Discovering machines (or: OpenSLP, a laundry list)

Marius Vollmer marius.vollmer at redhat.com
Fri Dec 13 08:14:09 UTC 2013


Marius Vollmer <marius.vollmer at redhat.com> writes:

> - In order to receive the unicast replies, we can punch a small hole in
>   the firewall while we listen for those replies.  The hole would allow
>   packets from *:427 to the socket we listen on, nothing else.  This is
>   done inside cockpitd.

Right, my naivety knows no bounds.  Of course we can't know the
destination port without patching OpenSLP and of course we can't
reliably add temporary firewall rules without patching firewalld.

So let's just open the firewall wide with

    firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p udp --sport 427 -j ACCEPT

until the conntrack helper exists.


More information about the cockpit-devel mailing list