Re: Discovering machines (or: OpenSLP, a laundry list)

[Marius Vollmer]

Marius Vollmer  writes:
> In order to receive the unicast replies, we can punch a small hole in
> the firewall while we listen for those replies.  The hole would allow
> packets from *:427 to the socket we listen on, nothing else.  This is
> done inside cockpitd.

Right, my naivety knows no bounds.  Of course we can't know the
destination port without patching OpenSLP and of course we can't
reliably add temporary firewall rules without patching firewalld.

So let's just open the firewall wide with

firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p udp --sport 427 -j ACCEPT

until the conntrack helper exists.