Project

General

Profile

Actions

action #54785

open

tap devices not in any zone, error reported by firewalld

Added by okurz almost 5 years ago. Updated over 3 years ago.

Status:
Workable
Priority:
Low
Assignee:
-
Category:
-
Target version:
Start date:
2019-07-29
Due date:
% Done:

0%

Estimated time:
Tags:

Description

Observation

On aarch64.o.o in /var/log/firewalld there are a lot of error messages about devices, especially tap devices, not in any zone:

2019-07-25 03:30:04 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-07-25 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-07-25 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-07-25 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-07-25 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-07-25 03:30:15 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-07-26 03:30:02 ERROR: UNKNOWN_INTERFACE: 'tap1' is not in any zone
2019-07-26 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap2' is not in any zone
2019-07-26 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap3' is not in any zone
2019-07-26 03:30:04 ERROR: UNKNOWN_INTERFACE: 'tap4' is not in any zone
2019-07-26 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap5' is not in any zone
2019-07-26 03:30:05 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-07-26 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-07-26 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-07-26 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-07-26 03:30:08 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-07-26 03:30:17 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-07-27 03:30:01 ERROR: UNKNOWN_INTERFACE: 'tap1' is not in any zone
2019-07-27 03:30:02 ERROR: UNKNOWN_INTERFACE: 'tap2' is not in any zone
2019-07-27 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap3' is not in any zone
2019-07-27 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap4' is not in any zone
2019-07-27 03:30:04 ERROR: UNKNOWN_INTERFACE: 'tap5' is not in any zone
2019-07-27 03:30:05 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-07-27 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-07-27 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-07-27 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-07-27 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-07-27 03:30:15 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone

Problem

  • H1: We never set the zone of the tap devices so who is setting the zone at all? Should the default zone apply? If yes, why does it not apply for some devices? Is this a race between firewalld and wicked?
  • P2: On 2019-07-29 we saw no errors about any devices not in any zone but firewall-cmd --get-zone-of-interface=tap131 states "trusted" wherease for tap130 we see still no zone, as on the previous days

Suggestions

  • Try to set an explicit zone in the interface config files
  • Set the tap devices to an explicit zone with firewall-cmd for openQA tests

Related issues 1 (0 open1 closed)

Related to openQA Tests - action #52499: [aarch64] Proper multi-machine test setup and wicked_basic successfully tested (was: wicked tests always in schedule state - tap worker required)Resolvedokurz2019-06-03

Actions
Actions #1

Updated by okurz almost 5 years ago

  • Related to action #52499: [aarch64] Proper multi-machine test setup and wicked_basic successfully tested (was: wicked tests always in schedule state - tap worker required) added
Actions #2

Updated by okurz almost 5 years ago

  • Description updated (diff)
Actions #3

Updated by okurz almost 5 years ago

  • Description updated (diff)
Actions #4

Updated by okurz almost 5 years ago

  • Status changed from New to Feedback
  • Assignee set to okurz

On aarch64 I did not observe this problem anymore, maybe because I removed all ZONE= from /etc/sysconfig/ifcfg* and instead set with firewalld directly:

firewall-cmd --zone=trusted --add-interface=ovs-system
firewall-cmd --runtime-to-permanent

Let's see for the next days if this helps and then turn towards other workers as well.

Current status:

for i in power8 aarch64 imagetester openqaworker1 openqaworker4 rebel ; do echo $i && ssh root@$i "tail /var/log/firewalld"; done
power8
tail: cannot open '/var/log/firewalld' for reading: No such file or directory
aarch64
2019-08-05 03:30:08 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-08-05 03:30:09 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-08-05 03:30:09 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-08-05 03:30:10 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-08-05 03:30:19 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-05 14:44:36 ERROR: ZONE_CONFLICT: 'eth0' already bound to a zone
2019-08-05 15:44:23 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-08-05 15:58:59 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-08-07 03:30:05 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-08-08 03:30:06 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
imagetester
2019-07-30 03:30:42 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-07-31 03:30:26 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-01 03:30:26 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-02 03:30:31 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-03 03:30:03 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-04 03:30:05 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-05 03:30:01 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-06 03:31:31 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-07 03:30:37 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-08 03:30:06 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
openqaworker1
2019-08-08 03:30:31 ERROR: UNKNOWN_INTERFACE: 'tap131' is not in any zone
2019-08-08 03:30:31 ERROR: UNKNOWN_INTERFACE: 'tap132' is not in any zone
2019-08-08 03:30:32 ERROR: UNKNOWN_INTERFACE: 'tap133' is not in any zone
2019-08-08 03:30:32 ERROR: UNKNOWN_INTERFACE: 'tap64' is not in any zone
2019-08-08 03:30:32 ERROR: UNKNOWN_INTERFACE: 'tap65' is not in any zone
2019-08-08 03:30:33 ERROR: UNKNOWN_INTERFACE: 'tap66' is not in any zone
2019-08-08 03:30:33 ERROR: UNKNOWN_INTERFACE: 'tap67' is not in any zone
2019-08-08 03:30:33 ERROR: UNKNOWN_INTERFACE: 'tap68' is not in any zone
2019-08-08 03:30:34 ERROR: UNKNOWN_INTERFACE: 'tap69' is not in any zone
2019-08-08 03:30:35 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
openqaworker4
2019-01-17 03:30:07 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
rebel
Actions #5

Updated by okurz over 4 years ago

  • Status changed from Feedback to Workable
  • Assignee deleted (okurz)
Actions #6

Updated by okurz almost 4 years ago

  • Target version set to Ready
Actions #7

Updated by okurz almost 4 years ago

  • Tags changed from caching, openQA, sporadic, arm, ipmi, worker to worker
Actions #8

Updated by okurz over 3 years ago

  • Priority changed from Normal to Low
Actions #9

Updated by okurz over 3 years ago

  • Target version changed from Ready to future
Actions

Also available in: Atom PDF