firewalld state does not commit interface change
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description of Issue
The firewalld state seemingly does not permanently commit interface changes. In my state, I am trying to reassign the interface eth0 from public to internal, which it does temporarily, but does not commit this change to the firewalld zone configuration.
Setup
Edit: CentOS 7 18.10, using firewalld
firewalld.present:
- name: internal
- interfaces:
- eth0
- prune_interfaces: True # whether this is true or false doesn't change anything
public:
firewalld.present:
- name: public
- interfaces:
- eth1
- prune_interfaces: True
Steps to Reproduce Issue
- Apply the above state on a minion.
- Observe the 'changed' result:
Function: firewalld.present
Result: True
Comment: 'internal' was configured.
Started: 11:50:09.089411
Duration: 4449.001 ms
Changes:
----------
interfaces:
----------
new:
- eth0
old:
- Re-apply the state again on the same minion.
- Notice the result is marked as 'changed' again even though nothing should have changed:
Function: firewalld.present
Result: True
Comment: 'internal' was configured.
Started: 11:51:49.487945
Duration: 5514.598 ms
Changes:
----------
interfaces:
----------
new:
- eth0
old:
- Check the firewalld zone file for the internal zone (
/etc/firewalld/zones/internal.xml) and note that no interface is specified in the file:
<zone>
<short>Internal</short>
<description>For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.</description>
<service name="ssh"/>
<service name="http"/>
<service name="https"/>
</zone>
We would expect a <interface> tag specifying eth0 in this file.
Versions Report
Salt: 2019.2.0
Dependency Versions:
cffi: Not Installed
cherrypy: unknown
dateutil: Not Installed
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
ioflo: Not Installed
Jinja2: 2.7.2
libgit2: Not Installed
libnacl: Not Installed
M2Crypto: Not Installed
Mako: Not Installed
msgpack-pure: Not Installed
msgpack-python: 0.4.6
mysql-python: Not Installed
pycparser: Not Installed
pycrypto: 2.6.1
pycryptodome: Not Installed
pygit2: Not Installed
Python: 2.7.5 (default, Oct 30 2018, 23:45:53)
python-gnupg: Not Installed
PyYAML: 3.11
PyZMQ: 15.3.0
RAET: Not Installed
smmap: Not Installed
timelib: Not Installed
Tornado: 4.2.1
ZMQ: 4.1.4
System Versions:
dist: centos 7.6.1810 Core
locale: UTF-8
machine: x86_64
release: 3.10.0-957.el7.x86_64
system: Linux
version: CentOS Linux 7.6.1810 Core
Identical on all minions.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the firewalld.present state twice on CentOS 7, using the exact internal and public configurations in the issue. Compare the reported changes with /etc/firewalld/zones/internal.xml and verify whether the interface assignment is persisted after the first run. Done means a second application reports no change and the internal zone file contains eth0.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- centos, linux, python
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100