Merge pull request #412 from grooverdan/firewalld

ENH: enhance firewall-cmd to use firewall-0.8.3's --remove-rules

ChangeLog

@@ -97,6 +97,7 @@ IMPORTANT incompatible changes:
   Edgar Hoch
 	 * action.d/firewall-cmd-direct-new.conf - action for firewalld
      from https://bugzilla.redhat.com/show_bug.cgi?id=979622
+     NOTE: requires firewalld-0.3.8+
   Andy Fragen and Daniel Black
    * filter.d/osx-ipfw.conf - ipfw action for OSX based on random rule
      numbers.

config/action.d/firewall-cmd-direct-new.conf

@@ -3,7 +3,8 @@
 # Author: Edgar Hoch
 # Copied from iptables-new.conf and modified for use with firewalld by Edgar Hoch.
 #  It uses "firewall-cmd" instead of "iptables".
-#  firewall-cmd is based on the command of version firewalld-0.3.4-1.fc19.
+#
+# Because of the --remove-rules in stop this action requires firewalld-0.3.8+
 
 [INCLUDES]
 
@@ -15,15 +16,8 @@ actionstart = firewall-cmd --direct --add-chain ipv4 filter fail2ban-<name>
               firewall-cmd --direct --add-rule ipv4 filter fail2ban-<name> 1000 -j RETURN
               firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
 
-# The following rule does not work, because firewalld keeps its own database of firewall rules.
-# firewall-cmd --direct --passthrough ipv4 -F fail2ban-<name>
-# The better rule would be the following, but firewall-cmd has not implemented this command with firewalld-0.3.3-2.fc19 .
-# firewall-cmd --direct --flush-chain ipv4 filter fail2ban-<name>
-# The following is a workaround using a loop to implement the --flush-chain command.
-# https://fedorahosted.org/firewalld/ticket/10
-
 actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
-             ( IFS='|' ; for r in $( firewall-cmd --direct --get-rules ipv4 filter fail2ban-<name> | tr '\n' '|' ) ; do eval firewall-cmd --direct --remove-rule ipv4 filter fail2ban-<name> $r ; done )
+             firewall-cmd --direct --remove-rules ipv4 filter fail2ban-<name>
              firewall-cmd --direct --remove-chain ipv4 filter fail2ban-<name>
 
 actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q 'fail2ban-<name>[ \t]'