mrash/fwknop — pull request #129 by g-reno (2014-09-01 01:36:01+00:00)
Title: Feature firewalld

Fwknopd now supports RHEL 7, CentOS 7, and Fedora's firewalld.

First checking that we didn't break iptables:
```
Aug 31 19:53:00 grp-01-23-03 fwknopd[18726]: Starting fwknopd
Aug 31 19:53:00 grp-01-23-03 fwknopd[18726]: Added jump rule from chain: INPUT to chain: FWKNOP_INPUT
Aug 31 19:53:00 grp-01-23-03 fwknopd[18726]: Added jump rule from chain: FORWARD to chain: FWKNOP_FORWARD
Aug 31 19:53:00 grp-01-23-03 fwknopd[18726]: Added jump rule from chain: PREROUTING to chain: FWKNOP_PREROUTING
Aug 31 19:53:00 grp-01-23-03 fwknopd[18726]: iptables 'comment' match is available
Aug 31 19:53:00 grp-01-23-03 fwknopd[18726]: Sniffing interface: enp2s0
Aug 31 19:53:00 grp-01-23-03 fwknopd[18726]: PCAP filter is: 'udp port 62202'
Aug 31 19:53:00 grp-01-23-03 fwknopd[18726]: Starting fwknopd main event loop.
...
...
Aug 31 20:08:12 grp-01-23-03 fwknopd[18726]: (stanza #1) SPA Packet from IP: 192.168.1.11 received with access source match
Aug 31 20:08:12 grp-01-23-03 fwknopd[18726]: Added Rule to FWKNOP_INPUT for 192.168.1.11, tcp/22223 expires at 1409530152
Aug 31 20:09:12 grp-01-23-03 fwknopd[18726]: Removed rule 1 from FWKNOP_INPUT with expire time of 1409530152
```
Here is same for firewalld:
```
Aug 31 20:41:03 grp-01-23-03 fwknopd[24115]: Starting fwknopd
Aug 31 20:41:03 grp-01-23-03 firewalld: 2014-08-31 20:41:03 ERROR: COMMAND_FAILED: '/sbin/iptables -C INPUT -t filter -j FWKNOP_INPUT' failed: iptables v1.4.21: Couldn't load target `FWKNOP_INPUT':No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
Aug 31 20:41:03 grp-01-23-03 firewalld: 2014-08-31 20:41:03 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -F FWKNOP_INPUT' failed: iptables: No chain/target/match by that name.
Aug 31 20:41:03 grp-01-23-03 firewalld: 2014-08-31 20:41:03 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -X FWKNOP_INPUT' failed: iptables: No chain/target/match by that name.
Aug 31 20:41:04 grp-01-23-03 firewalld: 2014-08-31 20:41:04 ERROR: COMMAND_FAILED: '/sbin/iptables -C FORWARD -t filter -j FWKNOP_FORWARD' failed: iptables v1.4.21: Couldn't load target `FWKNOP_FORWARD':No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
Aug 31 20:41:04 grp-01-23-03 firewalld: 2014-08-31 20:41:04 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -F FWKNOP_FORWARD' failed: iptables: No chain/target/match by that name.
Aug 31 20:41:04 grp-01-23-03 firewalld: 2014-08-31 20:41:04 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -X FWKNOP_FORWARD' failed: iptables: No chain/target/match by that name.
Aug 31 20:41:04 grp-01-23-03 firewalld: 2014-08-31 20:41:04 ERROR: COMMAND_FAILED: '/sbin/iptables -C PREROUTING -t nat -j FWKNOP_PREROUTING' failed: iptables v1.4.21: Couldn't load target `FWKNOP_PREROUTING':No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
Aug 31 20:41:04 grp-01-23-03 firewalld: 2014-08-31 20:41:04 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -F FWKNOP_PREROUTING' failed: iptables: No chain/target/match by that name.
Aug 31 20:41:05 grp-01-23-03 firewalld: 2014-08-31 20:41:05 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -X FWKNOP_PREROUTING' failed: iptables: No chain/target/match by that name.
Aug 31 20:41:05 grp-01-23-03 firewalld: 2014-08-31 20:41:05 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -L FWKNOP_INPUT -n' failed: iptables: No chain/target/match by that name.
Aug 31 20:41:05 grp-01-23-03 firewalld: 2014-08-31 20:41:05 ERROR: COMMAND_FAILED: '/sbin/iptables -C INPUT -t filter -j FWKNOP_INPUT' failed: iptables: No chain/target/match by that name.
Aug 31 20:41:05 grp-01-23-03 fwknopd[24115]: Added jump rule from chain: INPUT to chain: FWKNOP_INPUT
Aug 31 20:41:06 grp-01-23-03 firewalld: 2014-08-31 20:41:06 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -L FWKNOP_FORWARD -n' failed: iptables: No chain/target/match by that name.
Aug 31 20:41:06 grp-01-23-03 firewalld: 2014-08-31 20:41:06 ERROR: COMMAND_FAILED: '/sbin/iptables -C FORWARD -t filter -j FWKNOP_FORWARD' failed: iptables: No chain/target/match by that name.
Aug 31 20:41:06 grp-01-23-03 fwknopd[24115]: Added jump rule from chain: FORWARD to chain: FWKNOP_FORWARD
Aug 31 20:41:06 grp-01-23-03 firewalld: 2014-08-31 20:41:06 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -L FWKNOP_PREROUTING -n' failed: iptables: No chain/target/match by that name.
Aug 31 20:41:07 grp-01-23-03 firewalld: 2014-08-31 20:41:07 ERROR: COMMAND_FAILED: '/sbin/iptables -C PREROUTING -t nat -j FWKNOP_PREROUTING' failed: iptables: No chain/target/match by that name.
Aug 31 20:41:07 grp-01-23-03 fwknopd[24115]: Added jump rule from chain: PREROUTING to chain: FWKNOP_PREROUTING
Aug 31 20:41:07 grp-01-23-03 fwknopd[24115]: firewalld 'comment' match is available
Aug 31 20:41:08 grp-01-23-03 fwknopd[24115]: Sniffing interface: enp2s0
Aug 31 20:41:08 grp-01-23-03 fwknopd[24115]: PCAP filter is: 'udp port 62202'
Aug 31 20:41:08 grp-01-23-03 fwknopd[24115]: Starting fwknopd main event loop.
...
...
Aug 31 20:45:55 grp-01-23-03 fwknopd[24115]: (stanza #1) SPA Packet from IP: 192.168.1.11 received with access source match
Aug 31 20:45:56 grp-01-23-03 firewalld: 2014-08-31 20:45:56 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -N FWKNOP_INPUT' failed: iptables: Chain already exists.
Aug 31 20:45:56 grp-01-23-03 fwknopd[24115]: Added Rule to FWKNOP_INPUT for 192.168.1.11, tcp/22223 expires at 1409532415
Aug 31 20:46:55 grp-01-23-03 fwknopd[24115]: Removed rule 1 from FWKNOP_INPUT with expire time of 1409532415
```
firewalld does a little more complaining but it adds the proper chains and rules and it works fine.