Repository: moby/moby
File: libnetwork/iptables/firewalld.go (Go)

Code before:
)

const (
	dbusInterface   = "org.fedoraproject.FirewallD1"
	dbusPath        = "/org/fedoraproject/FirewallD1"
	dbusConfigPath  = "/org/fedoraproject/FirewallD1/config"
	dockerZone      = "docker"
	dockerFwdPolicy = "docker-forwarding"
)

// Conn is a connection to firewalld dbus endpoint.
type Conn struct {
	sysconn    *dbus.Conn
	sysObj     dbus.BusObject
	sysConfObj dbus.BusObject
	signal     chan *dbus.Signal
}

var (
	connection *Conn

	firewalldInitCalled bool
	firewalldRunning    bool // is Firewalld service running
	// Time of the last firewalld reload, acquire firewalldReloadedAtMu before reading/writing.
	firewalldReloadedAt   time.Time
	firewalldReloadedAtMu sync.Mutex
	// Mutex to serialise firewalld reload callbacks.
	firewalldReloadMu sync.Mutex
	onReloaded        []*func() // callbacks when Firewalld has been reloaded
)

// UsingFirewalld returns true if iptables rules will be applied via firewalld's
// passthrough interface. The error return is non-nil if the status cannot be
// determined because the initialisation function has not been called.
func UsingFirewalld() (bool, error) {
	// If called before startup has completed, the firewall backend is unknown.
	// But, if running rootless, the init function is not called because
	// firewalld will be running in the host's netns, not in rootlesskit's.
	if !firewalldInitCalled && !rootless.RunningWithRootlessKit() {
		return false, fmt.Errorf("iptables.firewalld is not initialised")
	}
	return firewalldRunning, nil
}

// FirewalldReloadedAt returns the time at which the daemon last completed a
// firewalld reload, or a nil-valued time.Time if it has not been reloaded
// since the daemon started.
func FirewalldReloadedAt() time.Time {
	firewalldReloadedAtMu.Lock()
	defer firewalldReloadedAtMu.Unlock()
	return firewalldReloadedAt

Review comment (suggestion):
Perhaps we could use an `atomic.Value` for this;

```suggestion
	firewalldReloadedAt atomic.Value
```

Code after:
	"github.com/pkg/errors"
)

const (
	dbusInterface   = "org.fedoraproject.FirewallD1"
	dbusPath        = "/org/fedoraproject/FirewallD1"
	dbusConfigPath  = "/org/fedoraproject/FirewallD1/config"
	dockerZone      = "docker"
	dockerFwdPolicy = "docker-forwarding"
)

// Conn is a connection to firewalld dbus endpoint.
type Conn struct {
	sysconn    *dbus.Conn
	sysObj     dbus.BusObject
	sysConfObj dbus.BusObject
	signal     chan *dbus.Signal
}

var (
	connection *Conn

	firewalldInitCalled bool
	firewalldRunning    bool // is Firewalld service running
	// Time of the last firewalld reload.
	firewalldReloadedAt atomic.Value
	// Mutex to serialise firewalld reload callbacks.
	firewalldReloadMu sync.Mutex
	onReloaded        []*func() // callbacks when Firewalld has been reloaded
)

// UsingFirewalld returns true if iptables rules will be applied via firewalld's
// passthrough interface. The error return is non-nil if the status cannot be
// determined because the initialisation function has not been called.
func UsingFirewalld() (bool, error) {
	// If called before startup has completed, the firewall backend is unknown.
	// But, if running rootless, the init function is not called because
	// firewalld will be running in the host's netns, not in rootlesskit's.
	if !firewalldInitCalled && !rootless.RunningWithRootlessKit() {
		return false, fmt.Errorf("iptables.firewalld is not initialised")
	}
	return firewalldRunning, nil
}

// FirewalldReloadedAt returns the time at which the daemon last completed a
// firewalld reload, or a zero-valued time.Time if it has not been reloaded
// since the daemon started.
func FirewalldReloadedAt() time.Time {
	val := firewalldReloadedAt.Load()
	if val == nil {
		return time.Time{}