Skip to content

Commit

Permalink
firewalld_zone: Fix failure creating new zone
Browse files Browse the repository at this point in the history
Possibly due to a change in recent firewalld versions, creating a new
zone fails with:

> Debug: Firewalld_zone[test3](provider=firewall_cmd): Creating new zone test3 with target: ''
> Debug: Puppet::Type::Firewalld_zone::ProviderFirewall_cmd: Executing --state command - current value
> Debug: Executing: '/usr/sbin/firewall-cmd --state'
> Debug: Executing: '/usr/sbin/firewall-offline-cmd --new-zone test3'
> Debug: Puppet::Type::Firewalld_zone::ProviderFirewall_cmd: Executing --state command - current value
> Debug: Executing: '/usr/sbin/firewall-cmd --state'
> Debug: Executing: '/usr/sbin/firewall-offline-cmd --zone test3 --list-interfaces'
> Debug: Firewalld_zone[test3](provider=firewall_cmd): removing icmp block inversion for zone test3
> Debug: Puppet::Type::Firewalld_zone::ProviderFirewall_cmd: Executing --state command - current value
> Debug: Executing: '/usr/sbin/firewall-cmd --state'
> Debug: Executing: '/usr/sbin/firewall-offline-cmd --zone test3 --remove-icmp-block-inversion'
> Error: Execution of '/usr/sbin/firewall-offline-cmd --zone test3 --remove-icmp-block-inversion' returned 12:
> Error: /Stage[main]/Main/Firewalld_zone[test3]/ensure: change from 'absent' to 'present' failed: Execution of '/usr/sbin/firewall-offline-cmd --zone test3 --remove-icmp-block-inversion' returned 12:

which seems to be because ICMP block inversion is unset by default:

```
> /usr/sbin/firewall-offline-cmd --zone test3 --remove-icmp-block-inversion
NOT_ENABLED: icmp-block-inversion
> echo $?
12
```

Only manage `icmp_block_inversion` property on new zones if set to
`true`.
  • Loading branch information
jameslikeslinux committed Mar 18, 2024
1 parent 302c22c commit 4ec801f
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion lib/puppet/provider/firewalld_zone/firewall_cmd.rb
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ def create
self.protocols = (@resource[:protocols]) if @resource[:protocols]
self.interfaces = @resource[:interfaces]
self.icmp_blocks = (@resource[:icmp_blocks]) if @resource[:icmp_blocks]
self.icmp_block_inversion = (@resource[:icmp_block_inversion]) if @resource[:icmp_block_inversion]
self.icmp_block_inversion = (@resource[:icmp_block_inversion]) if @resource[:icmp_block_inversion] == :true
self.description = (@resource[:description]) if @resource[:description]
self.short = (@resource[:short]) if @resource[:short]
end
Expand Down

0 comments on commit 4ec801f

Please sign in to comment.