firewalld task is not idempotent for adding ports

[okapia]

SUMMARY

I'm using the firewalld: task with the port: option. The first time this is run on a host, it works fine. However on any later or subsequent runs, I get an error: ERROR: Exception caught: org.fedoraproject.FirewallD1.Exception: ALREADY_ENABLED: 'xxxxx:tcp' already in 'public' Permanent and Non-Permanent(immediate) operation

This violates idempotency which is really the whole point of ansible.

Aside from port:, I'm using permanent: yes, immediate: yes, state: enabled, and zone: public.

ISSUE TYPE

• Bug Report

COMPONENT NAME

ansible.posix.firewalld

ANSIBLE VERSION

ansible 2.10.8

python version = 3.6.8 (default, Mar  9 2021, 15:28:46) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5.0.1)]

CONFIGURATION

Problem verified from a plain pip install ansible in a venv and just the minimal task so with zero config. Otherwise I'm not permitted to publish internal paths on the Internet so no full dump.

OS / ENVIRONMENT

Oracle Linux 8.3 which is a RHEL 8 clone.

STEPS TO REPRODUCE

- name: Enable ports in firewall
  firewalld:
    port: "{{ item }}"
    permanent: yes
    immediate: yes
    state: enabled
    zone: public
  loop: [ whatever/tcp ]
  become: yes

And run this TWICE

EXPECTED RESULTS

Expected results of the second run to be changed: false, failed: false

ACTUAL RESULTS

"msg": "ERROR: Exception caught: org.fedoraproject.FirewallD1.Exception: ALREADY_ENABLED: 'myport:tcp' already in 'public' Permanent and Non-Permanent(immediate) operation"

[Akasurde]

@okapia Thanks for reporting this issue.

Could you please report the firewalld version installed?

I am able to reproduce this on

# rpm -qa |grep firewalld
firewalld-filesystem-0.9.3-1.el8.noarch
firewalld-0.9.3-1.el8.noarch

and not on

firewalld-filesystem-0.8.2-2.el8.noarch
firewalld-0.8.2-2.el8.noarch

[Akasurde]

needs_info

[okapia]

I had the issue with 0.8.2-2.0.1.el8. The machine has been upgraded from 8.3 to 8.4 just last week so now runs 0.8.2-6.0.1.el8. But I just checked again and I still see the issue. I don't know if there's anything Oracle Linux specific in those version numbers like the additional .0.1 but I suppose there might be.

[Akasurde]

@okapia Could you please verify #199 and let me know? Thanks in advance.

resolved_by_pr #199

[mwperina]

As this is a regression, it should really be backported also to Ansible 2.9.z

[Akasurde]

@mwperina module works after downgrading to Firewalld 0.8.2. also, Ansible 2.9 release is frozen and only open for critical security fixes.