RFE: drop reports

[erig0]

Problem statement

It often occurs that firewalld blocks traffic, but the user doesn't know or understand that firewalld is the one doing the blocking.

Common scenarios:

1. newly installed daemon, but service not added to firewalld
2. VM or container trying to communicate with host

Enhancement

• Use a rich rule to log drops via NFLOG, i.e. Add new rich rule target nflog, that allows to capture packages with ulogd #587
• firewalld listens on a known NFLOG group id
• firewalld holds on to the last 10 minutes of dropped packets
  • maybe only keep unique tuples of: dip, sip, dport, sport
• firewalld posts dbus signal when a new drop occurs
• entities may query firewalld for recently dropped packets

Other thoughts

• A separate entity (say a desktop environment) could listen for these reports and present them to the user. It could be a simple allow/deny dialog which would magically add the service/rules to firewalld.