QA » openQA Project » openQA Infrastructure

debugged multi-machine with sebchlad. after reboot of workers some tests failed, in particular on arm3. osd workers are still on SuSEfirewall2, o3 workers are on firewalld. I could not find a ticket describing that we need to migrate to firewalld. I ran wicked advanced tests on arm with openqa-clone-job --skip-chained-deps --parental-inheritance --within-instance https://openqa.suse.de 4341663 _GROUP=0 BUILD=X WORKER_CLASS=openqaworker-arm-3 TEST=wicked_advanced_okurz and both test jobs passed while hpc_slurm tests showed problems. I showed and explained to sebchlad our current monitoring and recovery actions and the custom clone command. firewalld runs as service so we can check if the service runs and alert otherwise. For SuSEfirewall2 on startup that runs but exits so we can not rely on the systemd service for everything to be still in order, e.g.:

okurz@openqaworker-arm-3:~> sudo systemctl status SuSEfirewall2
● SuSEfirewall2.service - SuSEfirewall2 phase 2
   Loaded: loaded (/usr/lib/systemd/system/SuSEfirewall2.service; enabled; vendor preset: disabled)
   Active: active (exited) since Fri 2020-06-12 16:29:07 CEST; 2 days ago
…
Jun 12 16:28:31 openqaworker-arm-3 SuSEfirewall2[3846]: Warning: /proc/sys/net/ipv4/ip_forward is not enabled, but required for FW_ROUTE, you should configure this in /etc/sysctl.conf. This option has been implicitly enabled now.
Jun 12 16:28:31 openqaworker-arm-3 SuSEfirewall2[3846]: <36>Jun 12 16:28:31 SuSEfirewall2[3846]: Warning: /proc/sys/net/ipv4/ip_forward is not enabled, but required for FW_ROUTE, you should configure this in /etc/sysctl.conf. This option has been implicitly enabled now.
Jun 12 16:29:07 openqaworker-arm-3 SuSEfirewall2[3846]: Firewall rules successfully set
Jun 12 16:29:07 openqaworker-arm-3 systemd[1]: Started SuSEfirewall2 phase 2.

so firewall was started. However:

okurz@openqaworker-arm-3:~> sudo SuSEfirewall2 status
<35>Jun 15 09:51:43 SuSEfirewall2[7051]: SuSEfirewall2 not active

and also iptables shows a problem:

openqa:/srv/salt # salt -l error --no-color -C  'G@roles:worker' cmd.run 'iptables -L | head -n 3'
openqaworker9.suse.de:
    Chain INPUT (policy DROP)
    target     prot opt source               destination
    ACCEPT     all  --  anywhere             anywhere
…
openqaworker-arm-3.suse.de:
    Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

checking 1h later showed success though.

Created #68095 for migration of osd workers to firewalld.

Hello Oliver,

I don't know if my understanding is correct, but hopefully it can provide some help.

SUSE Linux Enterprise 15 introduces firewalld as the new software firewall, replacing SuSE-
firewall2. SuSEfirewall2 has not been removed from SUSE Linux Enterprise 15 and is still in
the Main repository. However, it is not included in the default installation, and firewalld is
installed by default in new installations.

There is no automatic migration, so you must migrate
to firewalld manually. firewalld includes a helper migration script, susefirewall2-to-
firewalld . Depending on the complexity of your SuSEfirewall2 configuration the script may
perform a perfect migration, or it may fail. Most likely it will partially succeed and you will
have to review your new firewalld configuration and make adjustments.
The resulting configuration will make firewalld behave somewhat like SuSEfirewall2. To take
full advantage of firewalld 's features you may elect to create a new configuration, rather than
trying to migrate your old configuration. It is safe to run the susefirewall2-to-firewalld
script with no options, as it makes no permanent changes to your system. However, if you are
administering the system remotely you could get locked out.
Install and run susefirewall2-to-firewalld :
root # zypper in susefirewall2-to-firewalld
root # susefirewall2-to-firewalld

rfan@openqaworker-arm-3:~> systemctl list-unit-files |grep firewall
SuSEfirewall2.service enabled

SuSEfirewall2_init.service enabled

SuSEfirewall2_setup.service enabled

rfan@openqaworker-arm-3:~> zypper se -s firewall
Loading repository data...
Reading installed packages...