action #54785: tap devices not in any zone, error reported by firewalld - openQA Infrastructure - openSUSE Project Management Tool

Actions

Copy link

action #54785

open

tap devices not in any zone, error reported by firewalld

Added by okurz over 5 years ago. Updated about 4 years ago.

Status:

Workable

Priority:

Low

Assignee:

Category:

Target version:

QA - future

Start date:

2019-07-29

Due date:

% Done:

Estimated time:

Tags:

worker

Description

Observation¶

On aarch64.o.o in /var/log/firewalld there are a lot of error messages about devices, especially tap devices, not in any zone:

2019-07-25 03:30:04 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-07-25 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-07-25 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-07-25 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-07-25 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-07-25 03:30:15 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-07-26 03:30:02 ERROR: UNKNOWN_INTERFACE: 'tap1' is not in any zone
2019-07-26 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap2' is not in any zone
2019-07-26 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap3' is not in any zone
2019-07-26 03:30:04 ERROR: UNKNOWN_INTERFACE: 'tap4' is not in any zone
2019-07-26 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap5' is not in any zone
2019-07-26 03:30:05 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-07-26 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-07-26 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-07-26 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-07-26 03:30:08 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-07-26 03:30:17 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-07-27 03:30:01 ERROR: UNKNOWN_INTERFACE: 'tap1' is not in any zone
2019-07-27 03:30:02 ERROR: UNKNOWN_INTERFACE: 'tap2' is not in any zone
2019-07-27 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap3' is not in any zone
2019-07-27 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap4' is not in any zone
2019-07-27 03:30:04 ERROR: UNKNOWN_INTERFACE: 'tap5' is not in any zone
2019-07-27 03:30:05 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-07-27 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-07-27 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-07-27 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-07-27 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-07-27 03:30:15 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone

Problem¶

H1: We never set the zone of the tap devices so who is setting the zone at all? Should the default zone apply? If yes, why does it not apply for some devices? Is this a race between firewalld and wicked?
P2: On 2019-07-29 we saw no errors about any devices not in any zone but firewall-cmd --get-zone-of-interface=tap131 states "trusted" wherease for tap130 we see still no zone, as on the previous days

Suggestions¶

Try to set an explicit zone in the interface config files
Set the tap devices to an explicit zone with firewall-cmd for openQA tests

Related issues 1 (0 open — 1 closed)

Actions

Copy link

Updated by okurz over 5 years ago

Related to action #52499: [aarch64] Proper multi-machine test setup and wicked_basic successfully tested (was: wicked tests always in schedule state - tap worker required) added

Actions

Copy link

Updated by okurz over 5 years ago

Description updated (diff)

Actions

Copy link

Updated by okurz over 5 years ago

Description updated (diff)

Actions

Copy link

Updated by okurz over 5 years ago

Status changed from New to Feedback
Assignee set to okurz

On aarch64 I did not observe this problem anymore, maybe because I removed all ZONE= from /etc/sysconfig/ifcfg* and instead set with firewalld directly:

firewall-cmd --zone=trusted --add-interface=ovs-system
firewall-cmd --runtime-to-permanent

Let's see for the next days if this helps and then turn towards other workers as well.

Current status:

for i in power8 aarch64 imagetester openqaworker1 openqaworker4 rebel ; do echo $i && ssh root@$i "tail /var/log/firewalld"; done
power8
tail: cannot open '/var/log/firewalld' for reading: No such file or directory
aarch64
2019-08-05 03:30:08 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-08-05 03:30:09 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-08-05 03:30:09 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-08-05 03:30:10 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-08-05 03:30:19 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-05 14:44:36 ERROR: ZONE_CONFLICT: 'eth0' already bound to a zone
2019-08-05 15:44:23 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-08-05 15:58:59 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-08-07 03:30:05 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-08-08 03:30:06 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
imagetester
2019-07-30 03:30:42 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-07-31 03:30:26 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-01 03:30:26 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-02 03:30:31 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-03 03:30:03 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-04 03:30:05 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-05 03:30:01 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-06 03:31:31 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-07 03:30:37 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-08 03:30:06 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
openqaworker1
2019-08-08 03:30:31 ERROR: UNKNOWN_INTERFACE: 'tap131' is not in any zone
2019-08-08 03:30:31 ERROR: UNKNOWN_INTERFACE: 'tap132' is not in any zone
2019-08-08 03:30:32 ERROR: UNKNOWN_INTERFACE: 'tap133' is not in any zone
2019-08-08 03:30:32 ERROR: UNKNOWN_INTERFACE: 'tap64' is not in any zone
2019-08-08 03:30:32 ERROR: UNKNOWN_INTERFACE: 'tap65' is not in any zone
2019-08-08 03:30:33 ERROR: UNKNOWN_INTERFACE: 'tap66' is not in any zone
2019-08-08 03:30:33 ERROR: UNKNOWN_INTERFACE: 'tap67' is not in any zone
2019-08-08 03:30:33 ERROR: UNKNOWN_INTERFACE: 'tap68' is not in any zone
2019-08-08 03:30:34 ERROR: UNKNOWN_INTERFACE: 'tap69' is not in any zone
2019-08-08 03:30:35 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
openqaworker4
2019-01-17 03:30:07 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
rebel

Actions

Copy link