diff -up firewalld-0.3.9/doc/xml/firewall-cmd.xml.RHBZ#994044 firewalld-0.3.9/doc/xml/firewall-cmd.xml
--- firewalld-0.3.9/doc/xml/firewall-cmd.xml.RHBZ#994044 2014-09-29 23:03:25.059783798 +0200
+++ firewalld-0.3.9/doc/xml/firewall-cmd.xml 2014-09-29 23:04:31.637000024 +0200
@@ -340,10 +340,11 @@
- =zone =service=seconds
+ =zone =service=timeval
- Add a service for zone. If zone is omitted, default zone will be used. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the amount of seconds and will be removed automatically afterwards.
+ Add a service for zone. If zone is omitted, default zone will be used. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards.
+ timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.
The service is one of the firewalld provided services. To get a list of the supported services, use firewall-cmd --get-services.
@@ -384,10 +385,11 @@
- =zone =portid-portid/protocol=seconds
+ =zone =portid-portid/protocol=timeval
- Add the port for zone. If zone is omitted, default zone will be used. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the amount of seconds and will be removed automatically afterwards.
+ Add the port for zone. If zone is omitted, default zone will be used. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards.
+ timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.
The port can either be a single port number or a port range portid-portid. The protocol can either be tcp or udp.
@@ -428,10 +430,11 @@
- =zone =icmptype=seconds
+ =zone =icmptype=timeval
- Add an ICMP block for icmptype for zone. If zone is omitted, default zone will be used. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the amount of seconds and will be removed automatically afterwards.
+ Add an ICMP block for icmptype for zone. If zone is omitted, default zone will be used. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards.
+ timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.
The icmptype is the one of the icmp types firewalld supports. To get a listing of supported icmp types: firewall-cmd --get-icmptypes
@@ -475,10 +478,11 @@
- =zone =port=portid-portid:proto=protocol:toport=portid-portid:toaddr=address/mask=seconds
+ =zone =port=portid-portid:proto=protocol:toport=portid-portid:toaddr=address/mask=timeval
- Add the IPv4 forward port for zone. If zone is omitted, default zone will be used. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the amount of seconds and will be removed automatically afterwards.
+ Add the IPv4 forward port for zone. If zone is omitted, default zone will be used. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards.
+ timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.
The port can either be a single port number portid or a port range portid-portid. The protocol can either be tcp or udp. The destination address is a simple IP address.
@@ -519,10 +523,12 @@
- =zone=seconds
+ =zone=timeval
- Enable IPv4 masquerade for zone. If zone is omitted, default zone will be used. If a timeout is supplied, masquerading will be active for the amount of seconds. Masquerading is useful if the machine is a router and machines connected over an interface in another zone should be able to use the first connection.
+ Enable IPv4 masquerade for zone. If zone is omitted, default zone will be used. If a timeout is supplied, masquerading will be active for the specified amount of time.
+ timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.
+ Masquerading is useful if the machine is a router and machines connected over an interface in another zone should be able to use the first connection.
The option is not combinable with the option.
@@ -569,10 +575,11 @@
- =zone ='rule' =seconds
+ =zone ='rule' =timeval
- Add rich language rule 'rule' for zone. This option can be specified multiple times. If zone is omitted, default zone will be used. If a timeout is supplied, the rule will be active for the amount of seconds and will be removed automatically afterwards.
+ Add rich language rule 'rule' for zone. This option can be specified multiple times. If zone is omitted, default zone will be used. If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards.
+ timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.
For the rich language rule syntax, please have a look at firewalld.richlanguage5.
diff -up firewalld-0.3.9/src/firewall-cmd.RHBZ#994044 firewalld-0.3.9/src/firewall-cmd
--- firewalld-0.3.9/src/firewall-cmd.RHBZ#994044 2014-09-29 23:03:25.063783811 +0200
+++ firewalld-0.3.9/src/firewall-cmd 2014-09-29 23:04:31.638000022 +0200
@@ -111,7 +111,8 @@ Service Options
Options to Adapt and Query Zones
--list-all List everything added for or enabled in a zone [P] [Z]
--list-services List services added for a zone [P] [Z]
- --timeout= Enable an option for seconds only
+ --timeout= Enable an option for timeval time, where timeval is
+ a number followed by one of letters 's' or 'm' or 'h'
Usable for options maked with [T]
--add-service=
Add a service for a zone [P] [Z] [T]
@@ -425,7 +426,7 @@ parser_group_lockdown_whitelist.add_argu
parser.add_argument("--permanent", action="store_true")
parser.add_argument("--zone", default="", metavar="")
-parser.add_argument("--timeout", default=0, type=int, metavar="")
+parser.add_argument("--timeout", default="0", metavar="")
parser_group_zone = parser.add_mutually_exclusive_group()
parser_group_zone.add_argument("--add-interface", metavar="")
@@ -574,7 +575,7 @@ options_zone_adapt_query = \
options_zone_ops = options_zone_interfaces_sources or \
options_zone_action_action or options_zone_adapt_query
-options_zone = a.zone or a.timeout or options_zone_ops
+options_zone = a.zone or a.timeout != "0" or options_zone_ops
options_permanent = a.permanent or options_config or a.zone or options_zone_ops
@@ -633,13 +634,48 @@ if options_config and options_zone:
__fail(parser.format_usage() +
"Wrong usage of --get-zones | --get-services | --get-icmptypes.")
+if a.timeout != "0":
+ value = 0
+ unit = 's'
+ if len(a.timeout) < 1:
+ __fail(parser.format_usage() +
+ "'%s' is wrong timeout value. Use for example '2m' or '1h'" % a.timeout)
+ elif len(a.timeout) == 1:
+ if a.timeout.isdigit():
+ value = int (a.timeout[0])
+ else:
+ __fail(parser.format_usage() +
+ "'%s' is wrong timeout value. Use for example '2m' or '1h'" % a.timeout)
+ elif len(a.timeout) > 1:
+ if a.timeout.isdigit():
+ value = int(a.timeout)
+ unit = 's'
+ else:
+ if a.timeout[:-1].isdigit():
+ value = int (a.timeout[:-1])
+ else:
+ __fail(parser.format_usage() +
+ "'%s' is wrong timeout value. Use for example '2m' or '1h'" % a.timeout)
+ unit = a.timeout[-1:].lower()
+ if unit == 's':
+ a.timeout = value
+ elif unit == 'm':
+ a.timeout = value * 60
+ elif unit == 'h':
+ a.timeout = value * 60 * 60
+ else:
+ __fail(parser.format_usage() +
+ "'%s' is wrong timeout value. Use for example '2m' or '1h'" % a.timeout)
+else:
+ a.timeout = 0
+
if a.timeout and not (a.add_service or a.add_port or a.add_icmp_block or \
- a.add_forward_port or a.add_masquerade or \
- a.add_rich_rule):
+ a.add_forward_port or a.add_masquerade or \
+ a.add_rich_rule):
__fail(parser.format_usage() + "Wrong --timeout usage")
if a.permanent:
- if a.timeout != 0:
+ if a.timeout:
__fail(parser.format_usage() +
"Can't specify timeout for permanent action.")
if options_config and not a.zone: