Disable REJECT rules in CentOS IBP

This is a hook to disable the following iptable rule:
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

Partial-Bug: #1458832

Change-Id: I2bc297dcc57ab4310cf6667c31d2dbeb6e74b588

deployment_scripts/blocking_iptables_rules.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# Copyright 2015 Mellanox Technologies, Ltd
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+readonly SCRIPT_DIR=$(dirname "$0")
+source $SCRIPT_DIR/common
+
+if [ "$DISTRO" == 'redhat' ]; then
+  sed -i /etc/sysconfig/system-config-firewall -e s/enabled/disabled/g
+  if (iptables -S | grep -q "FORWARD -j REJECT --reject-with icmp-host-prohibited"); then
+    iptables -D  FORWARD -j REJECT --reject-with icmp-host-prohibited
+    sed -i '/FORWARD -j REJECT --reject-with icmp-host-prohibited/d' /etc/sysconfig/iptables
+    sed -i '/FORWARD -j REJECT --reject-with icmp-host-prohibited/d' /etc/sysconfig/iptables.save
+  fi
+fi

metadata.yaml

@@ -5,7 +5,7 @@ name: mellanox-plugin
 title: Mellanox Openstack features
 
 # Plugin version
-version: 0.2.13
+version: 0.2.14
 
 # Description
 description: Enable features over Mellanox hardware

tasks.yaml

@@ -15,6 +15,13 @@
   parameters:
     cmd: ./link_astute_file.sh
     timeout: 5
+# This is a workaround: disable wrong rules in CentOS IBP #1458832.
+- role: '*'
+  stage: pre_deployment
+  type: shell
+  parameters:
+    cmd: ./blocking_iptables_rules.sh
+    timeout: 20
 # Add relevant settings for Mellanox manifests to mellanox plugin section in
 # hiera, to make the data easily accessible and independent of astute.yaml
 - role: '*'