saltstack / saltstack/salt

firewalld state does not commit interface change

Open
#53,743 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug centos Confirmed severity-high
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description of Issue

The firewalld state seemingly does not permanently commit interface changes. In my state, I am trying to reassign the interface eth0 from public to internal, which it does temporarily, but does not commit this change to the firewalld zone configuration.

Setup

Edit: CentOS 7 18.10, using firewalld

  firewalld.present:
    - name: internal
    - interfaces:
      - eth0
    - prune_interfaces: True # whether this is true or false doesn't change anything

public:
  firewalld.present:
    - name: public
    - interfaces:
      - eth1
    - prune_interfaces: True
Steps to Reproduce Issue
  1. Apply the above state on a minion.
  2. Observe the 'changed' result:
    Function: firewalld.present
      Result: True
     Comment: 'internal' was configured.
     Started: 11:50:09.089411
    Duration: 4449.001 ms
     Changes:
              ----------
              interfaces:
                  ----------
                  new:
                      - eth0
                  old:
  1. Re-apply the state again on the same minion.
  2. Notice the result is marked as 'changed' again even though nothing should have changed:
    Function: firewalld.present
      Result: True
     Comment: 'internal' was configured.
     Started: 11:51:49.487945
    Duration: 5514.598 ms
     Changes:
              ----------
              interfaces:
                  ----------
                  new:
                      - eth0
                  old:
  1. Check the firewalld zone file for the internal zone (/etc/firewalld/zones/internal.xml) and note that no interface is specified in the file:
<zone>
  <short>Internal</short>
  <description>For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="ssh"/>
  <service name="http"/>
  <service name="https"/>
</zone>

We would expect a <interface> tag specifying eth0 in this file.

Versions Report
           Salt: 2019.2.0

Dependency Versions:
           cffi: Not Installed
       cherrypy: unknown
       dateutil: Not Installed
      docker-py: Not Installed
          gitdb: Not Installed
      gitpython: Not Installed
          ioflo: Not Installed
         Jinja2: 2.7.2
        libgit2: Not Installed
        libnacl: Not Installed
       M2Crypto: Not Installed
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.4.6
   mysql-python: Not Installed
      pycparser: Not Installed
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: Not Installed
         Python: 2.7.5 (default, Oct 30 2018, 23:45:53)
   python-gnupg: Not Installed
         PyYAML: 3.11
          PyZMQ: 15.3.0
           RAET: Not Installed
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.2.1
            ZMQ: 4.1.4

System Versions:
           dist: centos 7.6.1810 Core
         locale: UTF-8
        machine: x86_64
        release: 3.10.0-957.el7.x86_64
         system: Linux
        version: CentOS Linux 7.6.1810 Core

Identical on all minions.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the firewalld.present state twice on CentOS 7, using the exact internal and public configurations in the issue. Compare the reported changes with /etc/firewalld/zones/internal.xml and verify whether the interface assignment is persisted after the first run. Done means a second application reports no change and the internal zone file contains eth0.

Written by the indexing model from the issue text.

Assessment

Tech stack
centos, linux, python
Domain
devops, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.