Project

General

Profile

action #54785

tap devices not in any zone, error reported by firewalld

Added by okurz about 2 years ago. Updated about 1 year ago.

Status:
Workable
Priority:
Low
Assignee:
-
Target version:
Start date:
2019-07-29
Due date:
% Done:

0%

Estimated time:
Tags:

Description

Observation

On aarch64.o.o in /var/log/firewalld there are a lot of error messages about devices, especially tap devices, not in any zone:

2019-07-25 03:30:04 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-07-25 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-07-25 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-07-25 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-07-25 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-07-25 03:30:15 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-07-26 03:30:02 ERROR: UNKNOWN_INTERFACE: 'tap1' is not in any zone
2019-07-26 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap2' is not in any zone
2019-07-26 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap3' is not in any zone
2019-07-26 03:30:04 ERROR: UNKNOWN_INTERFACE: 'tap4' is not in any zone
2019-07-26 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap5' is not in any zone
2019-07-26 03:30:05 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-07-26 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-07-26 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-07-26 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-07-26 03:30:08 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-07-26 03:30:17 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-07-27 03:30:01 ERROR: UNKNOWN_INTERFACE: 'tap1' is not in any zone
2019-07-27 03:30:02 ERROR: UNKNOWN_INTERFACE: 'tap2' is not in any zone
2019-07-27 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap3' is not in any zone
2019-07-27 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap4' is not in any zone
2019-07-27 03:30:04 ERROR: UNKNOWN_INTERFACE: 'tap5' is not in any zone
2019-07-27 03:30:05 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-07-27 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-07-27 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-07-27 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-07-27 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-07-27 03:30:15 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone

Problem

  • H1: We never set the zone of the tap devices so who is setting the zone at all? Should the default zone apply? If yes, why does it not apply for some devices? Is this a race between firewalld and wicked?
  • P2: On 2019-07-29 we saw no errors about any devices not in any zone but firewall-cmd --get-zone-of-interface=tap131 states "trusted" wherease for tap130 we see still no zone, as on the previous days

Suggestions

  • Try to set an explicit zone in the interface config files
  • Set the tap devices to an explicit zone with firewall-cmd for openQA tests

Related issues

Related to openQA Tests - action #52499: [aarch64] Proper multi-machine test setup and wicked_basic successfully tested (was: wicked tests always in schedule state - tap worker required)Resolved2019-06-03

History

#1 Updated by okurz about 2 years ago

  • Related to action #52499: [aarch64] Proper multi-machine test setup and wicked_basic successfully tested (was: wicked tests always in schedule state - tap worker required) added

#2 Updated by okurz about 2 years ago

  • Description updated (diff)

#3 Updated by okurz about 2 years ago

  • Description updated (diff)

#4 Updated by okurz about 2 years ago

  • Status changed from New to Feedback
  • Assignee set to okurz

On aarch64 I did not observe this problem anymore, maybe because I removed all ZONE= from /etc/sysconfig/ifcfg* and instead set with firewalld directly:

firewall-cmd --zone=trusted --add-interface=ovs-system
firewall-cmd --runtime-to-permanent

Let's see for the next days if this helps and then turn towards other workers as well.

Current status:

for i in power8 aarch64 imagetester openqaworker1 openqaworker4 rebel ; do echo $i && ssh root@$i "tail /var/log/firewalld"; done
power8
tail: cannot open '/var/log/firewalld' for reading: No such file or directory
aarch64
2019-08-05 03:30:08 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-08-05 03:30:09 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-08-05 03:30:09 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-08-05 03:30:10 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-08-05 03:30:19 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-05 14:44:36 ERROR: ZONE_CONFLICT: 'eth0' already bound to a zone
2019-08-05 15:44:23 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-08-05 15:58:59 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-08-07 03:30:05 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-08-08 03:30:06 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
imagetester
2019-07-30 03:30:42 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-07-31 03:30:26 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-01 03:30:26 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-02 03:30:31 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-03 03:30:03 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-04 03:30:05 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-05 03:30:01 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-06 03:31:31 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-07 03:30:37 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-08 03:30:06 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
openqaworker1
2019-08-08 03:30:31 ERROR: UNKNOWN_INTERFACE: 'tap131' is not in any zone
2019-08-08 03:30:31 ERROR: UNKNOWN_INTERFACE: 'tap132' is not in any zone
2019-08-08 03:30:32 ERROR: UNKNOWN_INTERFACE: 'tap133' is not in any zone
2019-08-08 03:30:32 ERROR: UNKNOWN_INTERFACE: 'tap64' is not in any zone
2019-08-08 03:30:32 ERROR: UNKNOWN_INTERFACE: 'tap65' is not in any zone
2019-08-08 03:30:33 ERROR: UNKNOWN_INTERFACE: 'tap66' is not in any zone
2019-08-08 03:30:33 ERROR: UNKNOWN_INTERFACE: 'tap67' is not in any zone
2019-08-08 03:30:33 ERROR: UNKNOWN_INTERFACE: 'tap68' is not in any zone
2019-08-08 03:30:34 ERROR: UNKNOWN_INTERFACE: 'tap69' is not in any zone
2019-08-08 03:30:35 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
openqaworker4
2019-01-17 03:30:07 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
rebel

#5 Updated by okurz about 2 years ago

  • Status changed from Feedback to Workable
  • Assignee deleted (okurz)

#6 Updated by okurz about 1 year ago

  • Target version set to Ready

#7 Updated by okurz about 1 year ago

  • Tags changed from caching, openQA, sporadic, arm, ipmi, worker to worker

#8 Updated by okurz about 1 year ago

  • Priority changed from Normal to Low

#9 Updated by okurz about 1 year ago

  • Target version changed from Ready to future

Also available in: Atom PDF