networks: Declare a need for DHCP/DNS ports to be open in firewall

- Before this change, when bind is disabled, dns port is removed from firewall
causing all 'shared' connection to not be able to resolve domains. This was
because no other application was declaring a need for 'dns' port to be kept
open. Declare a firewall component in the networks app needing 'dns' and 'dhcp'
services on the internal networks.

Tests:

- Without the patch, install and disable bind. 'dns' port is removed from
'internal' zone of the firewall.

- Install and disable bind. 'dns' port is not removed from 'internal' zone of
the firewall.

- On a fresh Debian machine. Install the freedombox package. 'http', 'https',
'dns' and 'dhcp' port are opened on the firewall as expected.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>

plinth/modules/firewall/__init__.py

@@ -81,7 +81,7 @@ class FirewallApp(app_module.App):
     def setup(self, old_version):
         """Install and configure the app."""
         super().setup(old_version)
-        _run_setup()
+        privileged.setup()
 
     def force_upgrade(self, packages):
         """Force upgrade firewalld to resolve conffile prompts."""
@@ -94,7 +94,7 @@ class FirewallApp(app_module.App):
             return False
 
         install(['firewalld'], force_configuration='new')
-        _run_setup()
+        privileged.setup()
         return True
 
     def diagnose(self) -> list[DiagnosticCheck]:
@@ -107,17 +107,6 @@ class FirewallApp(app_module.App):
         return results
 
 
-def _run_setup():
-    """Run firewalld setup."""
-    privileged.setup()
-    add_service('http', 'external')
-    add_service('http', 'internal')
-    add_service('https', 'external')
-    add_service('https', 'internal')
-    add_service('dns', 'internal')
-    add_service('dhcp', 'internal')
-
-
 def _get_dbus_proxy(object, interface):
     """Return a DBusProxy for a given firewalld object and interface."""
     connection = gio.bus_get_sync(gio.BusType.SYSTEM)

plinth/modules/networks/__init__.py

@@ -10,6 +10,7 @@ from plinth import app as app_module
 from plinth import daemon, kvstore, menu, network
 from plinth.config import DropinConfigs
 from plinth.diagnostic_check import DiagnosticCheck
+from plinth.modules.firewall.components import Firewall
 from plinth.package import Packages
 
 from . import privileged
@@ -69,6 +70,11 @@ class NetworksApp(app_module.App):
         packages = Packages('packages-networks', ['network-manager', 'batctl'])
         self.add(packages)
 
+        # For 'shared' network connections
+        firewall = Firewall('firewall-networks', info.name,
+                            ports=['dns', 'dhcp'], is_external=False)
+        self.add(firewall)
+
         dropin_configs = DropinConfigs('dropin-configs-networks', [
             '/etc/NetworkManager/dispatcher.d/10-freedombox-batman',
         ])