I'm trying to add an iptables rule that uses the fragment option, and I
cannot work out how to get it working using Ansible's iptables module.
Here's my task:
- name: drop fragmented packets
iptables:
jump: DROP
chain: INPUT
fragment: True
action: append
state: present
When I run this it fails with the following error:
FAILED! => {"changed": false, "cmd": "/sbin/iptables -t filter -A INPUT -j
DROP -f True", "msg": "Bad argument `True'\nTry `iptables -h' or 'iptables
--help' for more information.", "rc": 2, "stderr": "Bad argument
`True'\nTry `iptables -h' or 'iptables --help' for more information.\n",
"stderr_lines": ["Bad argument `True'", "Try `iptables -h' or 'iptables
--help' for more information."], "stdout": "", "stdout_lines": []}
So it's trying to add the 'True' as an parameter to the '-f' flag in the
iptables command.
I tried again, this time removing the 'True' from the fragment option:
- name: drop fragmented packets
iptables:
jump: DROP
chain: INPUT
fragment:
action: append
state: present
This time it just adds the rule *without* the '-f' option to iptables, so
the rule just drops everything - obviously not the behaviour I want.
So I looked at the module's code and saw that it expects a string, so next
I tried the following:
- name: drop fragmented packets
iptables:
jump: DROP
chain: INPUT
fragment: ''
action: append
state: present
This time, it fails with the following error:
FAILED! => {"changed": false, "module_stderr": "Traceback (most recent call
last):\n File \"master:/root/mitogen/ansible_mitogen/runner.py\", line
883, in _run\n self._run_code(code, mod)\n File
\"master:/root/mitogen/ansible_mitogen/runner.py\", line 862, in
_run_code\n exec('exec code in vars(mod)')\n File \"<string>\", line 1,
in <module>\n File
\"master:/usr/local/ansible/lib/ansible/modules/system/iptables.py\", line
634, in <module>\n File
\"master:/usr/local/ansible/lib/ansible/modules/system/iptables.py\", line
581, in main\n File
\"master:/usr/local/ansible/lib/ansible/modules/system/iptables.py\", line
434, in construct_rule\n File
\"master:/usr/local/ansible/lib/ansible/modules/system/iptables.py\", line
386, in append_param\nIndexError: string index out of range\n",
"module_stdout": "", "msg": "MODULE FAILURE", "rc": 1}
The problem in this case is that the code is using the first character of
the parameter to check for the negation/! option for the -f flag in
iptables, so it fails due to the empty string.
How do I use the fragment option correctly?
Thanks,
Guy
--
<http://www.bluebatgames.com>
Guy Knights • Senior Systems Engineer
c: 778-996-2687p: 778-379-5120
<https://www.facebook.com/BlueBatGames/>
<https://www.linkedin.com/company/bluebat-games>
<https://twitter.com/BlueBatGames> <http://www.bluebatgames.com>
--
You received this message because you are subscribed to the Google Groups
"Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/ansible-project/CAFtmDk-R_asYNe24Uj0bnn0%2BieT99MukaE%2BAaCQBVbAzKVutGg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.
