Add compatibility with netfilter backend #30
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
On systems using netfilter, nftables should not be installed, on systems using the new nftables backend, nftables and the nft command have to be installed.
andrewkroh
reviewed
Jul 6, 2020
| if table_names: | ||
| return table_names.splitlines() | ||
| else: | ||
| return self.TABLES | ||
|
|
There was a problem hiding this comment.
Suggested change
| return [] |
I think a catch-all return [] might be needed. I saw this error on a fresh Debian 10 system.
Traceback (most recent call last):
File "/tmp/.ansible-root/tmp/ansible-tmp-1594066148.433582-31501-31867424992637/AnsiballZ_iptables_raw.py", line 102, in <module>
_ansiballz_main()
File "/tmp/.ansible-root/tmp/ansible-tmp-1594066148.433582-31501-31867424992637/AnsiballZ_iptables_raw.py", line 94, in _ansiballz_main
invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)
File "/tmp/.ansible-root/tmp/ansible-tmp-1594066148.433582-31501-31867424992637/AnsiballZ_iptables_raw.py", line 40, in invoke_module
runpy.run_module(mod_name='ansible.modules.iptables_raw', init_globals=None, run_name='__main__', alter_sys=True)
File "/usr/lib/python2.7/runpy.py", line 188, in run_module
fname, loader, pkg_name)
File "/usr/lib/python2.7/runpy.py", line 82, in _run_module_code
mod_name, mod_fname, mod_loader, pkg_name)
File "/usr/lib/python2.7/runpy.py", line 72, in _run_code
exec code in run_globals
File "/tmp/ansible_iptables_raw_payload_nhVmBN/ansible_iptables_raw_payload.zip/ansible/modules/iptables_raw.py", line 1125, in <module>
File "/tmp/ansible_iptables_raw_payload_nhVmBN/ansible_iptables_raw_payload.zip/ansible/modules/iptables_raw.py", line 1017, in main
File "/tmp/ansible_iptables_raw_payload_nhVmBN/ansible_iptables_raw_payload.zip/ansible/modules/iptables_raw.py", line 311, in __init__
File "/tmp/ansible_iptables_raw_payload_nhVmBN/ansible_iptables_raw_payload.zip/ansible/modules/iptables_raw.py", line 567, in _refresh_active_rules
File "/tmp/ansible_iptables_raw_payload_nhVmBN/ansible_iptables_raw_payload.zip/ansible/modules/iptables_raw.py", line 582, in _get_system_active_rules
TypeError: argument of type 'NoneType' is not iterable
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Compatibility with newer distros like CentOS 8 and debian buster.
Not waterproof but if the nft command is available, nft list tables is used instead of /proc/net/ip[6]_tables_names
On systems using netfilter as backend the nft command must not be available because it returns an empty list of active tables, just like the /proc/net/ip_tables_names does on systems using nftables.