Bug 1968012

RHEL doesn't open all the ports by default like Fedora Workstation, but the bug is in RHEL-8.5 nonetheless. It's just a lot less likely to be encountered. I don't think it's urgent to fix for 8.5, but cloning for tracking reasons.


+++ This bug was initially created as a clone of Bug #1914935 +++

*** SNIPPED DUE TO COMMENT LIMIT ***

--- Additional comment from Brendan Mchugh on 2021-05-27 13:45:46 UTC ---

Is it possible there may have been a change in behavior in firewalld blocking duplicate entries while previous it allowed them?

Problematic zone file.

$ sudo cat /etc/firewalld/zones/FedoraWorkstation.xml
---
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Fedora Workstation</short>
  <description>Unsolicited incoming network packets are rejected from port 1 to 1024, except for select network services. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed.</description>
  <service name="dhcpv6-client"/>
  <service name="ssh"/>
  <service name="samba-client"/>
  <service name="mdns"/>
  <service name="http"/>
  <service name="https"/>
  <port port="1025-65535" protocol="udp"/>
  <port port="1025-65535" protocol="tcp"/>
  <port port="9000" protocol="tcp"/>
  <port port="22623" protocol="tcp"/>
  <port port="6443" protocol="tcp"/>
  <port port="8001" protocol="tcp"/>
</zone>
---


Editing out the values one by one that were also covered by the range <port port="1025-65535" protocol="tcp"/> and then restarting with "$ sudo systemctl restart firewalld" after each edit seems to indicate where it was getting stuck.
Also the first occurrence correlates with the F34 upgrade on May 10.

$ sudo journalctl -u firewalld | grep FedoraWorkstation.xml
---
May 10 00:17:57 t580 firewalld[1512]: ERROR: Failed to load zone file '/etc/firewalld/zones/FedoraWorkstation.xml': ALREADY_ENABLED: '9000:tcp' already in 'FedoraWorkstation'
May 23 22:58:18 t580 firewalld[1665]: ERROR: Failed to load zone file '/etc/firewalld/zones/FedoraWorkstation.xml': ALREADY_ENABLED: '9000:tcp' already in 'FedoraWorkstation'
May 24 08:03:15 t580 firewalld[1423]: ERROR: Failed to load zone file '/etc/firewalld/zones/FedoraWorkstation.xml': ALREADY_ENABLED: '9000:tcp' already in 'FedoraWorkstation'
May 24 21:27:14 t580 firewalld[1560]: ERROR: Failed to load zone file '/etc/firewalld/zones/FedoraWorkstation.xml': ALREADY_ENABLED: '9000:tcp' already in 'FedoraWorkstation'
May 24 21:33:13 t580 firewalld[1451]: ERROR: Failed to load zone file '/etc/firewalld/zones/FedoraWorkstation.xml': ALREADY_ENABLED: '9000:tcp' already in 'FedoraWorkstation'
May 24 21:38:55 t580 firewalld[1949]: ERROR: Failed to load zone file '/etc/firewalld/zones/FedoraWorkstation.xml': ALREADY_ENABLED: '9000:tcp' already in 'FedoraWorkstation'
May 25 07:54:45 t580 firewalld[1407]: ERROR: Failed to load zone file '/etc/firewalld/zones/FedoraWorkstation.xml': ALREADY_ENABLED: '9000:tcp' already in 'FedoraWorkstation'
May 25 21:25:37 t580 firewalld[1468]: ERROR: Failed to load zone file '/etc/firewalld/zones/FedoraWorkstation.xml': ALREADY_ENABLED: '9000:tcp' already in 'FedoraWorkstation'
May 27 07:34:45 t580 firewalld[1455]: ERROR: Failed to load zone file '/etc/firewalld/zones/FedoraWorkstation.xml': ALREADY_ENABLED: '9000:tcp' already in 'FedoraWorkstation'
May 27 15:16:36 t580 firewalld[15039]: ERROR: Failed to load zone file '/etc/firewalld/zones/FedoraWorkstation.xml': ALREADY_ENABLED: '22623:tcp' already in 'FedoraWorkstation'
May 27 15:17:26 t580 firewalld[15210]: ERROR: Failed to load zone file '/etc/firewalld/zones/FedoraWorkstation.xml': ALREADY_ENABLED: '6443:tcp' already in 'FedoraWorkstation'
May 27 15:18:15 t580 firewalld[15411]: ERROR: Failed to load zone file '/etc/firewalld/zones/FedoraWorkstation.xml': ALREADY_ENABLED: '8001:tcp' already in 'FedoraWorkstation'
---


Timestamp of last update to /etc/firewalld/zones/FedoraWorkstation.xml

$ sudo ls -l /etc/firewalld/zones
---
total 24
-rw-r--r--. 1 root root 329 Jul 18  2019 external.xml
-rw-r--r--. 1 root root 410 Jul 18  2019 external.xml.old
-rw-rw-r--. 1 root root 750 Jan 13  2020 FedoraWorkstation.xml
-rw-rw-r--. 1 root root 713 Jul 18  2019 FedoraWorkstation.xml.old
-rw-r--r--. 1 root root 913 Jan 15  2020 libvirt.xml
-rw-r--r--. 1 root root 870 Jan 15  2020 libvirt.xml.old
---


Presumably my current F34 machine started with F30 based on number and frequency of "system-upgrade upgrade" runs, if it's any help on correlating anything.

$ sudo dnf history list | grep "system-upgrade upgrade"
---
   153 | system-upgrade upgrade      | 2021-05-10 00:00 | ?, D, E, I, O, | 2237 EE
   140 | system-upgrade upgrade      | 2021-03-15 10:51 | D, E, I, O, U  | 2136 EE
   114 | system-upgrade upgrade      | 2020-06-24 11:10 | D, E, I, O, U  | 2003 EE
    79 | system-upgrade upgrade      | 2019-10-30 09:31 | D, E, I, O, U  | 1982 EE
---


Package versions

$ rpm -qa | grep firewalld
---
firewalld-filesystem-0.9.3-2.fc34.noarch
firewalld-0.9.3-2.fc34.noarch
---

--- Additional comment from Laine Stump on 2021-05-27 19:31:26 UTC ---

My opinion is that overlapping rules shouldn't be considered an error as long as they don't demand conflicting actions (which isn't even possible in this case, since all the rules have the implied action of "accept"). But that's not for me to decide - just making my vote heard :-)

--- Additional comment from Eric Garver on 2021-05-27 20:15:48 UTC ---

It's a combination of things that caused this. Below is mostly notes for myself.

  1. port coalescing and breaking (v0.9.0+)
    - a5291bcee84b ("improvement: port: allow coalescing and breaking of ranges")
    - prior to this overlapping ports were not detected at all
      - if your zone already had ports "1024-65535" and you tried to add "1234" it would NOT be detected as already enabled. It will get added to the permanent config.
      - with this change it WILL be detected and rejected. It won't be added to the permanent config.

  2. Overlapping ranges detected at startup (v0.9.0+)
    - the check for overlapping ports previously (< v0.9.0) did not occur during startup
    - this detection occurs now due refactoring done for policy objects

So here's what happened:

  1. prior configuration of firewalld (< v0.9.0) allowed the overlapping port ranges to exist in the permanent config (#1 above)
  2. update to v0.9.0 or later
  3. startup fails (#2 above)
  4. due to startup failure (#3), further actions fail - e.g. adding an interface to a zone.
    - the zone was not fully loaded due to the error so chains were missing

Workaround:

  - remove the overlapping port ranges

--- Additional comment from Eric Garver on 2021-06-04 13:29:37 UTC ---

Upstream PR: https://github.com/firewalld/firewalld/pull/807

The above is intended as a quick fix, but is suitable for the stable branches. There are plans for an overhaul of the the config checks, but those will be firewalld v1.0.0 or later depending on upstream developer bandwidth.

--- Additional comment from Eric Garver on 2021-06-04 14:28:03 UTC ---

Upstream commits:

012a87a34367 ("test(zone): verify overlapping ports don't halt zone loading")
b71e532bc21f ("fix(policy): warn instead of error for overlapping ports")
23dc028083db ("test(functions): improve checking firewalld.log for errors")
748bcaee9a1d ("test(functions): FWD_GREP_LOG: allow checking error code")

--- Additional comment from Fedora Update System on 2021-06-04 17:13:45 UTC ---

FEDORA-2021-a091f2e696 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-a091f2e696