fix

playbooks/mrwho/vm03-firewall.yml

@@ -96,12 +96,11 @@
 #        zone: external
 #        state: enabled
 #        permanent: true
-      - policy: 
-          name: lan-to-wan
-          state: enabled
-          permanent: true
-          masquerade: true
-          ingress_zones:
-            - internal
-          egress_zones:
-            - public
+      - policy: lan-to-wan
+        state: enabled
+        permanent: true
+        masquerade: true
+        ingress_zones:
+          - internal
+        egress_zones:
+          - public

roles/firewall/library/firewall_lib.py

@@ -272,7 +272,14 @@ options:
     type: str
     choices: ["replaced", "kept"]
     default: "kept"
-{"text": "  includes:\n    description:\n      Services to include in this one.\n    required: false\n    type: list\n    elements: str\n    default: []\n  policy:\n    description:\n      The policy name string.\n      If the policy name is not given, then the default policy will be used.\n    required: false\n    type: str\n  ingress_zone:\n    description:\n      List of ingress zone names.\n      Traffic originating from these zones will be subject to this policy.\n    required: false\n    type: list\n    elements: str\n    default: []\n  egress_zone:\n    description:\n      List of egress zone names.\n      Traffic destined to these zones will be subject to this policy.\n    required: false\n    type: list\n    elements: str\n    default: []\n  online:"}
+  includes:
+    description:
+      Services to include in this one.
+    required: false
+    type: list
+    elements: str
+    default: []
+  online:
     description:
       When true, use the D-Bus API to query the status from the running system.
       Otherwise, use firewall-offline-cmd(1). Offline mode is
@@ -571,7 +578,7 @@ EXAMPLES = """
 """
 
 from ansible.module_utils.basic import AnsibleModule
-from ansible.module_utils.firewall_lsr.get_config import (
+from ansible_collections.fedora.linux_system_roles.plugins.module_utils.firewall_lsr.get_config import (
     config_to_dict,
     export_config_dict,
     recursive_show_diffs,
@@ -1941,6 +1948,8 @@ class InMemoryBackend:
                     zone_config["masquerade"] = masquerade
                     self.changed = True
 
+    # note: rich_rule is a single string, normalized using str(Rich_Rule(rule_str=original_string))
+    # the zone config field 'rich_rule' is a list of normalized strings
     def set_rich_rule(self, rich_rule):
         """Configure rich rules in a zone."""
         for config_type, zone_config in (
@@ -1950,12 +1959,12 @@ class InMemoryBackend:
             if config_type and zone_config is not None:
                 for item in rich_rule:
                     if self.state == "enabled":
-                        if item not in zone_config.get("rich_rules", []):
-                            zone_config.setdefault("rich_rules", []).append(item)
+                        if item not in zone_config.get("rich_rule", []):
+                            zone_config.setdefault("rich_rule", []).append(item)
                             self.changed = True
                     elif self.state == "disabled":
-                        if item in zone_config.get("rich_rules", []):
-                            zone_config["rich_rules"].remove(item)
+                        if item in zone_config.get("rich_rule", []):
+                            zone_config["rich_rule"].remove(item)
                             self.changed = True
 
     def set_source(self, source):
@@ -2474,7 +2483,7 @@ class OfflineCLIBackend:
         enable = self.check_state(["enabled", "disabled"], "rich_rule")
 
         for item in rich_rule:
-            # note: item is a Rich_Rule object, but its __str__() does the right thing
+            # note: item is a string, normalized using str(Rich_Rule(rule_str=original_string))
             cur = self.query("--zone", self.zone, "--query-rich-rule=" + item)
 
             if cur != enable:
@@ -2592,8 +2601,13 @@ def get_interface_pci():
         device_udi = nm_get_client().get_device_by_iface(interface).get_udi()
         device_path = os.path.join(device_udi, "device")
         for field in ["vendor", "device"]:
-            with open(os.path.join(device_path, field)) as _file:
-                interface_ids.append(_file.readline().strip(" \n")[2:])
+            try:
+                with open(os.path.join(device_path, field)) as _file:
+                    interface_ids.append(_file.readline().strip(" \n")[2:])
+            except IOError:
+                continue
+        if len(interface_ids) != 2:
+            continue
         interface_ids = ":".join(interface_ids)
         if interface_ids not in pci_dict:
             pci_dict[interface_ids] = [interface]

roles/firewall/library/firewall_lib_facts.py

@@ -88,7 +88,7 @@ firewall_config:
 """
 
 from ansible.module_utils.basic import AnsibleModule
-from ansible.module_utils.firewall_lsr.get_config import config_to_dict, HAS_FIREWALLD
+from ansible_collections.fedora.linux_system_roles.plugins.module_utils.firewall_lsr.get_config import config_to_dict, HAS_FIREWALLD
 
 
 def main():