CVS log for loncom/configuration/Firewall.pm

Up to [LON-CAPA] / loncom / configuration

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

- Bug 6993. For LON-CAPA servers/VMs using firewalld: firewall rules added
  by lciptables made "permanent" so they persist after firewall-cmd --reload

- Support Ubuntu 24 and Debian 12 in which output from iptables -n -L uses
  IP protocol number instead of text when listing protocol for each rule.

- Support Ubuntu 22 and 24 (using ufw).

- Typo

- Support CentOS Stream 8 and 9.

- Support Rocky Linux 8 and AlmaLinux 8

- Show activity while firewall rules are checked for lond port unless this is
  a standalone server.

- Warn if iphost information is missing.

- When firewalld not in use, eliminate superfluous call to
  &firewall_is_active(), and fix logic in check for valid $fw_chain.

- Support Oracle Linux 7

- Dynamic management of LON-CAPA port 5663 compatible with firewalld
  - &get_default_zone(() provides default zone
  - Revert changes in rev. 1.17 to &uses_firewalld() -- now returns
    1 if firewalld in use, but not the default zone.
  - Additional arg, value = 1 if firewalld in use  is passed to
    &firewall_open_port(), &firewall_close_port(),
    &firewall_is_port_open(), &firewall_close_anywhere()

- Dynamic management of LON-CAPA port 5663 compatible with firewalld
  - &uses_firewalld() gets default zone when firewalld is in use.

- Suppress unwanted output from &uses_firewalld() on distros where firewalld
  is available but has been disabled in favor of using iptables commands.

- Dynamic management of LON-CAPA port 5663 compatible with firewalld.

Consistent case and punctuation of output text

- Additional output for unexpected states.

- Use LONCAPA:distro() to get Linux distro.

- Report if no IP addresses required termination of port access.

- Explicit path to distprobe as Firewall.pm is called by lciptables (setuid).

- &get_fw_chains() uses distprobe when getting names of chains in iptables.

- Support firewall configuration via ufw on Ubuntu.

- No longer stop and start of firewall rules for existing hosts when loncron
  calls lciptables.
- Additional arg in Firewall::firewall_close_port() - ref to %iphosts
  hash of hosts in cluster.

- get_fw_chain() renamed get_fw_chains()
  - return array of chains in use
- Reference to this array of chains is second arg for:
    &firewall_close_port() and &firewall_open_port()
- Replace backticks with opened pipe to extract information about chains.
- Streamline code in firewall_is_port_open() to eliminate loop for each
  iptables line.
- When using &firewall_open_port() check if entry already exists for specific IP for LON-CAPA port before calling system command to add one.

On Debian saved rulesets may be found in /var/lib/iptables.

- Pass $iptables (path to iptables) as arg to &get_fw_chain().

- RH-Firewall-1-INPUT no longer used as chain in iptables for Fedora 10 and 11.
  - default to use INPUT as chain for LON-CAPA firewall rules.

- Add a lost linefeed.

- Code to open ports in firewall moved from loncontrol to Firewall.pm
- New routines added:
   &get_pathto_iptables() - gets full path for iptables command
   &get_fw_chain() - gets chain name for firewall rules.