Skip to content

Commit 868f4f0

Browse files
richmrichm
committed
test: ensure interface chosen is managed by NetworkManager
NetworkManager must be running for this test to work, so ensure it. Ensure that the interface chosen is an active connected device managed by NM. Signed-off-by: Rich Megginson <rmeggins@redhat.com>
1 parent 2fdb7fd commit 868f4f0

File tree

1 file changed

+114
-43
lines changed

1 file changed

+114
-43
lines changed

‎tests/tests_interface_pci.yml‎

Lines changed: 114 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -17,31 +17,37 @@
1717
__firewall_is_rh_distro_fedora and
1818
ansible_facts['distribution_major_version'] is version('8', '>=') }}"
1919

20-
- name: Find ethernet interface
20+
- name: Find ethernet interfaces with PCI devices
2121
shell: |
2222
set -euo pipefail
23-
I=$(find /sys/class/net -name 'e*' | head -n1)
24-
# containers only have virtual devices; for PCI we need a real one
25-
if [ -n "$I" ] && [ -e "$I/device/vendor" ]; then
26-
echo "$I"
27-
fi
28-
register: find_iface
23+
find /sys/class/net -name 'e*' | while read -r iface_path; do
24+
# containers only have virtual devices; for PCI we need a real one
25+
if [ -n "$iface_path" ] && [ -e "$iface_path/device/vendor" ] && [ -e "$iface_path/device/device" ]; then
26+
echo "$iface_path"
27+
fi
28+
done
29+
register: find_iface_paths
2930
changed_when: false
3031

31-
- name: Debug
32-
shell: |
33-
set -euxo pipefail
34-
exec 1>&2
35-
ip addr
36-
ls -alrtF /sys/class/net
37-
ls -alrtF /sys/class/net/*/device/vendor || :
38-
ls -alrtF /sys/class/net/*/device/device || :
39-
changed_when: false
32+
- name: Determine if system is ostree and set flag
33+
when: not __firewall_is_ostree is defined
34+
block:
35+
- name: Check if system is ostree
36+
stat:
37+
path: /run/ostree-booted
38+
register: __ostree_booted_stat
39+
40+
- name: Set flag to indicate system is ostree
41+
set_fact:
42+
__firewall_is_ostree: "{{ __ostree_booted_stat.stat.exists }}"
4043

4144
- name: Test interfaces with PCI ids
4245
# this can't be tested in containers or similar envs without any real
4346
# ethernet devices
44-
when: find_iface.stdout != ""
47+
when: find_iface_paths.stdout_lines | length > 0
48+
vars:
49+
iface_path: "{{ pci_id_result.stdout_lines[0] }}"
50+
pci_id: "{{ pci_id_result.stdout_lines[1] }}"
4551
block:
4652
- name: Get temp directory
4753
tempfile:
@@ -57,37 +63,70 @@
5763
changed_when: false
5864
when: nftables_backend | bool
5965

60-
- name: Determine interface vendor/product ID
66+
- name: Debug - get iptables ruleset before
6167
shell: |
6268
set -euo pipefail
63-
VID="$(sed 's/^0x//' < {{ find_iface.stdout | quote }}/device/vendor)"
64-
PID="$(sed 's/^0x//' < {{ find_iface.stdout | quote }}/device/device)"
65-
echo "$VID:$PID"
66-
register: pci_id
69+
iptables -S > {{ temp_dir.path }}/iptables_before.txt || :
6770
changed_when: false
71+
when: not nftables_backend | bool
6872

69-
- name: Set up for el7
70-
when:
71-
- __firewall_is_rh_distro
72-
- ansible_facts['distribution_major_version'] is version('8', '<')
73-
block:
74-
- name: Install NetworkManager
75-
package:
76-
name: NetworkManager
77-
state: present
78-
79-
- name: Start NetworkManager
80-
service:
81-
name: NetworkManager
82-
state: started
73+
- name: Ensure NetworkManager is installed
74+
package:
75+
name: NetworkManager
76+
state: present
77+
use: "{{ (__firewall_is_ostree | d(false)) |
78+
ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
79+
register: nm_package_result
80+
81+
- name: Ensure NetworkManager is started
82+
service:
83+
name: NetworkManager
84+
state: started
85+
register: nm_service_result
86+
87+
- name: Debug - List devices managed by NetworkManager
88+
shell: |
89+
set -euo pipefail
90+
nmcli --fields all device status
91+
for dev in $(nmcli --fields DEVICE -t -c no device status); do
92+
echo "################### device: $dev ###################"
93+
nmcli --fields all device show "$dev"
94+
echo ""
95+
done
96+
changed_when: false
97+
98+
- name: Find the first interface with PCI devices that is managed by NetworkManager
99+
shell: |
100+
set -euo pipefail
101+
for iface in {{ find_iface_paths.stdout_lines | map("quote") | join(" ") }}; do
102+
# get the full real device path
103+
full_path="$(readlink -f "$iface")"
104+
# now, find the device with the matching GENERAL.UDI path in the nmcli output
105+
for dev in $(nmcli --fields DEVICE -t -c no device status); do
106+
# see if device is connected - state is 100
107+
if [[ "$(nmcli -g GENERAL.STATE -e no device show "$dev")" =~ ^100($|\ ) ]]; then
108+
udi="$(nmcli -g GENERAL.UDI -e no device show "$dev")"
109+
full_udi="$(readlink -f "$udi")"
110+
if [ "$full_path" = "$full_udi" ]; then
111+
VID="$(sed 's/^0x//' < "$full_path/device/vendor")"
112+
PID="$(sed 's/^0x//' < "$full_path/device/device")"
113+
echo "$iface"
114+
echo "$VID:$PID"
115+
break 2
116+
fi
117+
fi
118+
done
119+
done
120+
register: pci_id_result
121+
changed_when: false
83122

84123
- name: Add pci device ethernet controller
85124
include_role:
86125
name: linux-system-roles.firewall
87126
vars:
88127
firewall:
89128
zone: internal
90-
interface_pci_id: "{{ pci_id.stdout }}"
129+
interface_pci_id: "{{ pci_id }}"
91130
state: enabled
92131
permanent: true
93132

@@ -97,7 +136,7 @@
97136
vars:
98137
firewall:
99138
zone: internal
100-
interface_pci_id: "{{ pci_id.stdout }}"
139+
interface_pci_id: "{{ pci_id }}"
101140
state: enabled
102141
permanent: true
103142

@@ -119,10 +158,19 @@
119158
- name: Assert that interface is in nftable ruleset
120159
assert:
121160
that:
122-
- find_iface.stdout | basename in nft_list.stdout
123-
- pci_id.stdout | trim not in nft_list.stdout
161+
- iface_path | basename in nft_list.stdout
162+
- pci_id | trim not in nft_list.stdout
124163
when: nftables_backend | bool
125164

165+
- name: Debug - get iptables ruleset after and show diff
166+
shell: |
167+
set -euo pipefail
168+
iptables -S > {{ temp_dir.path }}/iptables_after.txt || :
169+
diff -u {{ temp_dir.path }}/iptables_before.txt {{ temp_dir.path }}/iptables_after.txt || :
170+
rm -rf {{ temp_dir.path }}
171+
changed_when: false
172+
when: not nftables_backend | bool
173+
126174
- name: Get iptables ruleset
127175
command: iptables -S
128176
register: ipt_list
@@ -132,8 +180,8 @@
132180
- name: Assert that interface is in iptables ruleset
133181
assert:
134182
that:
135-
- find_iface.stdout | basename in ipt_list.stdout
136-
- pci_id.stdout | trim not in ipt_list.stdout
183+
- iface_path | basename in ipt_list.stdout
184+
- pci_id | trim not in ipt_list.stdout
137185
when: not nftables_backend | bool
138186

139187
- name: Remove interface from internal
@@ -142,10 +190,33 @@
142190
vars:
143191
firewall:
144192
zone: internal
145-
interface_pci_id: "{{ pci_id.stdout }}"
193+
interface_pci_id: "{{ pci_id }}"
146194
state: disabled
147195
permanent: true
148196
always:
197+
- name: Remove temporary directory
198+
file:
199+
path: "{{ temp_dir.path }}"
200+
state: absent
201+
when: temp_dir.path is defined
202+
203+
- name: Stop NetworkManager if it was not started by the test
204+
service:
205+
name: NetworkManager
206+
state: stopped
207+
when:
208+
- nm_service_result is defined
209+
- nm_service_result is changed
210+
211+
- name: Remove NetworkManager if it was not installed by the test
212+
package:
213+
name: NetworkManager
214+
state: absent
215+
when:
216+
- not __firewall_is_ostree
217+
- nm_package_result is defined
218+
- nm_package_result is changed
219+
149220
- name: Cleanup
150221
tags:
151222
- tests::cleanup

0 commit comments

Comments
 (0)