $fw_chain.  Command was\n".
-                          "  ".$command_errors{$fw_chain}."\n";
+                unless (grep(/^\Q$port\E$/,@opened)) {
+                    if (@port_errors) {
+                        print "Error opening port for chains: ".
+                              join(', ',@port_errors).".\n";
+                    }
+                    if (keys(%command_errors)) {
+                        foreach my $fw_chain (sort(keys(%command_errors))) {
+                            print "Bad command error opening port for chain: $fw_chain.  Command was\n".
+                                  "  ".$command_errors{$fw_chain}."\n";
+                        }
                     }
                 }
             }
@@ -183,11 +265,11 @@ sub firewall_is_port_open {
     # check if firewall is active or installed
     return if (! &firewall_is_active());
     my $count = 0;
-    if (open(PIPE,"$iptables -L $fw_chain -n 2>/dev/null |")) {
+    if (open(PIPE,"$iptables -L $fw_chain -n |")) {
         while(<PIPE>) {
             if ($port eq $lond_port) {
                 if (ref($iphost) eq 'HASH') {
-                    if (/^ACCEPT\s+tcp\s+\-{2}\s+([\S]+)\s+/) {
+                    if (/^ACCEPT\s+tcp\s+\-{2}\s+(\S+)\s+\S+\s+tcp\s+dpt\:\Q$port\E/) {
                         my $ip = $1;
                         if ($iphost->{$ip}) {
                             $count ++;
@@ -210,15 +292,24 @@ sub firewall_is_port_open {
 }
 
 sub firewall_is_active {
+    my $status = 0;
     if (-e '/proc/net/ip_tables_names') {
-        return 1;
-    } else {
-        return 0;
+        if (open(PIPE,'cat /proc/net/ip_tables_names |')) {
+            while(<PIPE>) {
+                chomp();
+                if (/^filter$/) {
+                    $status = 1;
+                    last;
+                }
+            }
+            close(PIPE);
+        }
     }
+    return $status;
 }
 
 sub firewall_close_port {
-    my ($iptables,$fw_chains,$lond_port,$ports) = @_;
+    my ($iptables,$fw_chains,$lond_port,$iphost,$ports) = @_;
     return 'inactive firewall' if (!&firewall_is_active());
     return 'port number unknown' if !$lond_port;
     return 'invalid firewall chain' unless (ref($fw_chains) eq 'ARRAY');
@@ -231,11 +322,12 @@ sub firewall_close_port {
         }
     }
     if (!@okchains) {
-        return 'None of the chain names has the expected format'."\n";
+        return 'None of the chain names has the expected format.'."\n";
     }
     if (ref($ports) ne 'ARRAY') {
         return 'List of ports to close needed.';
     }
+    my $firewalld = &uses_firewalld();
     foreach my $portnum (@{$ports}) {
         my $port = '';
         if ($portnum =~ /^(\d+)$/) {
@@ -244,48 +336,79 @@ sub firewall_close_port {
             print "Skipped non-numeric port: $portnum\n"; 
             next;
         }
-        print "Closing firewall access on port $port\n";
+        print "Closing firewall access on port $port.\n";
         if (($port ne '') && ($port eq $lond_port)) {
+            my $output;
             foreach my $fw_chain (@okchains) {
                 my (@port_error,@command_error,@lond_port_close);
                 my %to_close;
                 if (open(PIPE, "$iptables -n -L $fw_chain |")) {
                     while (<PIPE>) {
                         chomp();
-                        next unless (/dpt:\Q$port\E\s*$/);
+                        next unless (/dpt:\Q$port\E/);
                         if (/^ACCEPT\s+tcp\s+\-{2}\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+/) {
-                            $to_close{$1} = $port;
+                            my $ip = $1;
+                            my $keepopen = 0;
+                            if (ref($iphost) eq 'HASH') {
+                                if (exists($iphost->{$ip})) {
+                                    $keepopen = 1; 
+                                }
+                            }
+                            unless ($keepopen) {
+                                $to_close{$ip} = $port;
+                            }
                         }
                     }
                     close(PIPE);
                 }
                 if (keys(%to_close) > 0) {
                     foreach my $ip (keys(%to_close)) {
-                        my $firewall_command =
-                            "$iptables -D $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT";
-                        system($firewall_command);
-                        my $return_status = $?>>8;
-                        if ($return_status == 1) {
-                            push (@port_error,$ip);
-                        } elsif ($return_status == 2) {
-                            push(@command_error,$ip);
-                        } elsif ($return_status == 0) {
-                            push(@lond_port_close,$ip);
+                        if ($firewalld) {
+                            my $cmd = 'firewall-cmd --zone=public --remove-rich-rule \'rule family="ipv4" source address="'.$ip.'/32" port port="'.$port.'" protocol="tcp" accept\'';
+                            if (open(PIPE,"$cmd |")) {
+                                my $result = <PIPE>;
+                                chomp($result);
+                                close(PIPE);
+                                if ($result eq 'success') {
+                                    push(@lond_port_close,$ip);
+                                } else {
+                                    push(@port_error,$ip);
+                                }
+                            } else {
+                                push(@port_error,$ip);
+                            }
+                        } else {
+                            my $firewall_command =
+                                "$iptables -D $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT";
+                            system($firewall_command);
+                            my $return_status = $?>>8;
+                            if ($return_status == 1) {
+                                push (@port_error,$ip);
+                            } elsif ($return_status == 2) {
+                                push(@command_error,$ip);
+                            } elsif ($return_status == 0) {
+                                push(@lond_port_close,$ip);
+                            }
                         }
                     }
                 }
                 if (@lond_port_close) {
-                    print "Port closed for ".scalar(@lond_port_close)." IP addresses\n";
+                    $output .= "Port closed for ".scalar(@lond_port_close)." IP addresses.\n";
                 }
                 if (@port_error) {
-                    print "Error closing port for following IP addresses: ".join(', ',@port_error)."\n";
+                    $output .= "Error closing port for following IP addresses: ".join(', ',@port_error)."\n";
                 }
                 if (@command_error) {
-                    print "Bad command error opening port for following IP addresses: ".
+                    $output .= "Bad command error opening port for following IP addresses: ".
                           join(', ',@command_error)."\n".
                           'Command was: "'."$iptables -D $fw_chain -p tcp -s ".'$ip'." -d 0/0 --dport $port -j ACCEPT".'", where $ip is IP address'."\n";
                 }
             }
+            if ($output) {
+                 print $output;
+            } else {
+                print "No IP addresses required discontinuation of access.\n";
+            }
         } else {
             foreach my $fw_chain (@okchains) {
                 my (@port_error,@command_error,@lond_port_close);
@@ -293,25 +416,41 @@ sub firewall_close_port {
                 if (open(PIPE, "$iptables -n -L $fw_chain |")) {
                     while (<PIPE>) {
                         chomp();
-                        next unless (/dpt:\Q$port\E\s*$/);
+                        next unless (/dpt:\Q$port\E/);
                         $to_close = 1;
                     }
                     close(PIPE);
                 }
                 if ($to_close) {
-                    my $firewall_command =
-                        "$iptables -D $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT";
-                    system($firewall_command);
-                    my $return_status = $?>>8;
-                    if ($return_status == 1) {
-                        # Error
-                        print "Error closing port for chain: $fw_chain.\n";
-                    } elsif ($return_status == 2) {
-                        # Bad command
-                        print "Bad command error closing port.  Command was\n".
-                              "  ".$firewall_command."\n";
+                    if ($firewalld) {
+                        my $cmd = 'firewall-cmd --zone=public --remove-rich-rule \'rule family="ipv4" port port="'.$port.'" protocol="tcp" accept\'';
+                        if (open(PIPE,"$cmd|")) {
+                            my $result = <PIPE>;
+                            chomp($result);
+                            close(PIPE);
+                            if ($result eq 'success') {
+                                print "Port closed for chain $fw_chain.\n";
+                            } else {
+                                print "Error closing port for chain: $fw_chain.\n";
+                            }
+                        } else {
+                            print "Error closing port for chain: $fw_chain.\n";
+                        }
                     } else {
-                        print "Port closed for chain $fw_chain.\n";
+                        my $firewall_command =
+                            "$iptables -D $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT";
+                        system($firewall_command);
+                        my $return_status = $?>>8;
+                        if ($return_status == 1) {
+                            # Error
+                            print "Error closing port for chain: $fw_chain.\n";
+                        } elsif ($return_status == 2) {
+                            # Bad command
+                            print "Bad command error closing port.  Command was\n".
+                                  "  ".$firewall_command."\n";
+                        } else {
+                            print "Port closed for chain $fw_chain.\n";
+                        }
                     }
                 }
             }
@@ -322,21 +461,38 @@ sub firewall_close_port {
 
 sub firewall_close_anywhere {
     my ($iptables,$fw_chain,$port) = @_;
+    my $firewalld = &uses_firewalld();
     if (open(PIPE, "$iptables --line-numbers -n -L $fw_chain |")) {
         while (<PIPE>) {
             next unless (/dpt:\Q$port\E/);
             chomp();
             if (/^(\d+)\s+ACCEPT\s+tcp\s+\-{2}\s+0\.0\.0\.0\/0\s+0\.0\.0\.0\/0/) {
-                my $firewall_command = "$iptables -D $fw_chain $1";
-                system($firewall_command);
-                my $return_status = $?>>8;
-                if ($return_status == 1) {
-                    print 'Error closing port '.$port.' for source "anywhere"'."\n";
-                } elsif ($return_status == 2) {
-                    print 'Bad command error closing port '.$port.' for source "anywhere".  Command was'."\n".
-                          ' '.$firewall_command."\n";
+                if ($firewalld) {
+                    my $cmd = 'firewall-cmd --remove-port='.$port.'/tcp';
+                    if (open(PIPE,"$cmd |")) {
+                        my $result = <PIPE>;
+                        chomp($result);
+                        close(PIPE);
+                        if ($result eq 'success') {
+                            print 'Port '.$port.' closed for source "anywhere"'."\n";
+                        } else {
+                            print 'Error closing port '.$port.' for source "anywhere".'."\n";
+                        }
+                    } else {
+                        print 'Error closing port '.$port.' for source "anywhere".'."\n";
+                    }
                 } else {
-                    print 'Port '.$port.' closed for source "anywhere"'."\n";
+                    my $firewall_command = "$iptables -D $fw_chain $1";
+                    system($firewall_command);
+                    my $return_status = $?>>8;
+                    if ($return_status == 1) {
+                        print 'Error closing port '.$port.' for source "anywhere".'."\n";
+                    } elsif ($return_status == 2) {
+                        print 'Bad command error closing port '.$port.' for source "anywhere".  Command was'."\n".
+                              ' '.$firewall_command."\n";
+                    } else {
+                        print 'Port '.$port.' closed for source "anywhere"'."\n";
+                    }
                 }
             }
         }
@@ -359,23 +515,48 @@ sub get_lond_port {
 }
 
 sub get_fw_chains {
-    my ($iptables) = @_;
+    my ($iptables,$distro) = @_;
+    if ($distro eq '') {
+        $distro = &get_distro();
+    }
     my @fw_chains;
     my $suse_config = "/etc/sysconfig/SuSEfirewall2";
-    if (-e $suse_config) {
+    my $ubuntu_config = "/etc/ufw/ufw.conf";
+    if (&uses_firewalld($distro)) {
+        push(@fw_chains,'IN_public_allow');
+    } elsif (-e $suse_config) {
         push(@fw_chains,'input_ext');
     } else {
-        if (!-e '/etc/sysconfig/iptables') {
-            if (!-e '/var/lib/iptables') {
-                print("Unable to find iptables file containing static definitions\n");
+        my @posschains;
+        if (-e $ubuntu_config) {
+            @posschains = ('ufw-user-input','INPUT');
+        } else {
+            if ($distro =~ /^(debian|ubuntu|suse|sles)/) {
+                @posschains = ('INPUT'); 
+            } elsif ($distro =~ /^(fedora|rhes|centos|scientific)(\d+)$/) {
+                if ((($1 eq 'fedora') && ($2 > 15)) || (($1 ne 'fedora') && ($2 >= 7))) {
+                    @posschains = ('INPUT');
+                } else {
+                    @posschains = ('RH-Firewall-1-INPUT','INPUT');
+                }
+            }
+            if (!-e '/etc/sysconfig/iptables') {
+                if (!-e '/var/lib/iptables') {
+                    unless ($distro =~ /^(debian|ubuntu)/) {
+                        print("Unable to find iptables file containing static definitions.\n");
+                    }
+                }
+                if ($distro =~ /^(fedora|rhes|centos|scientific)(\d+)$/) {
+                    unless ((($1 eq 'fedora') && ($2 > 15)) || (($1 ne 'fedora') && ($2 >= 7))) {
+                        push(@fw_chains,'RH-Firewall-1-INPUT');
+                    }
+                }
             }
-            push(@fw_chains,'RH-Firewall-1-INPUT'); 
         }
         if ($iptables eq '') {
             $iptables = &get_pathto_iptables();
         }
         my %counts;
-        my @posschains = ('RH-Firewall-1-INPUT','INPUT');
         if (open(PIPE,"$iptables -L -n |")) {
             while(<PIPE>) {
                 foreach my $chain (@posschains) {
@@ -388,7 +569,9 @@ sub get_fw_chains {
         }
         foreach my $fw_chain (@posschains) {
             if ($counts{$fw_chain}) {
-                push(@fw_chains,$fw_chain);
+                unless(grep(/^\Q$fw_chain\E$/,@fw_chains)) {
+                    push(@fw_chains,$fw_chain);
+                }
             }
         }
     }
@@ -402,11 +585,20 @@ sub get_pathto_iptables {
     } elsif (-e '/usr/sbin/iptables') {
         $iptables = '/usr/sbin/iptables';
     } else {
-        print("Unable to find iptables command\n");
+        print("Unable to find iptables command.\n");
     }
     return $iptables;
 }
 
+sub get_distro {
+    my $distro;
+    if (open(PIPE,"/home/httpd/perl/distprobe |")) {
+        $distro = <PIPE>;
+        close(PIPE);
+    }
+    return $distro;
+}
+
 1;
 __END__
 
@@ -421,6 +613,7 @@ B<LONCAPA::Firewall> - dynamic opening/c
  use lib '/home/httpd/lib/perl/';
  use LONCAPA::Firewall;
 
+ LONCAPA::Firewall::uses_firewalld();
  LONCAPA::Firewall::firewall_open_port();
  LONCAPA::Firewall::firewall_close_port();
  LONCAPA::Firewall::firewall_is_port_open();
@@ -440,13 +633,19 @@ The following methods are available:
 
 =over 4
 
+=item LONCAPA::Firewall::uses_firewalld( $distro );
+
+=back
+
+=over 4
+
 =item LONCAPA::Firewall::firewall_open_port( $iptables,$fw_chains,$lond_port,$iphost,$port );
 
 =back
 
 =over 4
 
-=item LONCAPA::Firewall::firewall_close_port( $iptables,$fw_chains,$lond_port,$ports );
+=item LONCAPA::Firewall::firewall_close_port( $iptables,$fw_chains,$lond_port,$iphost,$ports );
 
 =back
 
@@ -476,7 +675,7 @@ The following methods are available:
 
 =over 4
 
-=item LONCAPA::Firewall::get_fw_chains();
+=item LONCAPA::Firewall::get_fw_chains( $iptables,$distro );
 
 =back
 
@@ -484,6 +683,13 @@ The following methods are available:
 
 =item LONCAPA::Firewall::get_pathto_iptables();
 
+=back
+
+=over 4
+
+=item LONCAPA::Firewall::get_distro();
+
+=back
 
 =head1 AUTHORS