|Summary:||[NMCI] ovs_set_firewalld_zone test fail|
|Product:||Red Hat Enterprise Linux 8||Reporter:||Vladimir Benes <vbenes>|
|Component:||NetworkManager||Assignee:||Thomas Haller <thaller>|
|Status:||CLOSED ERRATA||QA Contact:||Filip Pokryvka <fpokryvk>|
|Version:||8.4||CC:||acabral, atragler, bgalvani, egarver, fpokryvk, lrintel, rkhan, sukulkar, thaller, till|
|Target Milestone:||beta||Keywords:||Regression, Triaged|
|Fixed In Version:||NetworkManager-1.32.8-1.el8||Doc Type:||No Doc Update|
|Doc Text:||Story Points:||---|
|Last Closed:||2021-11-09 19:30:33 UTC||Type:||Bug|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
Description Vladimir Benes 2021-07-14 19:01:31 UTC
Comment 1 Filip Pokryvka 2021-07-27 08:30:50 UTC
The test is passing on RHEL8.4 (firewalld-0.8.2-6.el8.noarch), however test fails on distros with newer firewalld. Looking at the test, maybe `firewall-cmd --reload` step cleans zones set by NetworkManager on newer versions? When doing check right before firewalld reload, zone is set. Eric can you check it is not a firewalld issue? Thank you!
Comment 2 Beniamino Galvani 2021-07-27 09:04:20 UTC
Note that in the "Status After Scenario" section, "iface0" is not yet activated: iface0 ovs-interface connecting (getting IP configuration) ovs-iface0 because it's waiting an IP via DHCP. Maybe firewalld no longer sets the zone on reload if the device is still activating?
Comment 3 Eric Garver 2021-07-27 12:56:06 UTC
(In reply to Beniamino Galvani from comment #2) > Note that in the "Status After Scenario" section, "iface0" is not yet > activated: > > iface0 ovs-interface connecting (getting IP configuration) > ovs-iface0 > > because it's waiting an IP via DHCP. Maybe firewalld no longer sets the zone > on reload if the device is still activating? My guess is this broke when we made the changes for bug 1928860. Firewalld now calls dev.get_ip_iface() instead of dev.get_iface(). I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP. Note: When firewalld reloads it asks NM for all the connections and their zone assignments.
Comment 4 Beniamino Galvani 2021-07-28 15:12:33 UTC
(In reply to Eric Garver from comment #3) > I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP. I would have thought the same, however get_ip_face() returns the interface only when the device is activated: https://developer.gnome.org/libnm/stable/NMDevice.html#nm-device-get-ip-iface https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.32.4/src/core/devices/nm-device.c#L18026 https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.32.4/src/core/devices/nm-device.c#L16299 This hasn't changed since forever, so probably there was some reason to do so... Thomas do you know why?
Comment 5 Thomas Haller 2021-07-28 16:10:23 UTC
> > I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP. > > I would have thought the same, however get_ip_face() returns the interface only when the device is activated: *sigh* I also thought so. Yes, this code is very old, and I don't think the way how NM exposes ip-iface vs iface makes sense. I don't know why it is that way, I don't think it should be.
Comment 7 Thomas Haller 2021-08-06 12:41:04 UTC
fixed upstream by https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/949. Now NetworkManager listens to "Reloaded" signal and reconfigures the zones. The behavior is the same (from NM's point of view), as if firewalld gets restarted (dropping of the bus and reappearing). Merged upstream to main (1.33.1+) and nm-1-32 (1.32.7+).
Comment 15 errata-xmlrpc 2021-11-09 19:30:33 UTC
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: NetworkManager security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:4361