Bug 1982403
| Summary: | [NMCI] ovs_set_firewalld_zone test fail | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Vladimir Benes <vbenes> |
| Component: | NetworkManager | Assignee: | Thomas Haller <thaller> |
| Status: | CLOSED ERRATA | QA Contact: | Filip Pokryvka <fpokryvk> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.4 | CC: | acabral, atragler, bgalvani, egarver, fpokryvk, lrintel, rkhan, sukulkar, thaller, till |
| Target Milestone: | beta | Keywords: | Regression, Triaged |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | NetworkManager-1.32.8-1.el8 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-11-09 19:30:33 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Vladimir Benes
2021-07-14 19:01:31 UTC
The test is passing on RHEL8.4 (firewalld-0.8.2-6.el8.noarch), however test fails on distros with newer firewalld. Looking at the test, maybe `firewall-cmd --reload` step cleans zones set by NetworkManager on newer versions? When doing check right before firewalld reload, zone is set. Eric can you check it is not a firewalld issue? Thank you! Note that in the "Status After Scenario" section, "iface0" is not yet activated: iface0 ovs-interface connecting (getting IP configuration) ovs-iface0 because it's waiting an IP via DHCP. Maybe firewalld no longer sets the zone on reload if the device is still activating? (In reply to Beniamino Galvani from comment #2) > Note that in the "Status After Scenario" section, "iface0" is not yet > activated: > > iface0 ovs-interface connecting (getting IP configuration) > ovs-iface0 > > because it's waiting an IP via DHCP. Maybe firewalld no longer sets the zone > on reload if the device is still activating? My guess is this broke when we made the changes for bug 1928860. Firewalld now calls dev.get_ip_iface() instead of dev.get_iface(). I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP. Note: When firewalld reloads it asks NM for all the connections and their zone assignments. (In reply to Eric Garver from comment #3) > I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP. I would have thought the same, however get_ip_face() returns the interface only when the device is activated: https://developer.gnome.org/libnm/stable/NMDevice.html#nm-device-get-ip-iface https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.32.4/src/core/devices/nm-device.c#L18026 https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.32.4/src/core/devices/nm-device.c#L16299 This hasn't changed since forever, so probably there was some reason to do so... Thomas do you know why? > > I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP. > > I would have thought the same, however get_ip_face() returns the interface only when the device is activated: *sigh* I also thought so. Yes, this code is very old, and I don't think the way how NM exposes ip-iface vs iface makes sense. I don't know why it is that way, I don't think it should be. fixed upstream by https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/949. Now NetworkManager listens to "Reloaded" signal and reconfigures the zones. The behavior is the same (from NM's point of view), as if firewalld gets restarted (dropping of the bus and reappearing). Merged upstream to main (1.33.1+) and nm-1-32 (1.32.7+). Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: NetworkManager security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:4361 |