[Question] Is there a way to determine if firewall-cmd changes a setting?

[MikeParkin]

I'm using firewalld within a devops situation, and it would be helpful to know if firewall-cmd has changed the active configuration after a command has run. Is there a way to do this?

If i run this multiple times I get 0 exit code and the message 'success'

/bin/firewall-cmd --permanent --zone=trusted --add-source=x.x.x.x

Would you ever consider changing it to 'Success [no change]' or is this out of the scope of firewall-cmds responsibilities?

[t-woerner]

firewall-cmd is only returning "Success" if the command succeeded. Here are some examples:

# firewall-cmd --permanent --zone=trusted --add-source=1.2.3.4
success
# firewall-cmd --permanent --zone=trusted --add-source=1.2.3.4
Warning: ALREADY_ENABLED: 1.2.3.4
# firewall-cmd --permanent --zone=trusted --remove-source=1.2.3.4
success
# firewall-cmd --permanent --zone=trusted --remove-source=1.2.3.4
Warning: NOT_ENABLED: 1.2.3.4

I just noticed that the return value is not correct in the warning case. I will fix this.

[MikeParkin]

Thanks for the quick response! What version was this functionality added?

[root@localhost vagrant]# /bin/firewall-cmd --permanent --zone=trusted --add-source=8.8.8.8
success
[root@localhost vagrant]# /bin/firewall-cmd --permanent --zone=trusted --add-source=8.8.8.8
success
[root@localhost vagrant]# /bin/firewall-cmd --version
0.3.9

I'm using 0.3.9 which was stock from Centos7 which doesn't seem to have the same behaviour.

[t-woerner]

That has been added with 0.3.12.

[t-woerner]

You will get this with the rebase to 0.4.3.