[BUG] `firewalld.present` reports `INVALID_ZONE` error if applied with `test=True`
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
If a firewalld.present state is applied with test=True, the following is reported:
ID: mynewzone_firewall_zone
Function: firewalld.present
Name: mynewzone
Result: False
Comment: Error: firewall-cmd failed: Error: INVALID_ZONE: mynewzone
Started: 12:41:30.596912
Duration: 2536.74 ms
Applying the state without test=True works without any errors.
Setup
mynewzone_firewall_zone:
firewalld.present:
- name: mynewzone
- default: False
- prune_ports: True
- prune_services: True
- prune_interfaces: True
- prune_sources: True
- prune_rich_rules: True
- services:
- myservice
- sources:
- {{ address_ipv4 }}/32
- {{ address_ipv6 }}/128
Please be as specific as possible and give set-up details.
- VM (KVM)
Steps to Reproduce the behavior
- Add a Salt profile with the above sample state
- Attempt to apply the state by running
salt-call state.apply test=Trueon the minion
Expected behavior
Ideally the program should report a change but not an error. If this is not possible because of firewall-cmd's limitations, maybe it could exempt the error from being added to the "Failed" counter.
Screenshots
n/a
Versions Report
salt --versions-report
(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)$ salt-minion --versions-report
Salt Version:
Salt: 3004
Dependency Versions:
cffi: 1.13.2
cherrypy: Not Installed
dateutil: Not Installed
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
Jinja2: 2.10.1
libgit2: Not Installed
M2Crypto: 0.38.0
Mako: Not Installed
msgpack: 0.5.6
msgpack-pure: Not Installed
mysql-python: Not Installed
pycparser: 2.17
pycrypto: Not Installed
pycryptodome: Not Installed
pygit2: Not Installed
Python: 3.6.15 (default, Sep 23 2021, 15:41:43) [GCC]
python-gnupg: Not Installed
PyYAML: 5.4.1
PyZMQ: 17.1.2
smmap: Not Installed
timelib: Not Installed
Tornado: 4.5.3
ZMQ: 4.2.3
System Versions:
dist: sles 15.4
locale: UTF-8
machine: x86_64
release: 5.14.21-150400.24.18-default
system: Linux
version: SLES 15.4
Additional context
This only applies on the "first" state.apply test=True, i.e. if the zone does not yet exist on the minion. After applying the state once without test=True, successive state.apply test=True calls report no errors.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the firewalld.present state implementation and its test-mode handling. Reproduce the first state.apply test=True with a zone that does not exist, then compare it with a subsequent dry run and a normal apply. Done means the initial dry run reports a planned change without counting the expected INVALID_ZONE response as an error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, python
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100