Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1982403

Summary: [NMCI] ovs_set_firewalld_zone test fail
Product: Red Hat Enterprise Linux 8 Reporter: Vladimir Benes <vbenes>
Component: NetworkManagerAssignee: Thomas Haller <thaller>
Status: CLOSED ERRATA QA Contact: Filip Pokryvka <fpokryvk>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.4CC: acabral, atragler, bgalvani, egarver, fpokryvk, lrintel, rkhan, sukulkar, thaller, till
Target Milestone: betaKeywords: Regression, Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: NetworkManager-1.32.8-1.el8 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-11-09 19:30:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Vladimir Benes 2021-07-14 19:01:31 UTC 
Description of problem:
We can see this test failing due to ipv4.may-fail no.
https://desktopqe-jenkins.rhev-ci-vms.eng.rdu2.redhat.com/job/beaker-NetworkManager-veth-RHEL-8.5/50/artifact/artifacts/FAIL_report_NetworkManager-ci_Test0754_ovs_set_firewalld_zone.html

Removing the may-fail no fixes the test and there are no more fails.


Version-Release number of selected component (if applicable):
1.32.3-0.z.2.20e3975fd2.el8

How reproducible:
not always

Steps to Reproduce:
1. ./test_run.sh ovs_set_firewalld_zone from https://gitlab.freedesktop.org/NetworkManager/NetworkManager-ci
Comment 1 Filip Pokryvka 2021-07-27 08:30:50 UTC 
The test is passing on RHEL8.4 (firewalld-0.8.2-6.el8.noarch), however test fails on distros with newer firewalld. Looking at the test, maybe `firewall-cmd --reload` step cleans zones set by NetworkManager on newer versions? When doing check right before firewalld reload, zone is set. Eric can you check it is not a firewalld issue? Thank you!
Comment 2 Beniamino Galvani 2021-07-27 09:04:20 UTC 
Note that in the "Status After Scenario" section, "iface0" is not yet activated:

  iface0      ovs-interface  connecting (getting IP configuration)  ovs-iface0

because it's waiting an IP via DHCP. Maybe firewalld no longer sets the zone on reload if the device is still activating?
Comment 3 Eric Garver 2021-07-27 12:56:06 UTC 
(In reply to Beniamino Galvani from comment #2)
> Note that in the "Status After Scenario" section, "iface0" is not yet
> activated:
> 
>   iface0      ovs-interface  connecting (getting IP configuration) 
> ovs-iface0
> 
> because it's waiting an IP via DHCP. Maybe firewalld no longer sets the zone
> on reload if the device is still activating?

My guess is this broke when we made the changes for bug 1928860. Firewalld now calls dev.get_ip_iface() instead of dev.get_iface(). I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP.

Note: When firewalld reloads it asks NM for all the connections and their zone assignments.
Comment 4 Beniamino Galvani 2021-07-28 15:12:33 UTC 
(In reply to Eric Garver from comment #3)
>  I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP.

I would have thought the same, however get_ip_face() returns the interface only when the device is activated:

https://developer.gnome.org/libnm/stable/NMDevice.html#nm-device-get-ip-iface

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.32.4/src/core/devices/nm-device.c#L18026
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.32.4/src/core/devices/nm-device.c#L16299

This hasn't changed since forever, so probably there was some reason to do so...

Thomas do you know why?
Comment 5 Thomas Haller 2021-07-28 16:10:23 UTC 
> >  I thought get_ip_iface() should return all interfaces _capable_ of having an IP. Not those that _actively_ have an IP.
>
> I would have thought the same, however get_ip_face() returns the interface only when the device is activated:

*sigh* I also thought so.


Yes, this code is very old, and I don't think the way how NM exposes ip-iface vs iface makes sense.

I don't know why it is that way, I don't think it should be.
Comment 7 Thomas Haller 2021-08-06 12:41:04 UTC 
fixed upstream by https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/949.

Now NetworkManager listens to "Reloaded" signal and reconfigures the zones. The behavior is the same (from NM's point of view), as if firewalld gets restarted (dropping of the bus and reappearing).


Merged upstream to main (1.33.1+) and nm-1-32 (1.32.7+).
Comment 15 errata-xmlrpc 2021-11-09 19:30:33 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: NetworkManager security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:4361