saltstack / saltstack/salt

[BUG] `firewalld.present` reports `INVALID_ZONE` error if applied with `test=True`

Open
#62,913 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage State-Module
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
If a firewalld.present state is applied with test=True, the following is reported:

          ID: mynewzone_firewall_zone
    Function: firewalld.present
        Name: mynewzone
      Result: False
     Comment: Error: firewall-cmd failed: Error: INVALID_ZONE: mynewzone
     Started: 12:41:30.596912
    Duration: 2536.74 ms

Applying the state without test=True works without any errors.

Setup

mynewzone_firewall_zone:
  firewalld.present:
    - name: mynewzone
    - default: False
    - prune_ports: True
    - prune_services: True
    - prune_interfaces: True
    - prune_sources: True
    - prune_rich_rules: True
    - services:
      - myservice
    - sources:
      - {{ address_ipv4 }}/32
      - {{ address_ipv6 }}/128

Please be as specific as possible and give set-up details.

  • VM (KVM)

Steps to Reproduce the behavior

  1. Add a Salt profile with the above sample state
  2. Attempt to apply the state by running salt-call state.apply test=True on the minion

Expected behavior
Ideally the program should report a change but not an error. If this is not possible because of firewall-cmd's limitations, maybe it could exempt the error from being added to the "Failed" counter.

Screenshots
n/a

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)
$ salt-minion --versions-report
Salt Version:
          Salt: 3004
 
Dependency Versions:
          cffi: 1.13.2
      cherrypy: Not Installed
      dateutil: Not Installed
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 2.10.1
       libgit2: Not Installed
      M2Crypto: 0.38.0
          Mako: Not Installed
       msgpack: 0.5.6
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: 2.17
      pycrypto: Not Installed
  pycryptodome: Not Installed
        pygit2: Not Installed
        Python: 3.6.15 (default, Sep 23 2021, 15:41:43) [GCC]
  python-gnupg: Not Installed
        PyYAML: 5.4.1
         PyZMQ: 17.1.2
         smmap: Not Installed
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.2.3
 
System Versions:
          dist: sles 15.4 
        locale: UTF-8
       machine: x86_64
       release: 5.14.21-150400.24.18-default
        system: Linux
       version: SLES 15.4 

Additional context
This only applies on the "first" state.apply test=True, i.e. if the zone does not yet exist on the minion. After applying the state once without test=True, successive state.apply test=True calls report no errors.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the firewalld.present state implementation and its test-mode handling. Reproduce the first state.apply test=True with a zone that does not exist, then compare it with a subsequent dry run and a normal apply. Done means the initial dry run reports a planned change without counting the expected INVALID_ZONE response as an error.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, python
Domain
devops, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.