From 32fc0ecdaa77bd0ce86f14fca335281e78b381f8 Mon Sep 17 00:00:00 2001 From: Auke Kok Date: Mon, 28 Oct 2019 14:27:02 -0700 Subject: [PATCH] Hide unwanted firewalld-cmd error messages. --- src/tallow.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/src/tallow.c b/src/tallow.c index 015b380..d56ec3c 100644 --- a/src/tallow.c +++ b/src/tallow.c @@ -71,20 +71,20 @@ static void ext_ignore(char *fmt, ...) static void reset_rules(void) { /* reset all rules in case the running fw changes */ - ext_ignore("%s/firewall-cmd --permanent --direct --quiet --remove-rule ipv4 filter INPUT 1 -m set --match-set tallow src -j DROP", ipt_path); - ext_ignore("%s/firewall-cmd --quiet --permanent --delete-ipset=tallow", ipt_path); + ext_ignore("%s/firewall-cmd --permanent --direct --remove-rule ipv4 filter INPUT 1 -m set --match-set tallow src -j DROP 2> /dev/null", ipt_path); + ext_ignore("%s/firewall-cmd --permanent --delete-ipset=tallow 2> /dev/null", ipt_path); /* delete iptables ref to set before the ipset! */ ext_ignore("%s/iptables -t filter -D INPUT -m set --match-set tallow src -j DROP 2> /dev/null", ipt_path); ext_ignore("%s/ipset destroy tallow 2> /dev/null", ipt_path); if (has_ipv6) { - ext_ignore("%s/firewall-cmd --permanent --direct --quiet --remove-rule ipv6 filter INPUT 1 -m set --match-set tallow6 src -j DROP", ipt_path); - ext_ignore("%s/firewall-cmd --permanent --delete-ipset=tallow6 --quiet", ipt_path); + ext_ignore("%s/firewall-cmd --permanent --direct --remove-rule ipv6 filter INPUT 1 -m set --match-set tallow6 src -j DROP 2> /dev/null", ipt_path); + ext_ignore("%s/firewall-cmd --permanent --delete-ipset=tallow6 2> /dev/null", ipt_path); /* delete iptables ref to set before the ipset! */ ext_ignore("%s/ip6tables -t filter -D INPUT -m set --match-set tallow6 src -j DROP 2> /dev/null", ipt_path); - ext_ignore("%s/ipset destroy tallow6 2> /dev/null", ipt_path); + ext_ignore("%s/ipset destroy tallow6 2> /dev/null", ipt_path); } } @@ -100,9 +100,7 @@ static void setup(void) /* firewalld */ char *fwd_path; - if (asprintf(&fwd_path, "%s/firewall-cmd", ipt_path) < 0) - { - fprintf(stderr, "Unable to allocate buffer for path to firewall-cmd.\n"); + if (asprintf(&fwd_path, "%s/firewall-cmd", ipt_path) < 0) { exit(EXIT_FAILURE); } @@ -138,10 +136,8 @@ static void setup(void) fprintf(stderr, "Unable to reload firewalld rules.\n"); exit(EXIT_FAILURE); } - } - /* iptables */ - else { - + } else { + /* iptables */ reset_rules(); /* create ipv4 rule and ipset */