From abd50d8438e7d371ce24f97d8f8f67052b562007 Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <dtantsur@redhat.com>
Date: Thu, 14 Apr 2016 18:02:27 +0200
Subject: [PATCH] Make sure to clean the blacklist cache when disabling the firewall

Otherwise on reintrospection the firewall code may not update
iptables rules, assuming they are already correct.

Change-Id: Icc05174854bd9ab51bfed9d1360873bf5db9ed54
Closes-Bug: #1570447
(cherry picked from commit 41580add20b20cb28dcacb5012c85a89cb46d830)
---

diff --git a/ironic_inspector/firewall.py b/ironic_inspector/firewall.py
index be8cb4b..c8e4036 100644
--- a/ironic_inspector/firewall.py
+++ b/ironic_inspector/firewall.py
@@ -135,7 +135,7 @@
 
 def _disable_dhcp():
     """Disable DHCP completely."""
-    global ENABLED
+    global ENABLED, BLACKLIST_CACHE
 
     if not ENABLED:
         LOG.debug('DHCP is already disabled, not updating')
@@ -143,6 +143,7 @@
 
     LOG.debug('No nodes on introspection and node_not_found_hook is '
               'not set - disabling DHCP')
+    BLACKLIST_CACHE = None
     with _temporary_chain(NEW_CHAIN, CHAIN):
         # Blacklist everything
         _iptables('-A', NEW_CHAIN, '-j', 'REJECT')
diff --git a/ironic_inspector/test/test_firewall.py b/ironic_inspector/test/test_firewall.py
index 27f27d1..d0d0a5c 100644
--- a/ironic_inspector/test/test_firewall.py
+++ b/ironic_inspector/test/test_firewall.py
@@ -288,6 +288,9 @@
                                                   mock_get_client,
                                                   mock_iptables):
         firewall.init()
+        firewall.BLACKLIST_CACHE = ['foo']
+        mock_get_client.return_value.port.list.return_value = [
+            mock.Mock(address='foobar')]
 
         update_filters_expected_args = [
             ('-D', 'INPUT', '-i', 'br-ctlplane', '-p', 'udp', '--dport',
@@ -317,6 +320,8 @@
                                 call_args_list):
             self.assertEqual(args, call[0])
 
+        self.assertIsNone(firewall.BLACKLIST_CACHE)
+
         # Check caching enabled flag
 
         mock_iptables.reset_mock()
@@ -330,3 +335,4 @@
         firewall.update_filters()
 
         mock_iptables.assert_any_call('-A', firewall.NEW_CHAIN, '-j', 'ACCEPT')
+        self.assertEqual({'foobar'}, firewall.BLACKLIST_CACHE)
diff --git a/releasenotes/notes/firewall-rerun-f2d0f64cca2698ff.yaml b/releasenotes/notes/firewall-rerun-f2d0f64cca2698ff.yaml
new file mode 100644
index 0000000..65068a2
--- /dev/null
+++ b/releasenotes/notes/firewall-rerun-f2d0f64cca2698ff.yaml
@@ -0,0 +1,4 @@
+---
+fixes:
+  - Fixed a regression in the firewall code, which causes re-running
+    introspection for an already inspected node to fail.