diff -up firewalld-0.4.3.2/doc/xml/firewalld.service.xml.support_sctp_and_dccp_rhbz#1429808 firewalld-0.4.3.2/doc/xml/firewalld.service.xml

--- firewalld-0.4.3.2/doc/xml/firewalld.service.xml.support_sctp_and_dccp_rhbz#1429808	2016-06-02 14:02:31.000000000 +0200

+++ firewalld-0.4.3.2/doc/xml/firewalld.service.xml	2017-04-13 12:23:16.775979161 +0200

@@ -136,7 +136,7 @@

 	  <term>protocol="<replaceable>string</replaceable>"</term>

           <listitem>

 	    <para>

-              The protocol value can either be <option>tcp</option> or <option>udp</option>.

+              The protocol value can either be <option>tcp</option>, <option>udp</option>, <option>sctp</option> or <option>dccp</option>.

 	    </para>

 	  </listitem>

 	</varlistentry>

@@ -185,7 +185,7 @@

 	  <term>protocol="<replaceable>string</replaceable>"</term>

           <listitem>

 	    <para>

-              The protocol value can either be <option>tcp</option> or <option>udp</option>.

+              The protocol value can either be <option>tcp</option>, <option>udp</option>, <option>sctp</option> or <option>dccp</option>.

 	    </para>

 	  </listitem>

 	</varlistentry>

diff -up firewalld-0.4.3.2/doc/xml/firewalld.zone.xml.support_sctp_and_dccp_rhbz#1429808 firewalld-0.4.3.2/doc/xml/firewalld.zone.xml

--- firewalld-0.4.3.2/doc/xml/firewalld.zone.xml.support_sctp_and_dccp_rhbz#1429808	2017-04-13 12:23:13.992969009 +0200

+++ firewalld-0.4.3.2/doc/xml/firewalld.zone.xml	2017-04-13 12:26:33.882698141 +0200

@@ -73,24 +73,24 @@

   [ <interface name="<replaceable>string</replaceable>"/> ]

   [ <source address="<replaceable>address</replaceable>[/<replaceable>mask</replaceable>]"|mac="<replaceable>MAC</replaceable>"|ipset="<replaceable>ipset</replaceable>"/> ]

   [ <service name="<replaceable>string</replaceable>"/> ]

-  [ <port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>"/> ]

+  [ <port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>|<literal>sctp</literal>|<literal>dccp</literal>"/> ]

   [ <protcol value="<replaceable>protocol</replaceable>"/> ]

   [ <icmp-block name="<replaceable>string</replaceable>"/> ]

   [ <icmp-block-inversion/> ]

   [ <masquerade/> ]

-  [ <forward-port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>" [to-port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]"] [to-addr="<replaceable>ipv4address</replaceable>"]/> ]

-  [ <source-port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>"/> ]

+  [ <forward-port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>|<literal>sctp</literal>|<literal>dccp</literal>" [to-port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]"] [to-addr="<replaceable>ipv4address</replaceable>"]/> ]

+  [ <source-port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>|<literal>sctp</literal>|<literal>dccp</literal>"/> ]

   [

     <rule [family="<literal>ipv4</literal>|<literal>ipv6</literal>"]>

     [ <source address="<replaceable>address</replaceable>[/<replaceable>mask</replaceable>]"|mac="<replaceable>MAC</replaceable>"|ipset="<replaceable>ipset</replaceable>" [invert="<replaceable>True</replaceable>"]/> ]

     [ <destination address="<replaceable>address</replaceable>[/<replaceable>mask</replaceable>]" [invert="<replaceable>True</replaceable>"]/> ]

     [

       <service name="<replaceable>string</replaceable>"/> |

-      <port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>"/> |

+      <port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>|<literal>sctp</literal>|<literal>dccp</literal>"/> |

       <protocol value="<replaceable>protocol</replaceable>"/> |

       <icmp-block name="<replaceable>icmptype</replaceable>"/> |

       <masquerade/> |

-      <forward-port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>" [to-port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]"] [to-addr="<replaceable>address</replaceable>"]/>

+      <forward-port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>|<literal>sctp</literal>|<literal>dccp</literal>" [to-port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]"] [to-addr="<replaceable>address</replaceable>"]/>

     ]

     [ <log [prefix="<replaceable>prefixtext</replaceable>"] [level="<literal>emerg</literal>|<literal>alert</literal>|<literal>crit</literal>|<literal>err</literal>|<literal>warn</literal>|<literal>notice</literal>|<literal>info</literal>|<literal>debug</literal>"]> [<limit value="<replaceable>rate</replaceable>/<replaceable>duration</replaceable>"/>] </log> ]

     [ <audit> [<limit value="<replaceable>rate</replaceable>/<replaceable>duration</replaceable>"/>] </audit> ]

@@ -248,10 +248,10 @@

 	</varlistentry>

 	<varlistentry>

-	  <term>protocol="<literal>tcp</literal>|<literal>udp</literal>"</term>

+	  <term>protocol="<literal>tcp</literal>|<literal>udp</literal>|<literal>sctp</literal>|<literal>dccp</literal>"</term>

           <listitem>

 	    <para>

-	      The protocol can either be <replaceable>tcp</replaceable> or <replaceable>udp</replaceable>.

+	      The protocol can either be <replaceable>tcp</replaceable>, <option>udp</option>, <option>sctp</option> or <option>dccp</option>.

 	    </para>

 	  </listitem>

 	</varlistentry>

@@ -328,10 +328,10 @@

 	  </varlistentry>

 	  <varlistentry>

-	    <term>protocol="<literal>tcp</literal>|<literal>udp</literal>"</term>

+	    <term>protocol="<literal>tcp</literal>|<literal>udp</literal>|<literal>sctp</literal>|<literal>dccp</literal>"</term>

             <listitem>

 	      <para>

-		The protocol can either be <replaceable>tcp</replaceable> or <replaceable>udp</replaceable>.

+		The protocol can either be <replaceable>tcp</replaceable>, <option>udp</option>, <option>sctp</option> or <option>dccp</option>.

 	      </para>

 	    </listitem>

 	  </varlistentry>

@@ -381,10 +381,10 @@

 	</varlistentry>

 	<varlistentry>

-	  <term>protocol="<literal>tcp</literal>|<literal>udp</literal>"</term>

+	  <term>protocol="<literal>tcp</literal>|<literal>udp</literal>|<literal>sctp</literal>|<literal>dccp</literal>"</term>

           <listitem>

 	    <para>

-	      The protocol can either be <replaceable>tcp</replaceable> or <replaceable>udp</replaceable>.

+	      The protocol can either be <replaceable>tcp</replaceable>, <option>udp</option>, <option>sctp</option> or <option>dccp</option>.

 	    </para>

 	  </listitem>

 	</varlistentry>

@@ -405,12 +405,12 @@

   [ <destination address="<replaceable>address</replaceable>[/<replaceable>mask</replaceable>]" [invert="<replaceable>True</replaceable>"]/> ]

   [

     <service name="<replaceable>string</replaceable>"/> |

-    <port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>"/> |

+    <port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>|<literal>sctp</literal>|<literal>dccp</literal>"/> |

     <protocol value="<replaceable>protocol</replaceable>"/> |

     <icmp-block name="<replaceable>icmptype</replaceable>"/> |

     <masquerade/> |

-    <forward-port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>" [to-port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]"] [to-addr="<replaceable>address</replaceable>"]/> |

-    <source-port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>"/> |

+    <forward-port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>|<literal>sctp</literal>|<literal>dccp</literal>" [to-port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]"] [to-addr="<replaceable>address</replaceable>"]/> |

+    <source-port port="<replaceable>portid</replaceable>[-<replaceable>portid</replaceable>]" protocol="<literal>tcp</literal>|<literal>udp</literal>|<literal>sctp</literal>|<literal>dccp</literal>"/> |

   ]

   [ <log [prefix="<replaceable>prefixtext</replaceable>"] [level="<literal>emerg</literal>|<literal>alert</literal>|<literal>crit</literal>|<literal>err</literal>|<literal>warn</literal>|<literal>notice</literal>|<literal>info</literal>|<literal>debug</literal>"]/> [<limit value="<replaceable>rate</replaceable>/<replaceable>duration</replaceable>"/>] </log> ]

   [ <audit> [<limit value="<replaceable>rate</replaceable>/<replaceable>duration</replaceable>"/>] </audit> ]

diff -up firewalld-0.4.3.2/src/firewall/command.py.support_sctp_and_dccp_rhbz#1429808 firewalld-0.4.3.2/src/firewall/command.py

--- firewalld-0.4.3.2/src/firewall/command.py.support_sctp_and_dccp_rhbz#1429808	2017-04-13 12:23:14.019969107 +0200

+++ firewalld-0.4.3.2/src/firewall/command.py	2017-04-13 12:23:16.782979187 +0200

@@ -261,9 +261,10 @@ class FirewallCommand(object):

                                 "portid[-portid]%sprotocol" % separator)

         if not check_port(port):

             raise FirewallError(errors.INVALID_PORT, port)

-        if proto not in [ "tcp", "udp" ]:

+        if proto not in [ "tcp", "udp", "sctp", "dccp" ]:

             raise FirewallError(errors.INVALID_PROTOCOL,

-                                "'%s' not in {'tcp'|'udp'}" % proto)

+                                "'%s' not in {'tcp'|'udp'|'sctp'|'dccp'}" % \

+                                proto)

         return (port, proto)

     def parse_forward_port(self, value):

@@ -295,9 +296,10 @@ class FirewallCommand(object):

         if not check_port(port):

             raise FirewallError(errors.INVALID_PORT, port)

-        if protocol not in [ "tcp", "udp" ]:

+        if protocol not in [ "tcp", "udp", "sctp", "dccp" ]:

             raise FirewallError(errors.INVALID_PROTOCOL,

-                                "'%s' not in {'tcp'|'udp'}" % protocol)

+                                "'%s' not in {'tcp'|'udp'|'sctp'|'dccp'}" % \

+                                protocol)

         if toport and not check_port(toport):

             raise FirewallError(errors.INVALID_PORT, toport)

         if toaddr and not check_single_address("ipv4", toaddr):

diff -up firewalld-0.4.3.2/src/firewall-config.glade.support_sctp_and_dccp_rhbz#1429808 firewalld-0.4.3.2/src/firewall-config.glade

--- firewalld-0.4.3.2/src/firewall-config.glade.support_sctp_and_dccp_rhbz#1429808	2016-06-29 12:04:52.000000000 +0200

+++ firewalld-0.4.3.2/src/firewall-config.glade	2017-04-13 12:23:16.781979183 +0200

@@ -1144,6 +1144,8 @@

                     <items>

                       <item>tcp</item>

                       <item>udp</item>

+                      <item>sctp</item>

+                      <item>dccp</item>

                     </items>

                     <signal name="changed" handler="onForwardChanged" swapped="no"/>

                   </object>

@@ -8074,6 +8076,8 @@

                     <items>

                       <item>tcp</item>

                       <item>udp</item>

+                      <item>sctp</item>

+                      <item>dccp</item>

                     </items>

                     <signal name="changed" handler="onPortChanged" swapped="no"/>

                   </object>

@@ -8475,6 +8479,7 @@

                       <item translatable="yes">- Select -</item>

                       <item>ah</item>

                       <item>esp</item>

+                      <item>dccp</item>

                       <item>ddp</item>

                       <item>icmp</item>

                       <item>igmp</item>

diff -up firewalld-0.4.3.2/src/firewall/core/fw.py.support_sctp_and_dccp_rhbz#1429808 firewalld-0.4.3.2/src/firewall/core/fw.py

--- firewalld-0.4.3.2/src/firewall/core/fw.py.support_sctp_and_dccp_rhbz#1429808	2017-04-13 12:23:14.022969118 +0200

+++ firewalld-0.4.3.2/src/firewall/core/fw.py	2017-04-13 12:23:16.782979187 +0200

@@ -915,9 +915,10 @@ class Firewall(object):

     def check_tcpudp(self, protocol):

         if not protocol:

             raise FirewallError(errors.MISSING_PROTOCOL)

-        if protocol not in [ "tcp", "udp" ]:

+        if protocol not in [ "tcp", "udp", "sctp", "dccp" ]:

             raise FirewallError(errors.INVALID_PROTOCOL,

-                                "'%s' not in {'tcp'|'udp'}" % protocol)

+                                "'%s' not in {'tcp'|'udp'|'sctp'|'dccp'}" % \

+                                protocol)

     def check_ip(self, ip):

         if not functions.checkIP(ip):

diff -up firewalld-0.4.3.2/src/firewall/core/fw_test.py.support_sctp_and_dccp_rhbz#1429808 firewalld-0.4.3.2/src/firewall/core/fw_test.py

--- firewalld-0.4.3.2/src/firewall/core/fw_test.py.support_sctp_and_dccp_rhbz#1429808	2016-04-19 16:36:12.000000000 +0200

+++ firewalld-0.4.3.2/src/firewall/core/fw_test.py	2017-04-13 12:23:16.783979190 +0200

@@ -421,9 +421,10 @@ class Firewall_test(object):

     def check_tcpudp(self, protocol):

         if not protocol:

             raise FirewallError(errors.MISSING_PROTOCOL)

-        if not protocol in [ "tcp", "udp" ]:

+        if not protocol in [ "tcp", "udp", "sctp", "dccp" ]:

             raise FirewallError(errors.INVALID_PROTOCOL,

-                                "'%s' not in {'tcp'|'udp'}" % protocol)

+                                "'%s' not in {'tcp'|'udp'|'sctp'|'dccp'}" % \

+                                protocol)

     def check_ip(self, ip):

         if not functions.checkIP(ip):

diff -up firewalld-0.4.3.2/src/firewall/core/io/io_object.py.support_sctp_and_dccp_rhbz#1429808 firewalld-0.4.3.2/src/firewall/core/io/io_object.py

--- firewalld-0.4.3.2/src/firewall/core/io/io_object.py.support_sctp_and_dccp_rhbz#1429808	2016-05-30 00:02:39.000000000 +0200

+++ firewalld-0.4.3.2/src/firewall/core/io/io_object.py	2017-04-13 12:23:16.783979190 +0200

@@ -285,9 +285,10 @@ def check_port(port):

                             "'%s' is invalid port range" % port)

 def check_tcpudp(protocol):

-    if protocol not in [ "tcp", "udp" ]:

+    if protocol not in [ "tcp", "udp", "sctp", "dccp" ]:

         raise FirewallError(errors.INVALID_PROTOCOL,

-                            "'%s' not from {'tcp'|'udp'}" % protocol)

+                            "'%s' not from {'tcp'|'udp'|'sctp'|'dccp'}" % \

+                            protocol)

 def check_protocol(protocol):

     if not functions.checkProtocol(protocol):

diff -up firewalld-0.4.3.2/src/firewall/core/rich.py.support_sctp_and_dccp_rhbz#1429808 firewalld-0.4.3.2/src/firewall/core/rich.py

--- firewalld-0.4.3.2/src/firewall/core/rich.py.support_sctp_and_dccp_rhbz#1429808	2016-05-19 17:30:27.000000000 +0200

+++ firewalld-0.4.3.2/src/firewall/core/rich.py	2017-04-13 12:23:16.783979190 +0200

@@ -561,7 +561,7 @@ class Rich_Rule(object):

         elif type(self.element) == Rich_Port:

             if not functions.check_port(self.element.port):

                 raise FirewallError(errors.INVALID_PORT, self.element.port)

-            if self.element.protocol not in [ "tcp", "udp" ]:

+            if self.element.protocol not in [ "tcp", "udp", "sctp", "dccp" ]:

                 raise FirewallError(errors.INVALID_PROTOCOL, self.element.protocol)

         # protocol

@@ -589,7 +589,7 @@ class Rich_Rule(object):

         elif type(self.element) == Rich_ForwardPort:

             if not functions.check_port(self.element.port):

                 raise FirewallError(errors.INVALID_PORT, self.element.port)

-            if self.element.protocol not in [ "tcp", "udp" ]:

+            if self.element.protocol not in [ "tcp", "udp", "sctp", "dccp" ]:

                 raise FirewallError(errors.INVALID_PROTOCOL, self.element.protocol)

             if self.element.to_port == "" and self.element.to_address == "":

                 raise FirewallError(errors.INVALID_PORT, self.element.to_port)

@@ -609,7 +609,7 @@ class Rich_Rule(object):

         elif type(self.element) == Rich_SourcePort:

             if not functions.check_port(self.element.port):

                 raise FirewallError(errors.INVALID_PORT, self.element.port)

-            if self.element.protocol not in [ "tcp", "udp" ]:

+            if self.element.protocol not in [ "tcp", "udp", "sctp", "dccp" ]:

                 raise FirewallError(errors.INVALID_PROTOCOL, self.element.protocol)

         # other element and not empty?

diff -up firewalld-0.4.3.2/src/tests/firewall-cmd_test.sh.support_sctp_and_dccp_rhbz#1429808 firewalld-0.4.3.2/src/tests/firewall-cmd_test.sh

--- firewalld-0.4.3.2/src/tests/firewall-cmd_test.sh.support_sctp_and_dccp_rhbz#1429808	2017-04-13 12:23:14.015969093 +0200

+++ firewalld-0.4.3.2/src/tests/firewall-cmd_test.sh	2017-04-13 12:23:16.784979194 +0200

@@ -339,6 +339,15 @@ assert_good " --query-port=111-222/udp -

 assert_good "--remove-port 111-222/udp"

 assert_bad  " --query-port=111-222/udp"

+assert_good "   --add-port=5000/sctp"

+assert_good " --query-port=5000/sctp --zone=${default_zone}"

+assert_good "--remove-port 5000/sctp"

+assert_bad  " --query-port=5000/sctp"

+assert_good "   --add-port=222/dccp"

+assert_good " --query-port=222/dccp --zone=${default_zone}"

+assert_good "--remove-port 222/dccp"

+assert_bad  " --query-port=222/dccp"

+

 assert_bad  "--permanent    --add-port=666" # no protocol

 assert_bad  "--permanent    --add-port=666/dummy" # bad protocol

 assert_good "--permanent    --add-port=666/tcp"

@@ -348,6 +357,15 @@ assert_good "--permanent  --query-port=1

 assert_good "--permanent --remove-port 111-222/udp"

 assert_bad  "--permanent  --query-port=111-222/udp"

+assert_good "--permanent    --add-port=5000/sctp"

+assert_good "--permanent  --query-port=5000/sctp --zone=${default_zone}"

+assert_good "--permanent --remove-port 5000/sctp"

+assert_bad  "--permanent  --query-port=5000/sctp"

+assert_good "--permanent    --add-port=222/dccp"

+assert_good "--permanent  --query-port=222/dccp --zone=${default_zone}"

+assert_good "--permanent --remove-port 222/dccp"

+assert_bad  "--permanent  --query-port=222/dccp"

+

 assert_good "   --add-port=80/tcp --add-port 443-444/udp"

 assert_good " --query-port=80/tcp --zone=${default_zone}"

 assert_good " --query-port=443-444/udp"

@@ -488,6 +506,10 @@ assert_good "   --add-forward-port=port=

 assert_good " --query-forward-port port=55:proto=tcp:toport=66:toaddr=7.7.7.7 --zone=${default_zone}"

 assert_good "--remove-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

 assert_bad  " --query-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

+assert_good "   --add-forward-port=port=66:proto=sctp:toport=66:toaddr=7.7.7.7"

+assert_good " --query-forward-port port=66:proto=sctp:toport=66:toaddr=7.7.7.7 --zone=${default_zone}"

+assert_good "--remove-forward-port=port=66:proto=sctp:toport=66:toaddr=7.7.7.7"

+assert_bad  " --query-forward-port=port=66:proto=sctp:toport=66:toaddr=7.7.7.7"

 assert_bad  "--permanent         --add-forward-port=666" # no protocol

 assert_good "--permanent    --add-forward-port=port=11:proto=tcp:toport=22 --zone=${default_zone}"

@@ -499,6 +521,10 @@ assert_good "--permanent    --add-forwar

 assert_good "--permanent  --query-forward-port port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

 assert_good "--permanent --remove-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

 assert_bad  "--permanent  --query-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

+assert_good "--permanent    --add-forward-port=port=66:proto=sctp:toport=66:toaddr=7.7.7.7"

+assert_good "--permanent  --query-forward-port port=66:proto=sctp:toport=66:toaddr=7.7.7.7 --zone=${default_zone}"

+assert_good "--permanent --remove-forward-port=port=66:proto=sctp:toport=66:toaddr=7.7.7.7"

+assert_bad  "--permanent  --query-forward-port=port=66:proto=sctp:toport=66:toaddr=7.7.7.7"

 assert_good "   --add-forward-port=port=88:proto=udp:toport=99 --add-forward-port port=100:proto=tcp:toport=200"

 assert_good " --query-forward-port=port=100:proto=tcp:toport=200"

@@ -598,6 +624,18 @@ assert_good "--permanent --icmptype=${my

 assert_good "--permanent --icmptype=${myicmp} --remove-destination=ipv4"

 assert_bad "--permanent --icmptype=${myicmp} --query-destination=ipv4"

+# test sctp and dccp ports

+assert_good "--permanent --service=${myservice} --add-port=666/sctp"

+assert_good "--permanent --service=${myservice} --remove-port=666/sctp"

+assert_good "--permanent --service=${myservice} --remove-port 666/sctp"

+assert_bad  "--permanent --service=${myservice} --query-port=666/sctp"

+assert_good "--permanent --service=${myservice} --add-port=999/dccp"

+assert_good "--permanent --service=${myservice} --remove-port=999/dccp"

+assert_good "--permanent --service=${myservice} --remove-port 999/dccp"

+assert_bad  "--permanent --service=${myservice} --query-port=999/dccp"

+assert_good "--permanent --service=${myservice} --add-port=666/sctp"

+assert_good "--permanent --service=${myservice} --add-port=999/dccp"

+

 # add them to zone

 assert_good "--permanent --zone=${myzone} --add-service=${myservice}"

 assert_good "--permanent --zone=${myzone} --add-icmp-block=${myicmp}"

@@ -886,7 +924,9 @@ good_rules=(

  'rule family="ipv4" source address="192.168.1.0/24" masquerade'

  'rule family="ipv4" destination address="192.168.1.0/24" masquerade' # masquerade & destination

  'rule family="ipv6" masquerade'

- 'rule forward-port port="2222" to-port="22" to-addr="192.168.100.2" protocol="tcp" family="ipv4" source address="192.168.2.100"')

+ 'rule forward-port port="2222" to-port="22" to-addr="192.168.100.2" protocol="tcp" family="ipv4" source address="192.168.2.100"'

+ 'rule forward-port port="66" to-port="666" to-addr="192.168.100.2" protocol="sctp" family="ipv4" source address="192.168.2.100"'

+ 'rule forward-port port="99" to-port="999" to-addr="1::2:3:4:7" protocol="dccp" family="ipv6" source address="1:2:3:4:6::"')

 for (( i=0;i<${#good_rules[@]};i++)); do

   rule=${good_rules[${i}]}

diff -up firewalld-0.4.3.2/src/tests/firewall-offline-cmd_test.sh.support_sctp_and_dccp_rhbz#1429808 firewalld-0.4.3.2/src/tests/firewall-offline-cmd_test.sh

--- firewalld-0.4.3.2/src/tests/firewall-offline-cmd_test.sh.support_sctp_and_dccp_rhbz#1429808	2017-04-13 12:23:14.015969093 +0200

+++ firewalld-0.4.3.2/src/tests/firewall-offline-cmd_test.sh	2017-04-13 12:23:16.784979194 +0200

@@ -332,6 +332,15 @@ assert_good " --query-port=111-222/udp -

 assert_good "--remove-port 111-222/udp"

 assert_bad  " --query-port=111-222/udp"

+assert_good "   --add-port=5000/sctp"

+assert_good " --query-port=5000/sctp --zone=${default_zone}"

+assert_good "--remove-port 5000/sctp"

+assert_bad  " --query-port=5000/sctp"

+assert_good "   --add-port=222/dccp"

+assert_good " --query-port=222/dccp --zone=${default_zone}"

+assert_good "--remove-port 222/dccp"

+assert_bad  " --query-port=222/dccp"

+

 assert_good "   --add-port=80/tcp --add-port 443-444/udp"

 assert_good " --query-port=80/tcp --zone=${default_zone}"

 assert_good " --query-port=443-444/udp"

@@ -409,6 +418,10 @@ assert_good "   --add-forward-port=port=

 assert_good " --query-forward-port port=55:proto=tcp:toport=66:toaddr=7.7.7.7 --zone=${default_zone}"

 assert_good "--remove-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

 assert_bad  " --query-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

+assert_good "   --add-forward-port=port=66:proto=sctp:toport=66:toaddr=7.7.7.7"

+assert_good " --query-forward-port port=66:proto=sctp:toport=66:toaddr=7.7.7.7 --zone=${default_zone}"

+assert_good "--remove-forward-port=port=66:proto=sctp:toport=66:toaddr=7.7.7.7"

+assert_bad  " --query-forward-port=port=66:proto=sctp:toport=66:toaddr=7.7.7.7"

 assert_good "   --add-forward-port=port=88:proto=udp:toport=99 --add-forward-port port=100:proto=tcp:toport=200"

 assert_good " --query-forward-port=port=100:proto=tcp:toport=200"

@@ -495,6 +508,18 @@ assert_good "--icmptype=${myicmp} --quer

 assert_good "--icmptype=${myicmp} --remove-destination=ipv4"

 assert_bad "--icmptype=${myicmp} --query-destination=ipv4"

+# test sctp and dccp ports

+assert_good "--service=${myservice} --add-port=666/sctp"

+assert_good "--service=${myservice} --remove-port=666/sctp"

+assert_good "--service=${myservice} --remove-port 666/sctp"

+assert_bad  "--service=${myservice} --query-port=666/sctp"

+assert_good "--service=${myservice} --add-port=999/dccp"

+assert_good "--service=${myservice} --remove-port=999/dccp"

+assert_good "--service=${myservice} --remove-port 999/dccp"

+assert_bad  "--service=${myservice} --query-port=999/dccp"

+assert_good "--service=${myservice} --add-port=666/sctp"

+assert_good "--service=${myservice} --add-port=999/dccp"

+

 # add them to zone

 assert_good "--zone=${myzone} --add-service=${myservice}"

 assert_good "--zone=${myzone} --add-icmp-block=${myicmp}"

@@ -668,7 +693,9 @@ good_rules=(

  'rule family="ipv6" source address="1:2:3:4:6::" icmp-block name="redirect" log prefix="redirect" level="info" limit value="4/m"'

  'rule family="ipv4" source address="192.168.1.0/24" masquerade'

  'rule family="ipv6" masquerade'

- 'rule forward-port port="2222" to-port="22" to-addr="192.168.100.2" protocol="tcp" family="ipv4" source address="192.168.2.100"')

+ 'rule forward-port port="2222" to-port="22" to-addr="192.168.100.2" protocol="tcp" family="ipv4" source address="192.168.2.100"'

+ 'rule forward-port port="66" to-port="666" to-addr="192.168.100.2" protocol="sctp" family="ipv4" source address="192.168.2.100"'

+ 'rule forward-port port="99" to-port="999" to-addr="1::2:3:4:7" protocol="dccp" family="ipv6" source address="1:2:3:4:6::"')

 for (( i=0;i<${#good_rules[@]};i++)); do

   rule=${good_rules[${i}]}