Bug 1588456

Summary:	dbus-send --system does not work without --print-reply
Product:	Red Hat Enterprise Linux 7	Reporter:	David Kaspar // Dee'Kej <deekej>
Component:	dbus	Assignee:	David King <dking>
Status:	CLOSED WONTFIX	QA Contact:	Desktop QE <desktop-qa-list>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	7.5	CC:	drusek, mclasen, vbenes
Target Milestone:	rc	Keywords:	Reproducer
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-07-13 15:20:38 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1497759, 1586284

Description David Kaspar // Dee'Kej 2018-06-07 11:48:23 UTC

Description of problem:
In BZ #1497759 we have replaced the firewall-cmd with dbus-send calls in network-scripts, for a speed improvement.

It has been now discovered though, that the 'dbus-send' calls we have there actually does not work if we do *not* use ẗhe --print-reply option as well.

Version-Release number of selected component (if applicable):
dbus-1.10.24-7.el7.x86_64

How reproducible:
Always.

Steps to Reproduce:
1. Install fresh RHEL-7.5 server version in VM.
2. Start the RHEL-7.5, log in as root.
3. Disable NetworkManager:
  $ systemctl disable NetworkManager
  $ systemctl status NetworkManager
4. Enable firewalld:
  $ systemctl enable firewalld
  $ systemctl status firewalld
5. Check that the ZONE option is *NOT* set in the ifcfg-eth0 file:
  $ cat /etc/sysconfig/network-scripts/ifcfg-eth0 | grep ZONE
6. Reboot the machine, log in again.
7. Check that we don't have any active firewall zones for eth0 NIC:
  $ firewall-cmd --get-active-zones
  ... The output of this command should be empty now.
8. Issue the DBus send call to set the firewall zone:
  $ dbus-send --system --dest=org.fedoraproject.FirewallD1 \
              /org/fedoraproject/FirewallD1 \
              org.fedoraproject.FirewallD1.zone.changeZoneOfInterface \
              string:"trusted" string:"eth0"
9. Check if the eth0 NIC was assigned to "trusted" zone:
  $ $ firewall-cmd --get-active-zones

Actual results:


Expected results:


Additional info:

Comment 2 David Kaspar // Dee'Kej 2018-06-07 11:54:14 UTC

Darn it, I have miss-clicked... :-/

(In reply to David Kaspar [Dee'Kej] from comment #0)
> Actual results:
Empty output -- meaning no NIC is assigned to any firewall zone.

> Expected results (output):
trusted
  interfaces: eth0

> Additional info:
After adding the --print-reply option to the 'dbus-send' call, you will see the expected result.

This seems like some kind of a race-condition, since the --print-reply makes the 'dbus-send' call synchronous (and thus slower) AFAIK.

The slow down can negatively impact our customers experience with RHV. See:
https://bugzilla.redhat.com/show_bug.cgi?id=1497759#c3

----------------

NOTE: Please, make sure we fix this in upstream / Fedora as well. We use the same dbus-send calls there aas well.

Comment 4 Vladimir Benes 2018-06-07 12:01:26 UTC

(In reply to David Kaspar [Dee'Kej] from comment #0)
> Description of problem:
> In BZ #1497759 we have replaced the firewall-cmd with dbus-send calls in
> network-scripts, for a speed improvement.
> 
> It has been now discovered though, that the 'dbus-send' calls we have there
> actually does not work if we do *not* use ẗhe --print-reply option as well.
> 
> Version-Release number of selected component (if applicable):
> dbus-1.10.24-7.el7.x86_64
> 
> How reproducible:
> Always.
> 
> Steps to Reproduce:
> 1. Install fresh RHEL-7.5 server version in VM.
> 2. Start the RHEL-7.5, log in as root.
> 3. Disable NetworkManager:
>   $ systemctl disable NetworkManager
>   $ systemctl status NetworkManager

Just curious, why do you do this? Does it have any impact on result?

Comment 5 David Kaspar // Dee'Kej 2018-06-07 12:24:03 UTC

(In reply to Vladimir Benes from comment #4)
> Just curious, why do you do this? Does it have any impact on result?

I'm not exactly sure what NetworkManager does in case of firewalld zones, so I'm disabling it just to be sure (so it does not mix in somehow), for consistency -- the original reproducer in BZ #1586284 also has it disabled. :)

Comment 6 David King 2018-06-12 14:48:55 UTC

(In reply to David Kaspar [Dee'Kej] from comment #0)
> Description of problem:
> In BZ #1497759 we have replaced the firewall-cmd with dbus-send calls in
> network-scripts, for a speed improvement.
> 
> It has been now discovered though, that the 'dbus-send' calls we have there
> actually does not work if we do *not* use ẗhe --print-reply option as well.

What happens if you give "--type=method_call" as an argument to dbus-send?

Comment 7 David Kaspar // Dee'Kej 2018-06-13 09:28:19 UTC

(In reply to David King from comment #6)
> What happens if you give "--type=method_call" as an argument to dbus-send?

Nothing changes, unfortunately.

-------------------------------

[root@localhost ~]# firewall-cmd --get-active-zones
trusted
  interfaces: eth0

[root@localhost ~]# dbus-send --type=method_call --system \
    --dest=org.fedoraproject.FirewallD1 /org/fedoraproject/FirewallD1 \
           org.fedoraproject.FirewallD1.zone.changeZoneOfInterface \
           string:"home" string:"eth0"

[root@localhost ~]# firewall-cmd --get-active-zones
trusted
  interfaces: eth0