FirewallDriver's defer_apply might need better exception handling

[IWAMOTO Toshihiro]

The current code is:

    @contextlib.contextmanager
    def defer_apply(self):
        """Defer apply context."""
        self.filter_defer_apply_on()
        try:
            yield
        finally:
            self.filter_defer_apply_off()

This means filter_defer_apply_off will be called even if there is an exception and the exception will be reraised.

Assuming the SG rules were consistent before this contextmanager call, it might make more sense to just discard deferred SG programming.

[Brian Haley (brian-haley)]

The iptables defer_apply() code is a little better in that it catches the exception in defer_apply_off() and raises a consistent value.

But I think we need to always make the filter_defer_apply_off() call so that things like self._defer_apply are correctly set to False, else we could get in a state where the agent can't apply anything, right? Maybe a patch with your proposed change would be a better place to discuss?