Repository: openshift/openshift-ansible

Issue:
[BUG] iptable insert 
The following doesn't appear to handle a situation where the last rule in the INPUT chain is a DROP and we've witnessed behavior where the installer is appending the etcd 8443 rule after the DROP. 

"os_firewall_manage_iptables.py" line 155 of 273

```
            # Naively assume that if the last row is a REJECT rule, then
            # we can add insert our rule right before it, otherwise we
            # assume that we can just append the rule.
            if (last_rule_num and last_rule_target
                    and last_rule_target == 'REJECT'):
                # insert rule
                cmd = self.cmd + ['-I', self.jump_rule_chain,
                                  str(last_rule_num)]
            else:
                # append rule
                cmd = self.cmd + ['-A', self.jump_rule_chain]
```

Suggested Fix

```
           # Naively assume that if the last row is a REJECT rule, then
            # we can add insert our rule right before it, otherwise we
            # assume that we can just append the rule.
            if (last_rule_num and last_rule_target
                    and ( last_rule_target == 'REJECT' || last_rule_target == 'DROP')):
                # insert rule
                cmd = self.cmd + ['-I', self.jump_rule_chain,
                                  str(last_rule_num)]
            else:
                # append rule
                cmd = self.cmd + ['-A', self.jump_rule_chain]
            cmd += ['-j', self.chain]
```



Discussion:

Resolving patch:
diff --git a/roles/os_firewall/library/os_firewall_manage_iptables.py b/roles/os_firewall/library/os_firewall_manage_iptables.py
--- a/roles/os_firewall/library/os_firewall_manage_iptables.py
+++ b/roles/os_firewall/library/os_firewall_manage_iptables.py
@@ -37,14 +37,14 @@ class IpTablesSaveError(IpTablesError):
 
 
 class IpTablesCreateChainError(IpTablesError):
-    def __init__(self, chain, msg, cmd, exit_code, output): # pylint: disable=too-many-arguments, line-too-long
+    def __init__(self, chain, msg, cmd, exit_code, output): # pylint: disable=too-many-arguments, line-too-long, redefined-outer-name
         super(IpTablesCreateChainError, self).__init__(msg, cmd, exit_code,
                                                        output)
         self.chain = chain
 
 
 class IpTablesCreateJumpRuleError(IpTablesError):
-    def __init__(self, chain, msg, cmd, exit_code, output): # pylint: disable=too-many-arguments, line-too-long
+    def __init__(self, chain, msg, cmd, exit_code, output): # pylint: disable=too-many-arguments, line-too-long, redefined-outer-name
         super(IpTablesCreateJumpRuleError, self).__init__(msg, cmd, exit_code,
                                                           output)
         self.chain = chain
@@ -152,11 +152,11 @@ def create_jump(self):
                             continue
                         last_rule_target = rule[1]
 
-                # Naively assume that if the last row is a REJECT rule, then
-                # we can add insert our rule right before it, otherwise we
+                # Naively assume that if the last row is a REJECT or DROP rule,
+                # then we can insert our rule right before it, otherwise we
                 # assume that we can just append the rule.
                 if (last_rule_num and last_rule_target
-                        and last_rule_target == 'REJECT'):
+                        and last_rule_target in ['REJECT', 'DROP']):
                     # insert rule
                     cmd = self.cmd + ['-I', self.jump_rule_chain,
                                       str(last_rule_num)]


Test patch: