action #54785
open
tap devices not in any zone, error reported by firewalld
Added by okurz over 4 years ago.
Updated over 3 years ago.
Description
Observation¶
On aarch64.o.o in /var/log/firewalld there are a lot of error messages about devices, especially tap devices, not in any zone:
2019-07-25 03:30:04 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-07-25 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-07-25 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-07-25 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-07-25 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-07-25 03:30:15 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-07-26 03:30:02 ERROR: UNKNOWN_INTERFACE: 'tap1' is not in any zone
2019-07-26 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap2' is not in any zone
2019-07-26 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap3' is not in any zone
2019-07-26 03:30:04 ERROR: UNKNOWN_INTERFACE: 'tap4' is not in any zone
2019-07-26 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap5' is not in any zone
2019-07-26 03:30:05 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-07-26 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-07-26 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-07-26 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-07-26 03:30:08 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-07-26 03:30:17 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-07-27 03:30:01 ERROR: UNKNOWN_INTERFACE: 'tap1' is not in any zone
2019-07-27 03:30:02 ERROR: UNKNOWN_INTERFACE: 'tap2' is not in any zone
2019-07-27 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap3' is not in any zone
2019-07-27 03:30:03 ERROR: UNKNOWN_INTERFACE: 'tap4' is not in any zone
2019-07-27 03:30:04 ERROR: UNKNOWN_INTERFACE: 'tap5' is not in any zone
2019-07-27 03:30:05 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-07-27 03:30:05 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-07-27 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-07-27 03:30:06 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-07-27 03:30:07 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-07-27 03:30:15 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
Problem¶
- H1: We never set the zone of the tap devices so who is setting the zone at all? Should the default zone apply? If yes, why does it not apply for some devices? Is this a race between firewalld and wicked?
- P2: On 2019-07-29 we saw no errors about any devices not in any zone but
firewall-cmd --get-zone-of-interface=tap131 states "trusted" wherease for tap130 we see still no zone, as on the previous days
Suggestions¶
- Try to set an explicit zone in the interface config files
- Set the tap devices to an explicit zone with
firewall-cmd for openQA tests
- Related to action #52499: [aarch64] Proper multi-machine test setup and wicked_basic successfully tested (was: wicked tests always in schedule state - tap worker required) added
- Description updated (diff)
- Description updated (diff)
- Status changed from New to Feedback
- Assignee set to okurz
On aarch64 I did not observe this problem anymore, maybe because I removed all ZONE= from /etc/sysconfig/ifcfg* and instead set with firewalld directly:
firewall-cmd --zone=trusted --add-interface=ovs-system
firewall-cmd --runtime-to-permanent
Let's see for the next days if this helps and then turn towards other workers as well.
Current status:
for i in power8 aarch64 imagetester openqaworker1 openqaworker4 rebel ; do echo $i && ssh root@$i "tail /var/log/firewalld"; done
power8
tail: cannot open '/var/log/firewalld' for reading: No such file or directory
aarch64
2019-08-05 03:30:08 ERROR: UNKNOWN_INTERFACE: 'tap0' is not in any zone
2019-08-05 03:30:09 ERROR: UNKNOWN_INTERFACE: 'tap128' is not in any zone
2019-08-05 03:30:09 ERROR: UNKNOWN_INTERFACE: 'tap129' is not in any zone
2019-08-05 03:30:10 ERROR: UNKNOWN_INTERFACE: 'tap130' is not in any zone
2019-08-05 03:30:19 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-05 14:44:36 ERROR: ZONE_CONFLICT: 'eth0' already bound to a zone
2019-08-05 15:44:23 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-08-05 15:58:59 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-08-07 03:30:05 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
2019-08-08 03:30:06 ERROR: UNKNOWN_INTERFACE: 'ovs-system' is not in any zone
imagetester
2019-07-30 03:30:42 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-07-31 03:30:26 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-01 03:30:26 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-02 03:30:31 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-03 03:30:03 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-04 03:30:05 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-05 03:30:01 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-06 03:31:31 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-07 03:30:37 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
2019-08-08 03:30:06 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
openqaworker1
2019-08-08 03:30:31 ERROR: UNKNOWN_INTERFACE: 'tap131' is not in any zone
2019-08-08 03:30:31 ERROR: UNKNOWN_INTERFACE: 'tap132' is not in any zone
2019-08-08 03:30:32 ERROR: UNKNOWN_INTERFACE: 'tap133' is not in any zone
2019-08-08 03:30:32 ERROR: UNKNOWN_INTERFACE: 'tap64' is not in any zone
2019-08-08 03:30:32 ERROR: UNKNOWN_INTERFACE: 'tap65' is not in any zone
2019-08-08 03:30:33 ERROR: UNKNOWN_INTERFACE: 'tap66' is not in any zone
2019-08-08 03:30:33 ERROR: UNKNOWN_INTERFACE: 'tap67' is not in any zone
2019-08-08 03:30:33 ERROR: UNKNOWN_INTERFACE: 'tap68' is not in any zone
2019-08-08 03:30:34 ERROR: UNKNOWN_INTERFACE: 'tap69' is not in any zone
2019-08-08 03:30:35 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
openqaworker4
2019-01-17 03:30:07 ERROR: UNKNOWN_INTERFACE: 'eth0' is not in any zone
rebel
- Status changed from Feedback to Workable
- Assignee deleted (
okurz)
- Target version set to Ready
- Tags changed from caching, openQA, sporadic, arm, ipmi, worker to worker
- Priority changed from Normal to Low
- Target version changed from Ready to future
Also available in: Atom
PDF