saltstack / saltstack/salt

[BUG] in iptables.append parameter "icmp-type" always add new line

Open
#56,706 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug severity-low State-Module
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
In state iptables.append parameter "icmp-type" cause problem, it always add same rule even it already exists.

Steps to Reproduce the behavior
test.sls:

Work_OK:
  iptables.append:
    - comment: 'Only one line'
    - chain: 'OUTPUT'
    - save: False
    - protocol: 'icmp'
    - match: 'state'
    - connstate: 'ESTABLISHED,RELATED,NEW'
    - jump: 'ACCEPT'

Always_add_new:
  iptables.append:
    - comment: 'Add new line'
    - chain: 'OUTPUT'
    - save: False
    - protocol: 'icmp'
    - match: 'state'
    - connstate: 'ESTABLISHED,RELATED,NEW'
    - jump: 'ACCEPT'
   {# problem #}
    - 'icmp-type': '0'

On minion run:

root@eeebox1test:~# iptables -F


root@eeebox1test:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination


root@eeebox1test:~# salt-call -l debug state.apply iptables.test
[DEBUG   ] Reading configuration from /etc/salt/minion
[DEBUG   ] Including configuration from '/etc/salt/minion.d/_schedule.conf'
[DEBUG   ] Reading configuration from /etc/salt/minion.d/_schedule.conf
[DEBUG   ] Including configuration from '/etc/salt/minion.d/master.conf'
[DEBUG   ] Reading configuration from /etc/salt/minion.d/master.conf
[DEBUG   ] Using cached minion ID from /etc/salt/minion_id: eeebox1test
[DEBUG   ] Configuration file path: /etc/salt/minion
[WARNING ] Insecure logging configuration detected! Sensitive data may be logged.
[DEBUG   ] Grains refresh requested. Refreshing grains.
[DEBUG   ] Reading configuration from /etc/salt/minion
[DEBUG   ] Including configuration from '/etc/salt/minion.d/_schedule.conf'
[DEBUG   ] Reading configuration from /etc/salt/minion.d/_schedule.conf
[DEBUG   ] Including configuration from '/etc/salt/minion.d/master.conf'
[DEBUG   ] Reading configuration from /etc/salt/minion.d/master.conf
[DEBUG   ] LazyLoaded zfs.is_supported
[DEBUG   ] Connecting to master. Attempt 1 of 1
[DEBUG   ] Master URI: tcp://192.168.1.10:4506
[DEBUG   ] Initializing new AsyncAuth for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506')
[DEBUG   ] Generated random reconnect delay between '1000ms' and '11000ms' (2033)
[DEBUG   ] Setting zmq_reconnect_ivl to '2033ms'
[DEBUG   ] Setting zmq_reconnect_ivl_max to '11000ms'
[DEBUG   ] Initializing new AsyncZeroMQReqChannel for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506', 'clear')
[DEBUG   ] Connecting the Minion to the Master URI (for the return server): tcp://192.168.1.10:4506
[DEBUG   ] Trying to connect to: tcp://192.168.1.10:4506
[DEBUG   ] salt.crypt.get_rsa_pub_key: Loading public key
[DEBUG   ] Decrypting the current master AES key
[DEBUG   ] salt.crypt.get_rsa_key: Loading private key
[DEBUG   ] salt.crypt._get_key_with_evict: Loading private key
[DEBUG   ] Loaded minion key: /var/lib/salt/pki/minion/minion.pem
[DEBUG   ] salt.crypt.get_rsa_pub_key: Loading public key
[DEBUG   ] Closing AsyncZeroMQReqChannel instance
[DEBUG   ] Connecting the Minion to the Master publish port, using the URI: tcp://192.168.1.10:4505
[DEBUG   ] salt.crypt.get_rsa_key: Loading private key
[DEBUG   ] Loaded minion key: /var/lib/salt/pki/minion/minion.pem
[DEBUG   ] Determining pillar cache
[DEBUG   ] Initializing new AsyncZeroMQReqChannel for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506', 'aes')
[DEBUG   ] Initializing new AsyncAuth for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506')
[DEBUG   ] Connecting the Minion to the Master URI (for the return server): tcp://192.168.1.10:4506
[DEBUG   ] Trying to connect to: tcp://192.168.1.10:4506
[DEBUG   ] salt.crypt.get_rsa_key: Loading private key
[DEBUG   ] Loaded minion key: /var/lib/salt/pki/minion/minion.pem
[DEBUG   ] Closing AsyncZeroMQReqChannel instance
[DEBUG   ] LazyLoaded jinja.render
[DEBUG   ] LazyLoaded yaml.render
[DEBUG   ] LazyLoaded state.apply
[DEBUG   ] LazyLoaded direct_call.execute
[DEBUG   ] LazyLoaded saltutil.is_running
[DEBUG   ] LazyLoaded grains.get
[DEBUG   ] LazyLoaded config.get
[DEBUG   ] key: test, ret: _|-
[DEBUG   ] Initializing new AsyncZeroMQReqChannel for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506', 'aes')
[DEBUG   ] Initializing new AsyncAuth for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506')
[DEBUG   ] Connecting the Minion to the Master URI (for the return server): tcp://192.168.1.10:4506
[DEBUG   ] Trying to connect to: tcp://192.168.1.10:4506
[DEBUG   ] Gathering pillar data for state run
[DEBUG   ] Finished gathering pillar data for state run
[INFO    ] Loading fresh modules for state activity
[DEBUG   ] LazyLoaded jinja.render
[DEBUG   ] LazyLoaded yaml.render
[DEBUG   ] In saltenv 'base', looking at rel_path 'iptables/test.sls' to resolve 'salt://iptables/test.sls'
[DEBUG   ] In saltenv 'base', ** considering ** path '/var/cache/salt/minion/files/base/iptables/test.sls' to resolve 'salt://iptables/test.sls'
[DEBUG   ] compile template: /var/cache/salt/minion/files/base/iptables/test.sls
[DEBUG   ] Jinja search path: ['/var/cache/salt/minion/files/base']
[DEBUG   ] Initializing new AsyncZeroMQReqChannel for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506', 'aes')
[DEBUG   ] Initializing new AsyncAuth for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506')
[DEBUG   ] Connecting the Minion to the Master URI (for the return server): tcp://192.168.1.10:4506
[DEBUG   ] Trying to connect to: tcp://192.168.1.10:4506
[PROFILE ] Time (in seconds) to render '/var/cache/salt/minion/files/base/iptables/test.sls' using 'jinja' renderer: 0.023581981658935547
[DEBUG   ] Rendered data from file: /var/cache/salt/minion/files/base/iptables/test.sls:

Work_OK:
  iptables.append:
    - comment: 'Only one line'
    - chain: 'OUTPUT'
    - save: False
    - protocol: 'icmp'
    - match: 'state'
    - connstate: 'ESTABLISHED,RELATED,NEW'
    - jump: 'ACCEPT'

Always_add_new:
  iptables.append:
    - comment: 'Add new line'
    - chain: 'OUTPUT'
    - save: False
    - protocol: 'icmp'
    - match: 'state'
    - connstate: 'ESTABLISHED,RELATED,NEW'
    - jump: 'ACCEPT'

    - 'icmp-type': '0'



[DEBUG   ] Results of YAML rendering:
OrderedDict([('Work_OK', OrderedDict([('iptables.append', [OrderedDict([('comment', 'Only one line')]), OrderedDict([('chain', 'OUTPUT')]), OrderedDict([('save', False)]), OrderedDict([('protocol', 'icmp')]), OrderedDict([('match', 'state')]), OrderedDict([('connstate', 'ESTABLISHED,RELATED,NEW')]), OrderedDict([('jump', 'ACCEPT')])])])), ('Always_add_new', OrderedDict([('iptables.append', [OrderedDict([('comment', 'Add new line')]), OrderedDict([('chain', 'OUTPUT')]), OrderedDict([('save', False)]), OrderedDict([('protocol', 'icmp')]), OrderedDict([('match', 'state')]), OrderedDict([('connstate', 'ESTABLISHED,RELATED,NEW')]), OrderedDict([('jump', 'ACCEPT')]), OrderedDict([('icmp-type', '0')])])]))])
[PROFILE ] Time (in seconds) to render '/var/cache/salt/minion/files/base/iptables/test.sls' using 'yaml' renderer: 0.0030159950256347656
[DEBUG   ] LazyLoaded config.option
[DEBUG   ] LazyLoaded iptables.version
[DEBUG   ] LazyLoaded iptables.append
[INFO    ] Running state [Work_OK] at time 23:26:32.057331
[INFO    ] Executing state iptables.append for [Work_OK]
[DEBUG   ] LazyLoaded cmd.run
[INFO    ] Executing command '/usr/sbin/iptables --wait -t filter -A OUTPUT -p icmp -m state --state ESTABLISHED,RELATED,NEW -m comment --comment "Only one line" --jump ACCEPT' in directory '/root'
[DEBUG   ] output:
[INFO    ] {'locale': 'Work_OK'}
[INFO    ] Completed state [Work_OK] at time 23:26:32.089107 (duration_in_ms=31.777)
[INFO    ] Running state [Always_add_new] at time 23:26:32.089405
[INFO    ] Executing state iptables.append for [Always_add_new]
[INFO    ] Executing command '/usr/sbin/iptables --wait -t filter -A OUTPUT -p icmp -m state --state ESTABLISHED,RELATED,NEW -m comment --comment "Add new line" --icmp-type 0 --jump ACCEPT' in directory '/root'
[DEBUG   ] output:
[INFO    ] {'locale': 'Always_add_new'}
[INFO    ] Completed state [Always_add_new] at time 23:26:32.116723 (duration_in_ms=27.318)
[DEBUG   ] File /var/cache/salt/minion/accumulator/3008359916 does not exist, no need to cleanup
[DEBUG   ] LazyLoaded state.check_result
[DEBUG   ] Closing AsyncZeroMQReqChannel instance
[DEBUG   ] Initializing new AsyncZeroMQReqChannel for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506', 'aes')
[DEBUG   ] Initializing new AsyncAuth for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506')
[DEBUG   ] Connecting the Minion to the Master URI (for the return server): tcp://192.168.1.10:4506
[DEBUG   ] Trying to connect to: tcp://192.168.1.10:4506
[DEBUG   ] Closing AsyncZeroMQReqChannel instance
[DEBUG   ] LazyLoaded highstate.output
[DEBUG   ] LazyLoaded nested.output
[DEBUG   ] LazyLoaded nested.output
local:
----------
          ID: Work_OK
    Function: iptables.append
      Result: True
     Comment: Set iptables rule for Work_OK to: /usr/sbin/iptables --wait -t filter -A OUTPUT  -p icmp -m state --state ESTABLISHED,RELATED,NEW -m comment --comment "Only one line" --jump ACCEPT for ipv4
     Started: 23:26:32.057330
    Duration: 31.777 ms
     Changes:
              ----------
              locale:
                  Work_OK
----------
          ID: Always_add_new
    Function: iptables.append
      Result: True
     Comment: Set iptables rule for Always_add_new to: /usr/sbin/iptables --wait -t filter -A OUTPUT  -p icmp -m state --state ESTABLISHED,RELATED,NEW -m comment --comment "Add new line" --icmp-type 0 --jump ACCEPT for ipv4
     Started: 23:26:32.089405
    Duration: 27.318 ms
     Changes:
              ----------
              locale:
                  Always_add_new

Summary for local
------------
Succeeded: 2 (changed=2)
Failed:    0
------------
Total states run:     2
Total run time:  59.095 ms
[DEBUG   ] Closing AsyncZeroMQReqChannel instance


root@eeebox1test:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     icmp --  anywhere             anywhere             state NEW,RELATED,ESTABLISHED /* Only one line */ACCEPT     icmp --  anywhere             anywhere             state NEW,RELATED,ESTABLISHED icmp echo-reply /* Add new line */


root@eeebox1test:~# salt-call -l debug state.apply iptables.test
[DEBUG   ] Reading configuration from /etc/salt/minion
[DEBUG   ] Including configuration from '/etc/salt/minion.d/_schedule.conf'
[DEBUG   ] Reading configuration from /etc/salt/minion.d/_schedule.conf
[DEBUG   ] Including configuration from '/etc/salt/minion.d/master.conf'
[DEBUG   ] Reading configuration from /etc/salt/minion.d/master.conf
[DEBUG   ] Using cached minion ID from /etc/salt/minion_id: eeebox1test
[DEBUG   ] Configuration file path: /etc/salt/minion
[WARNING ] Insecure logging configuration detected! Sensitive data may be logged.
[DEBUG   ] Grains refresh requested. Refreshing grains.
[DEBUG   ] Reading configuration from /etc/salt/minion
[DEBUG   ] Including configuration from '/etc/salt/minion.d/_schedule.conf'
[DEBUG   ] Reading configuration from /etc/salt/minion.d/_schedule.conf
[DEBUG   ] Including configuration from '/etc/salt/minion.d/master.conf'
[DEBUG   ] Reading configuration from /etc/salt/minion.d/master.conf
[DEBUG   ] LazyLoaded zfs.is_supported
[DEBUG   ] Connecting to master. Attempt 1 of 1
[DEBUG   ] Master URI: tcp://192.168.1.10:4506
[DEBUG   ] Initializing new AsyncAuth for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506')
[DEBUG   ] Generated random reconnect delay between '1000ms' and '11000ms' (9777)
[DEBUG   ] Setting zmq_reconnect_ivl to '9777ms'
[DEBUG   ] Setting zmq_reconnect_ivl_max to '11000ms'
[DEBUG   ] Initializing new AsyncZeroMQReqChannel for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506', 'clear')
[DEBUG   ] Connecting the Minion to the Master URI (for the return server): tcp://192.168.1.10:4506
[DEBUG   ] Trying to connect to: tcp://192.168.1.10:4506
[DEBUG   ] salt.crypt.get_rsa_pub_key: Loading public key
[DEBUG   ] Decrypting the current master AES key
[DEBUG   ] salt.crypt.get_rsa_key: Loading private key
[DEBUG   ] salt.crypt._get_key_with_evict: Loading private key
[DEBUG   ] Loaded minion key: /var/lib/salt/pki/minion/minion.pem
[DEBUG   ] salt.crypt.get_rsa_pub_key: Loading public key
[DEBUG   ] Closing AsyncZeroMQReqChannel instance
[DEBUG   ] Connecting the Minion to the Master publish port, using the URI: tcp://192.168.1.10:4505
[DEBUG   ] salt.crypt.get_rsa_key: Loading private key
[DEBUG   ] Loaded minion key: /var/lib/salt/pki/minion/minion.pem
[DEBUG   ] Determining pillar cache
[DEBUG   ] Initializing new AsyncZeroMQReqChannel for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506', 'aes')
[DEBUG   ] Initializing new AsyncAuth for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506')
[DEBUG   ] Connecting the Minion to the Master URI (for the return server): tcp://192.168.1.10:4506
[DEBUG   ] Trying to connect to: tcp://192.168.1.10:4506
[DEBUG   ] salt.crypt.get_rsa_key: Loading private key
[DEBUG   ] Loaded minion key: /var/lib/salt/pki/minion/minion.pem
[DEBUG   ] Closing AsyncZeroMQReqChannel instance
[DEBUG   ] LazyLoaded jinja.render
[DEBUG   ] LazyLoaded yaml.render
[DEBUG   ] LazyLoaded state.apply
[DEBUG   ] LazyLoaded direct_call.execute
[DEBUG   ] LazyLoaded saltutil.is_running
[DEBUG   ] LazyLoaded grains.get
[DEBUG   ] LazyLoaded config.get
[DEBUG   ] key: test, ret: _|-
[DEBUG   ] Initializing new AsyncZeroMQReqChannel for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506', 'aes')
[DEBUG   ] Initializing new AsyncAuth for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506')
[DEBUG   ] Connecting the Minion to the Master URI (for the return server): tcp://192.168.1.10:4506
[DEBUG   ] Trying to connect to: tcp://192.168.1.10:4506
[DEBUG   ] Gathering pillar data for state run
[DEBUG   ] Finished gathering pillar data for state run
[INFO    ] Loading fresh modules for state activity
[DEBUG   ] LazyLoaded jinja.render
[DEBUG   ] LazyLoaded yaml.render
[DEBUG   ] In saltenv 'base', looking at rel_path 'iptables/test.sls' to resolve 'salt://iptables/test.sls'
[DEBUG   ] In saltenv 'base', ** considering ** path '/var/cache/salt/minion/files/base/iptables/test.sls' to resolve 'salt://iptables/test.sls'
[DEBUG   ] compile template: /var/cache/salt/minion/files/base/iptables/test.sls
[DEBUG   ] Jinja search path: ['/var/cache/salt/minion/files/base']
[DEBUG   ] Initializing new AsyncZeroMQReqChannel for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506', 'aes')
[DEBUG   ] Initializing new AsyncAuth for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506')
[DEBUG   ] Connecting the Minion to the Master URI (for the return server): tcp://192.168.1.10:4506
[DEBUG   ] Trying to connect to: tcp://192.168.1.10:4506
[PROFILE ] Time (in seconds) to render '/var/cache/salt/minion/files/base/iptables/test.sls' using 'jinja' renderer: 0.03221392631530762
[DEBUG   ] Rendered data from file: /var/cache/salt/minion/files/base/iptables/test.sls:

Work_OK:
  iptables.append:
    - comment: 'Only one line'
    - chain: 'OUTPUT'
    - save: False
    - protocol: 'icmp'
    - match: 'state'
    - connstate: 'ESTABLISHED,RELATED,NEW'
    - jump: 'ACCEPT'

Always_add_new:
  iptables.append:
    - comment: 'Add new line'
    - chain: 'OUTPUT'
    - save: False
    - protocol: 'icmp'
    - match: 'state'
    - connstate: 'ESTABLISHED,RELATED,NEW'
    - jump: 'ACCEPT'

    - 'icmp-type': '0'



[DEBUG   ] Results of YAML rendering:
OrderedDict([('Work_OK', OrderedDict([('iptables.append', [OrderedDict([('comment', 'Only one line')]), OrderedDict([('chain', 'OUTPUT')]), OrderedDict([('save', False)]), OrderedDict([('protocol', 'icmp')]), OrderedDict([('match', 'state')]), OrderedDict([('connstate', 'ESTABLISHED,RELATED,NEW')]), OrderedDict([('jump', 'ACCEPT')])])])), ('Always_add_new', OrderedDict([('iptables.append', [OrderedDict([('comment', 'Add new line')]), OrderedDict([('chain', 'OUTPUT')]), OrderedDict([('save', False)]), OrderedDict([('protocol', 'icmp')]), OrderedDict([('match', 'state')]), OrderedDict([('connstate', 'ESTABLISHED,RELATED,NEW')]), OrderedDict([('jump', 'ACCEPT')]), OrderedDict([('icmp-type', '0')])])]))])
[PROFILE ] Time (in seconds) to render '/var/cache/salt/minion/files/base/iptables/test.sls' using 'yaml' renderer: 0.0024750232696533203
[DEBUG   ] LazyLoaded config.option
[DEBUG   ] LazyLoaded iptables.version
[DEBUG   ] LazyLoaded iptables.append
[INFO    ] Running state [Work_OK] at time 23:26:53.259862
[INFO    ] Executing state iptables.append for [Work_OK]
[DEBUG   ] LazyLoaded cmd.run
[INFO    ] iptables rule for Work_OK already set (/usr/sbin/iptables --wait -t filter -A OUTPUT  -p icmp -m state --state ESTABLISHED,RELATED,NEW -m comment --comment "Only one line" --jump ACCEPT) for ipv4
[INFO    ] Completed state [Work_OK] at time 23:26:53.275371 (duration_in_ms=15.51)
[INFO    ] Running state [Always_add_new] at time 23:26:53.275614
[INFO    ] Executing state iptables.append for [Always_add_new]
[INFO    ] Executing command '/usr/sbin/iptables --wait -t filter -A OUTPUT -p icmp -m state --state ESTABLISHED,RELATED,NEW -m comment --comment "Add new line" --icmp-type 0 --jump ACCEPT' in directory '/root'
[DEBUG   ] output:
[INFO    ] {'locale': 'Always_add_new'}
[INFO    ] Completed state [Always_add_new] at time 23:26:53.303885 (duration_in_ms=28.27)
[DEBUG   ] File /var/cache/salt/minion/accumulator/3008777484 does not exist, no need to cleanup
[DEBUG   ] LazyLoaded state.check_result
[DEBUG   ] Closing AsyncZeroMQReqChannel instance
[DEBUG   ] Initializing new AsyncZeroMQReqChannel for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506', 'aes')
[DEBUG   ] Initializing new AsyncAuth for ('/var/lib/salt/pki/minion', 'eeebox1test', 'tcp://192.168.1.10:4506')
[DEBUG   ] Connecting the Minion to the Master URI (for the return server): tcp://192.168.1.10:4506
[DEBUG   ] Trying to connect to: tcp://192.168.1.10:4506
[DEBUG   ] Closing AsyncZeroMQReqChannel instance
[DEBUG   ] LazyLoaded highstate.output
[DEBUG   ] LazyLoaded nested.output
local:
----------
          ID: Work_OK
    Function: iptables.append
      Result: True
     Comment: iptables rule for Work_OK already set (/usr/sbin/iptables --wait -t filter -A OUTPUT  -p icmp -m state --state ESTABLISHED,RELATED,NEW -m comment --comment "Only one line" --jump ACCEPT) for ipv4
     Started: 23:26:53.259861
    Duration: 15.51 ms
     Changes:
----------
          ID: Always_add_new
    Function: iptables.append
      Result: True
     Comment: Set iptables rule for Always_add_new to: /usr/sbin/iptables --wait -t filter -A OUTPUT  -p icmp -m state --state ESTABLISHED,RELATED,NEW -m comment --comment "Add new line" --icmp-type 0 --jump ACCEPT for ipv4
     Started: 23:26:53.275615
    Duration: 28.27 ms
     Changes:
              ----------
              locale:
                  Always_add_new

Summary for local
------------
Succeeded: 2 (changed=1)
Failed:    0
------------
Total states run:     2
Total run time:  43.780 ms
[DEBUG   ] Closing AsyncZeroMQReqChannel instance


root@eeebox1test:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     icmp --  anywhere             anywhere             state NEW,RELATED,ESTABLISHED /* Only one line */
ACCEPT     icmp --  anywhere             anywhere             state NEW,RELATED,ESTABLISHED icmp echo-reply /* Add new line */
ACCEPT     icmp --  anywhere             anywhere             state NEW,RELATED,ESTABLISHED icmp echo-reply /* Add new line */

Expected behavior
In first run it add 2 lines to iptables, on second run it must do nothing, but in second example it always add new line to iptables.

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.) 
Master:
Salt Version:
           Salt: 3000.1

Dependency Versions:
           cffi: Not Installed
       cherrypy: Not Installed
       dateutil: 2.7.3
      docker-py: Not Installed
          gitdb: Not Installed
      gitpython: Not Installed
         Jinja2: 2.10
        libgit2: 0.27.7
       M2Crypto: Not Installed
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.5.6
   mysql-python: 1.3.10
      pycparser: 2.19
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: 0.27.4
         Python: 3.7.3 (default, Dec 20 2019, 18:57:59)
   python-gnupg: Not Installed
         PyYAML: 3.13
          PyZMQ: 17.1.2
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.3.1

System Versions:
           dist: debian 10.3
         locale: UTF-8
        machine: i686
        release: 4.19.0-8-686-pae
         system: Linux
        version: debian 10.3


Minion:
Salt Version:
           Salt: 3000.1

Dependency Versions:
           cffi: Not Installed
       cherrypy: Not Installed
       dateutil: 2.7.3
      docker-py: Not Installed
          gitdb: Not Installed
      gitpython: Not Installed
         Jinja2: 2.10
        libgit2: Not Installed
       M2Crypto: Not Installed
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.5.6
   mysql-python: Not Installed
      pycparser: Not Installed
       pycrypto: 2.6.1
   pycryptodome: 3.6.1
         pygit2: Not Installed
         Python: 3.7.3 (default, Dec 20 2019, 18:57:59)
   python-gnupg: Not Installed
         PyYAML: 3.13
          PyZMQ: 17.1.2
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.3.1

System Versions:
           dist: debian 10.3
         locale: UTF-8
        machine: i686
        release: 4.19.0-8-686
         system: Linux
        version: debian 10.3

salt-minion:
  Installed: 3000.1+dfsg1-1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the iptables.append state entry point and the test.sls reproduction, focusing on the icmp-type parameter and the generated rule comparison. Run the shown state twice and verify that the existing icmp echo-reply rule is not appended again.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.