iptables: setting chain policy is not idempotent

[valentin-krasontovitsch]

ISSUE TYPE

• Bug Report

COMPONENT NAME

iptables

ANSIBLE VERSION

ansible 2.3.0.0
  config file = /Users/valkra/code/ansible-config/ansible.cfg
  configured module search path = Default w/o overrides
  python version = 2.7.13 (default, Dec 18 2016, 07:03:39) \
    [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.42.1)]

CONFIGURATION

OS / ENVIRONMENT

Running ansible on MacOS Sierra 12.12.3 (probably irrelevant), and managing Ubuntu 16.04 (kernel: 4.4.0-62-generic)

SUMMARY

Using the iptables module to set policies on built in chains always returns changed, is hence not idempotent.

STEPS TO REPRODUCE

Run the following playbook twice on any host with iptables, substituting the hostname appropriately.

---
- hosts: myhost.local
  tasks:
  - name: set output policy to accept
    iptables:
      chain: OUTPUT
      policy: ACCEPT
    become: yes

EXPECTED RESULTS

Should report OK at least on the second run.

ACTUAL RESULTS

PLAY [myhost.local] ***********************

TASK [Gathering Facts] *********************
ok: [myhost.local]

TASK [set output policy to accept] ***********************
changed: [myhost.local]

PLAY RECAP *****************
myhost.local         : ok=2    changed=1    unreachable=0    failed=0

[ansibot]

cc @LinusU
click here for bot help

[valentin-krasontovitsch]

Trying to fix this, I see in the code that the existence of a rule is checked using

iptables -C

which let's one check if a rule exists in a given table and chain.

As far as I can tell, there is no such option for checking the policy of a given chain.

One way I see is using something like

iptables -S $CHAIN

which returns a list of all rules, including

-P INPUT DROP

which could be grepped and cut. All in all, something along the lines of

iptables -S $CHAIN | grep -e '-P' | cut -f 3 -d ' '

or perhaps implementing the last step in python.

I'm not sure how brittle this is, and how accepted such bash hacking is in an ansible module though. Would appreciate some feedback on that.

[sebastiendarocha]

Didn't reproduce on 2.5.0.0

fixed by 4c72e98

test: modules/system/test_iptables : test_policy_table_no_change

@mscherer could you close this ?