modules.iptables optimistically tries to read /etc/sysconfig/iptables

https://github.com/saltstack/salt/blob/705e8cca0b9ad6441c3884e76798cac1ff7859d7/salt/modules/iptables.py#L977-L994

If modules.iptables.get_saved_rules() is called without an explicit dump file path (generated by iptables -S or iptables-save), then it assumes the default OS' iptables config path and tries to read it, but does not handle the case where that file doesn't exist.

All this happens at the top of modules.iptables._parse_conf().

Here's the unhandled exception when this happens:

sys-firewall:
  ----------
            ID: QBS-FORWARD-exists
      Function: iptables.chain_present
          Name: QBS-FORWARD
        Result: True
       Comment: iptables QBS-FORWARD chain is already exist in filter table for ipv4
       Started: 12:39:56.244931
      Duration: 6.656 ms
       Changes:   
  ----------
            ID: set-downstream-mtu
      Function: iptables.insert
        Result: False
       Comment: An exception occurred in this state: Traceback (most recent call last):
                  File /var/tmp/.root_62a99a_salt/pyall/salt/state.py, line 1933, in call
                    **cdata['kwargs'])
                  File /var/tmp/.root_62a99a_salt/pyall/salt/loader.py, line 1939, in wrapper
                    return f(*args, **kwargs)
                  File /var/tmp/.root_62a99a_salt/pyall/salt/states/iptables.py, line 573, in insert
                    saved_rules = __salt__['iptables.get_saved_rules'](family=family)
                  File /var/tmp/.root_62a99a_salt/pyall/salt/modules/iptables.py, line 561, in get_saved_rules
                    return _parse_conf(conf_file=conf_file, family=family)
                  File /var/tmp/.root_62a99a_salt/pyall/salt/modules/iptables.py, line 990, in _parse_conf
                    with salt.utils.files.fopen(conf_file, 'r') as ifile:
                  File /var/tmp/.root_62a99a_salt/pyall/salt/utils/files.py, line 399, in fopen
                    f_handle = open(*args, **kwargs)  # pylint: disable=resource-leakage
                IOError: [Errno 2] No such file or directory: u'/etc/sysconfig/iptables'
       Started: 12:39:56.252038
      Duration: 14.878 ms
       Changes:   

And the state that triggers it:

QBS-FORWARD-exists:
  iptables.chain_present:
    - name: QBS-FORWARD

set-downstream-mtu:
  iptables.insert:
    - chain: QBS-FORWARD
    - position: 1
    - protocol: tcp
    - match: tcp
    - tcp-flags: SYN,RST SYN
    - jump: TCPMSS
    - set-mss: 1320
    - save: True
    - require:
      - iptables: QBS-FORWARD-exists

The target minion (sys-firewall) indeed doesn't have anything at /etc/sysconfig/iptables

I have a fix for this, just need to fork and send PR.

Start in salt/modules/iptables.py at get_saved_rules() and _parse_conf(), then reproduce the missing /etc/sysconfig/iptables case using the iptables.insert state shown in the report. Done means the absent default configuration file no longer produces an unhandled IOError when saved rules are requested.