Bug 1982403

Summary: [NMCI] ovs_set_firewalld_zone test fail
Product: Red Hat Enterprise Linux 8 Reporter: Vladimir Benes <vbenes>
Component: NetworkManagerAssignee: Thomas Haller <thaller>
Status: CLOSED ERRATA QA Contact: Filip Pokryvka <fpokryvk>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.4CC: acabral, atragler, bgalvani, egarver, fpokryvk, lrintel, rkhan, sukulkar, thaller, till
Target Milestone: betaKeywords: Regression, Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: NetworkManager-1.32.8-1.el8 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-11-09 19:30:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Vladimir Benes 2021-07-14 19:01:31 UTC
Description of problem:
We can see this test failing due to ipv4.may-fail no.
https://desktopqe-jenkins.rhev-ci-vms.eng.rdu2.redhat.com/job/beaker-NetworkManager-veth-RHEL-8.5/50/artifact/artifacts/FAIL_report_NetworkManager-ci_Test0754_ovs_set_firewalld_zone.html

Removing the may-fail no fixes the test and there are no more fails.


Version-Release number of selected component (if applicable):
1.32.3-0.z.2.20e3975fd2.el8

How reproducible:
not always

Steps to Reproduce:
1. ./test_run.sh ovs_set_firewalld_zone from https://gitlab.freedesktop.org/NetworkManager/NetworkManager-ci

Comment 1 Filip Pokryvka 2021-07-27 08:30:50 UTC
The test is passing on RHEL8.4 (firewalld-0.8.2-6.el8.noarch), however test fails on distros with newer firewalld. Looking at the test, maybe `firewall-cmd --reload` step cleans zones set by NetworkManager on newer versions? When doing check right before firewalld reload, zone is set. Eric can you check it is not a firewalld issue? Thank you!

Comment 2 Beniamino Galvani 2021-07-27 09:04:20 UTC
Note that in the "Status After Scenario" section, "iface0" is not yet activated:

  iface0      ovs-interface  connecting (getting IP configuration)  ovs-iface0

because it's waiting an IP via DHCP. Maybe firewalld no longer sets the zone on reload if the device is still activating?

Comment 3 Eric Garver 2021-07-27 12:56:06 UTC
(In reply to Beniamino Galvani from comment #2)
> Note that in the "Status After Scenario" section, "iface0" is not yet
> activated:
> 
>   iface0      ovs-interface  connecting (getting IP configuration) 
> ovs-iface0
> 
> because it's waiting an IP via DHCP. Maybe firewalld no longer sets the zone
> on reload if the device is still activating?

My guess is this broke when we made the changes for bug 1928860. Firewalld now calls dev.get_ip_iface() instead of dev.get_iface(). I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP.

Note: When firewalld reloads it asks NM for all the connections and their zone assignments.

Comment 4 Beniamino Galvani 2021-07-28 15:12:33 UTC
(In reply to Eric Garver from comment #3)
>  I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP.

I would have thought the same, however get_ip_face() returns the interface only when the device is activated:

https://developer.gnome.org/libnm/stable/NMDevice.html#nm-device-get-ip-iface

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.32.4/src/core/devices/nm-device.c#L18026
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.32.4/src/core/devices/nm-device.c#L16299

This hasn't changed since forever, so probably there was some reason to do so...

Thomas do you know why?

Comment 5 Thomas Haller 2021-07-28 16:10:23 UTC
> >  I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP.
>
> I would have thought the same, however get_ip_face() returns the interface only when the device is activated:

*sigh* I also thought so.


Yes, this code is very old, and I don't think the way how NM exposes ip-iface vs iface makes sense.

I don't know why it is that way, I don't think it should be.

Comment 7 Thomas Haller 2021-08-06 12:41:04 UTC
fixed upstream by https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/949.

Now NetworkManager listens to "Reloaded" signal and reconfigures the zones. The behavior is the same (from NM's point of view), as if firewalld gets restarted (dropping of the bus and reappearing).


Merged upstream to main (1.33.1+) and nm-1-32 (1.32.7+).

Comment 15 errata-xmlrpc 2021-11-09 19:30:33 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: NetworkManager security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:4361