From 8ac6081555dd95574692e93c0c985a28582c6595 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 31 Oct 2013 01:23:00 +1100 Subject: [PATCH 1/3] ENH: fix to use upstream --remove-rules https://fedorahosted.org/firewalld/ticket/10 --- config/action.d/firewall-cmd-direct-new.conf | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/config/action.d/firewall-cmd-direct-new.conf b/config/action.d/firewall-cmd-direct-new.conf index ac06aa57..0f7388a2 100644 --- a/config/action.d/firewall-cmd-direct-new.conf +++ b/config/action.d/firewall-cmd-direct-new.conf @@ -15,15 +15,8 @@ actionstart = firewall-cmd --direct --add-chain ipv4 filter fail2ban- firewall-cmd --direct --add-rule ipv4 filter fail2ban- 1000 -j RETURN firewall-cmd --direct --add-rule ipv4 filter 0 -m state --state NEW -p --dport -j fail2ban- -# The following rule does not work, because firewalld keeps its own database of firewall rules. -# firewall-cmd --direct --passthrough ipv4 -F fail2ban- -# The better rule would be the following, but firewall-cmd has not implemented this command with firewalld-0.3.3-2.fc19 . -# firewall-cmd --direct --flush-chain ipv4 filter fail2ban- -# The following is a workaround using a loop to implement the --flush-chain command. -# https://fedorahosted.org/firewalld/ticket/10 - actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -m state --state NEW -p --dport -j fail2ban- - ( IFS='|' ; for r in $( firewall-cmd --direct --get-rules ipv4 filter fail2ban- | tr '\n' '|' ) ; do eval firewall-cmd --direct --remove-rule ipv4 filter fail2ban- $r ; done ) + firewall-cmd --direct --remove-rules ipv4 filter fail2ban- firewall-cmd --direct --remove-chain ipv4 filter fail2ban- actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q 'fail2ban-[ \t]' From 5eddd5d12dbb7a4d82d74598df2c9efb548f2e12 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 31 Oct 2013 09:10:59 +1100 Subject: [PATCH 2/3] DOC: document required firewalld version as > 0.3.7.1 --- config/action.d/firewall-cmd-direct-new.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/config/action.d/firewall-cmd-direct-new.conf b/config/action.d/firewall-cmd-direct-new.conf index 0f7388a2..3fd4e52b 100644 --- a/config/action.d/firewall-cmd-direct-new.conf +++ b/config/action.d/firewall-cmd-direct-new.conf @@ -3,7 +3,8 @@ # Author: Edgar Hoch # Copied from iptables-new.conf and modified for use with firewalld by Edgar Hoch. # It uses "firewall-cmd" instead of "iptables". -# firewall-cmd is based on the command of version firewalld-0.3.4-1.fc19. +# +# Because of the --remove-rules in stop it requires a version AFTER (but not including) 0.3.7.1 [INCLUDES] From 87f68d7564ff375eda6c423b28ca09e3f53123ae Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Wed, 6 Nov 2013 11:37:56 +1100 Subject: [PATCH 3/3] firewalld-0.3.8 release that support --remove-rules out so documenting this. --- ChangeLog | 1 + config/action.d/firewall-cmd-direct-new.conf | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index f77d9491..623d998e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -54,6 +54,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests Edgar Hoch * action.d/firewall-cmd-direct-new.conf - action for firewalld from https://bugzilla.redhat.com/show_bug.cgi?id=979622 + NOTE: requires firewalld-0.3.8+ Andy Fragen and Daniel Black * filter.d/osx-ipfw.conf - ipfw action for OSX based on random rule numbers. diff --git a/config/action.d/firewall-cmd-direct-new.conf b/config/action.d/firewall-cmd-direct-new.conf index 3fd4e52b..55b6762d 100644 --- a/config/action.d/firewall-cmd-direct-new.conf +++ b/config/action.d/firewall-cmd-direct-new.conf @@ -4,7 +4,7 @@ # Copied from iptables-new.conf and modified for use with firewalld by Edgar Hoch. # It uses "firewall-cmd" instead of "iptables". # -# Because of the --remove-rules in stop it requires a version AFTER (but not including) 0.3.7.1 +# Because of the --remove-rules in stop this action requires firewalld-0.3.8+ [INCLUDES]