firewall: consolidate firewalld code into firewall plugin

plugins/meta/firewall/firewall_firewalld_test.go

@@ -24,7 +24,6 @@ import (
 
  "github.com/containernetworking/cni/pkg/invoke"
  "github.com/containernetworking/cni/pkg/skel"
- "github.com/containernetworking/plugins/pkg/firewalld"
  "github.com/containernetworking/plugins/pkg/ns"
  "github.com/containernetworking/plugins/pkg/testutils"
 
@@ -141,7 +140,7 @@ var _ = Describe("firewalld test", func() {
  Expect(err).NotTo(HaveOccurred())
 
  // Start our fake firewalld
- reply, err := conn.RequestName(firewalld.FirewalldName, dbus.NameFlagDoNotQueue)
+ reply, err := conn.RequestName(firewalldName, dbus.NameFlagDoNotQueue)
  Expect(err).NotTo(HaveOccurred())
  Expect(reply).To(Equal(dbus.RequestNameReplyPrimaryOwner))
 
@@ -150,17 +149,17 @@ var _ = Describe("firewalld test", func() {
  // because in Go lower-case methods are private, we need to remap
  // Go public methods to the D-Bus name
  methods := map[string]string{
- "AddSource": "addSource",
- "RemoveSource": "removeSource",
+ "AddSource": firewalldAddSourceMethod,
+ "RemoveSource": firewalldRemoveSourceMethod,
  }
- conn.ExportWithMap(fwd, methods, firewalld.FirewalldPath, firewalld.FirewalldZoneInterface)
+ conn.ExportWithMap(fwd, methods, firewalldPath, firewalldZoneInterface)
 
  // Make sure the plugin uses our private session bus
  testConn = conn
  })
 
  AfterEach(func() {
- _, err := conn.ReleaseName(firewalld.FirewalldName)
+ _, err := conn.ReleaseName(firewalldName)
  Expect(err).NotTo(HaveOccurred())
 
  err = cmd.Process.Signal(syscall.SIGTERM)
@@ -170,7 +169,7 @@ var _ = Describe("firewalld test", func() {
  })
 
  It("works with a 0.3.1 config", func() {
- Expect(firewalld.IsRunning(conn)).To(BeTrue())
+ Expect(isFirewalldRunning()).To(BeTrue())
 
  conf := fmt.Sprintf(confTmpl, ifname, targetNs.Path())
  args := &skel.CmdArgs{

plugins/meta/firewall/firewalld.go

@@ -16,12 +16,25 @@ package main
 
 import (
  "fmt"
-
- "github.com/containernetworking/plugins/pkg/firewalld"
+ "strings"
 
  "github.com/godbus/dbus"
 )
 
+const (
+ dbusName = "org.freedesktop.DBus"
+ dbusPath = "/org/freedesktop/DBus"
+ dbusGetNameOwnerMethod = "GetNameOwner"
+
+ firewalldName = "org.fedoraproject.FirewallD1"
+ firewalldPath = "/org/fedoraproject/FirewallD1"
+ firewalldZoneInterface = "org.fedoraproject.FirewallD1.zone"
+ firewalldAddSourceMethod = "addSource"
+ firewalldRemoveSourceMethod = "removeSource"
+
+ errZoneAlreadySet = "ZONE_ALREADY_SET"
+)
+
 // Only used for testcases to override the D-Bus connection
 var testConn *dbus.Conn
 
@@ -39,12 +52,20 @@ func getConn() (*dbus.Conn, error) {
  return dbus.SystemBus()
 }
 
+// isFirewalldRunning checks whether firewalld is running.
 func isFirewalldRunning() bool {
  conn, err := getConn()
  if err != nil {
  return false
  }
- return firewalld.IsRunning(conn)
+
+ dbusObj := conn.Object(dbusName, dbusPath)
+ var res string
+ if err := dbusObj.Call(dbusName+"."+dbusGetNameOwnerMethod, 0, firewalldName).Store(&res); err != nil {
+ return false
+ }
+
+ return true
 }
 
 func newFirewalldBackend(conf *FirewallNetConf) (FirewallBackend, error) {
@@ -61,16 +82,26 @@ func newFirewalldBackend(conf *FirewallNetConf) (FirewallBackend, error) {
 
 func (fb *fwdBackend) Add(conf *FirewallNetConf) error {
  for _, ip := range conf.PrevResult.IPs {
- if err := firewalld.AddSourceToZone(fb.conn, ip.Address.IP, conf.FirewalldZone); err != nil {
- return fmt.Errorf("failed to add the address %v to %v zone: %v", ip.Address.IP, conf.FirewalldZone, err)
+ ipStr := ipString(ip.Address)
+ // Add a firewalld rule which assigns the given source IP to the given zone
+ firewalldObj := fb.conn.Object(firewalldName, firewalldPath)
+ var res string
+ if err := firewalldObj.Call(firewalldZoneInterface+"."+firewalldAddSourceMethod, 0, conf.FirewalldZone, ipStr).Store(&res); err != nil {
+ if !strings.Contains(err.Error(), errZoneAlreadySet) {
+ return fmt.Errorf("failed to add the address %v to %v zone: %v", ipStr, conf.FirewalldZone, err)
+ }
  }
  }
  return nil
 }
 
 func (fb *fwdBackend) Del(conf *FirewallNetConf) error {
  for _, ip := range conf.PrevResult.IPs {
- firewalld.RemoveSourceFromZone(fb.conn, ip.Address.IP, conf.FirewalldZone)
+ ipStr := ipString(ip.Address)
+ // Remove firewalld rules which assigned the given source IP to the given zone
+ firewalldObj := fb.conn.Object(firewalldName, firewalldPath)
+ var res string
+ firewalldObj.Call(firewalldZoneInterface+"."+firewalldRemoveSourceMethod, 0, conf.FirewalldZone, ipStr).Store(&res)
  }
  return nil
 }