summaryrefslogtreecommitdiffstats
path: root/roles/os_firewall/library
diff options
context:
space:
mode:
authorJason DeTiberus <jdetiber@redhat.com>2015-04-20 22:52:12 -0400
committerJason DeTiberus <jdetiber@redhat.com>2015-04-21 00:03:03 -0400
commit991b232e34f86a6a745bdc34d62b046abd2291e7 (patch)
tree7878cc09c884ddc46cbe4ab8786fd0e1047f7a91 /roles/os_firewall/library
parent96dd0ab929b7f391eee9b23209aa377537114b72 (diff)
downloadopenshift-991b232e34f86a6a745bdc34d62b046abd2291e7.tar.gz
openshift-991b232e34f86a6a745bdc34d62b046abd2291e7.tar.bz2
openshift-991b232e34f86a6a745bdc34d62b046abd2291e7.tar.xz
openshift-991b232e34f86a6a745bdc34d62b046abd2291e7.zip
fixes to better deal with gce image defaults
- remove exception if INPUT rules are not found, gce centos-7 image is stripped of default rules - ignore_errors for systemctl mask operation, fails with permission denied on gce centos-7 image.
Diffstat (limited to 'roles/os_firewall/library')
-rwxr-xr-xroles/os_firewall/library/os_firewall_manage_iptables.py9
1 files changed, 1 insertions, 8 deletions
diff --git a/roles/os_firewall/library/os_firewall_manage_iptables.py b/roles/os_firewall/library/os_firewall_manage_iptables.py
index 9d0af497d..987cc6fc2 100755
--- a/roles/os_firewall/library/os_firewall_manage_iptables.py
+++ b/roles/os_firewall/library/os_firewall_manage_iptables.py
@@ -150,17 +150,10 @@ class IpTablesManager:
continue
last_rule_target = rule[1]
- # Raise an exception if we do not find a valid rule
- if not last_rule_num or not last_rule_target:
- raise IpTablesCreateJumpRuleError(
- chain=self.chain,
- msg="Failed to find existing %s rules" % self.jump_rule_chain,
- cmd=None, exit_code=None, output=None)
-
# Naively assume that if the last row is a REJECT rule, then
# we can add insert our rule right before it, otherwise we
# assume that we can just append the rule.
- if last_rule_target == 'REJECT':
+ if last_rule_num and last_rule_target and last_rule_target == 'REJECT':
# insert rule
cmd = self.cmd + ['-I', self.jump_rule_chain, str(last_rule_num)]
else: