RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1982403 - [NMCI] ovs_set_firewalld_zone test fail
Summary: [NMCI] ovs_set_firewalld_zone test fail
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: NetworkManager
Version: 8.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: beta
: ---
Assignee: Thomas Haller
QA Contact: Filip Pokryvka
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-07-14 19:01 UTC by Vladimir Benes
Modified: 2021-11-10 06:58 UTC (History)
10 users (show)

Fixed In Version: NetworkManager-1.32.8-1.el8
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-11-09 19:30:33 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:4361 0 None None None 2021-11-09 19:30:57 UTC
freedesktop.org Gitlab NetworkManager NetworkManager-ci merge_requests 806/ 0 None None None 2021-08-17 07:04:07 UTC
freedesktop.org Gitlab NetworkManager NetworkManager merge_requests 949 0 None None None 2021-08-02 11:35:29 UTC

Description Vladimir Benes 2021-07-14 19:01:31 UTC 
Description of problem:
We can see this test failing due to ipv4.may-fail no.
https://desktopqe-jenkins.rhev-ci-vms.eng.rdu2.redhat.com/job/beaker-NetworkManager-veth-RHEL-8.5/50/artifact/artifacts/FAIL_report_NetworkManager-ci_Test0754_ovs_set_firewalld_zone.html

Removing the may-fail no fixes the test and there are no more fails.


Version-Release number of selected component (if applicable):
1.32.3-0.z.2.20e3975fd2.el8

How reproducible:
not always

Steps to Reproduce:
1. ./test_run.sh ovs_set_firewalld_zone from https://gitlab.freedesktop.org/NetworkManager/NetworkManager-ci
Comment 1 Filip Pokryvka 2021-07-27 08:30:50 UTC 
The test is passing on RHEL8.4 (firewalld-0.8.2-6.el8.noarch), however test fails on distros with newer firewalld. Looking at the test, maybe `firewall-cmd --reload` step cleans zones set by NetworkManager on newer versions? When doing check right before firewalld reload, zone is set. Eric can you check it is not a firewalld issue? Thank you!
Comment 2 Beniamino Galvani 2021-07-27 09:04:20 UTC 
Note that in the "Status After Scenario" section, "iface0" is not yet activated:

  iface0      ovs-interface  connecting (getting IP configuration)  ovs-iface0

because it's waiting an IP via DHCP. Maybe firewalld no longer sets the zone on reload if the device is still activating?
Comment 3 Eric Garver 2021-07-27 12:56:06 UTC 
(In reply to Beniamino Galvani from comment #2)
> Note that in the "Status After Scenario" section, "iface0" is not yet
> activated:
> 
>   iface0      ovs-interface  connecting (getting IP configuration) 
> ovs-iface0
> 
> because it's waiting an IP via DHCP. Maybe firewalld no longer sets the zone
> on reload if the device is still activating?

My guess is this broke when we made the changes for bug 1928860. Firewalld now calls dev.get_ip_iface() instead of dev.get_iface(). I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP.

Note: When firewalld reloads it asks NM for all the connections and their zone assignments.
Comment 4 Beniamino Galvani 2021-07-28 15:12:33 UTC 
(In reply to Eric Garver from comment #3)
>  I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP.

I would have thought the same, however get_ip_face() returns the interface only when the device is activated:

https://developer.gnome.org/libnm/stable/NMDevice.html#nm-device-get-ip-iface

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.32.4/src/core/devices/nm-device.c#L18026
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.32.4/src/core/devices/nm-device.c#L16299

This hasn't changed since forever, so probably there was some reason to do so...

Thomas do you know why?
Comment 5 Thomas Haller 2021-07-28 16:10:23 UTC 
> >  I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP.
>
> I would have thought the same, however get_ip_face() returns the interface only when the device is activated:

*sigh* I also thought so.


Yes, this code is very old, and I don't think the way how NM exposes ip-iface vs iface makes sense.

I don't know why it is that way, I don't think it should be.
Comment 7 Thomas Haller 2021-08-06 12:41:04 UTC 
fixed upstream by https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/949.

Now NetworkManager listens to "Reloaded" signal and reconfigures the zones. The behavior is the same (from NM's point of view), as if firewalld gets restarted (dropping of the bus and reappearing).


Merged upstream to main (1.33.1+) and nm-1-32 (1.32.7+).
Comment 15 errata-xmlrpc 2021-11-09 19:30:33 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: NetworkManager security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:4361
Note You need to log in before you can comment on or make changes to this bug.