Regression 3.1.5: firewalld_rich_rule failes when firewalld is not running

[elconas]

When firewalld is not running when firewalld_rich_rule is applied, it failes with:

Firewalld_rich_rule[NAME]: Could not evaluate: Execution of '/bin/firewall-offline-cmd --zone ZONE --query-rich-rule rule family="ipv4" source address="0.0.0.0/0" service name="SERVICE" accept' returned 1: no

On the second run and when firewalld is already running, everything works ok.

[elconas]

Two ways to fix it:

--- a/lib/puppet/provider/firewalld_rich_rule/firewall_cmd.rb
+++ b/lib/puppet/provider/firewalld_rich_rule/firewall_cmd.rb
@@ -12,7 +12,11 @@ Puppet::Type.type(:firewalld_rich_rule).provide(

   def exists?
     @rule_args ||= build_rich_rule
-    output=execute_firewall_cmd(['--query-rich-rule', @rule_args], @resource[:zone], true, false)
+    begin
+      output=execute_firewall_cmd(['--query-rich-rule', @rule_args], @resource[:zone], true, false)
+    rescue Puppet::ExecutionFailure => e
+      return false
+    end
     output.exitstatus == 0
   end

Or

--- a/lib/puppet/provider/firewalld.rb
+++ b/lib/puppet/provider/firewalld.rb
@@ -61,7 +61,7 @@ class Puppet::Provider::Firewalld < Puppet::Provider
     if online?
       self.class.execute_firewall_cmd(args, zone, perm, failonfail)
     else
-      self.class.execute_firewall_cmd(args, zone, false, true, 'firewall-offline-cmd')
+      self.class.execute_firewall_cmd(args, zone, false, failonfail, 'firewall-offline-cmd')
     end
   end

[elconas]

With 3.1.4 it still works.

[crayfishx]

I seem to remember there was a reason for forcing failonfail when offline... or maybe there wasn't - I'll add this fix in and test it against the scenarios we were trying to fix.