Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-59148

Improve logging when connection fails due to 802-3-ethernet.mac-address-denylist

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • None
    • 1
    • rhel-net-mgmt
    • ssg_networking
    • 3
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • NMT SST - Future releases
    • Hide

      Definition of Done:

      Please mark each item below with ( / ) if completed or ( x ) if incomplete:

      ( ) The acceptance criteria defined below are met.

      Given a system administrator is configuring NetworkManager with the 802-3-ethernet.mac-address-denylist property that prevents a specific MAC address from connecting and attempts to connect using a network interface that is included in the denylist, 

      When the connection attempt is blocked because the network interface’s MAC address matches an entry on the denylist, 

      Then:

      • The error log should clearly indicate that the connection was denied due to the 802-3-ethernet.mac-address-denylist setting.
      • The trace log should include a detailed message explaining why the connection failed, explicitly mentioning the denylist.
      • The correct network interface name should be displayed in all related logs, avoiding any incorrect or misleading information.

      Definition of Done:

      • The implementation meets the acceptance criteria
      • Integration tests are written and pass
      • The code is part of a downstream build attached to an errata

      ( ) Code changes are included in a downstream build attached to an errata.

      ( ) All required testing (manual and/or automated) passes successfully.

      ( ) Related documentation updates (if applicable) have been completed.

      Show
      Definition of Done: Please mark each item below with ( / ) if completed or ( x ) if incomplete: ( ) The acceptance criteria defined below are met. Given a system administrator is configuring NetworkManager with the 802-3-ethernet.mac-address-denylist property that prevents a specific MAC address from connecting and attempts to connect using a network interface that is included in the denylist,  When the connection attempt is blocked because the network interface’s MAC address matches an entry on the denylist,  Then: The error log should clearly indicate that the connection was denied due to the 802-3-ethernet.mac-address-denylist setting. The trace log should include a detailed message explaining why the connection failed, explicitly mentioning the denylist. The correct network interface name should be displayed in all related logs, avoiding any incorrect or misleading information. Definition of Done: The implementation meets the acceptance criteria Integration tests are written and pass The code is part of a downstream build attached to an errata ( ) Code changes are included in a downstream build attached to an errata. ( ) All required testing (manual and/or automated) passes successfully. ( ) Related documentation updates (if applicable) have been completed.
    • None
    • None
    • All
    • Linux
    • None

      Goal:

      Improve logging when connection fails due to 802-3-ethernet.mac-address-denylist

       

      With mac-address-denylist added in config file, profile does not start:

       

      1. nmcli connection modify enp7s0 802-3-ethernet.mac-address-denylist 52:54:00:2a:5d:80
      1. nmcli con down enp7s0;nmcli con up enp7s0

      Connection 'enp7s0' successfully deactivated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/34)

      Error: Connection activation failed: No suitable device found for this connection (device enp1s0 not available because profile is not compatible with device (mismatching interface name)).

       

      However, when we look at trace logs, it does not tell that it was  failed due to “802-3-ethernet.mac-address-denylist” setting even in trace logs:

       

      Corresponding NM logs:

      Sep 17 09:33:54 localhost.localdomain NetworkManager[796]: <trace> [1726580034.3827] secret-agent[ba7895311d390c57]: constructed: :1.229/nmcli-connect/0, owner="root" (unix-process[pid=6388, uid=0, start=1833956]), unique-name=":1.2", capabilities=vpn-hints

      Sep 17 09:33:54 localhost.localdomain NetworkManager[796]: <debug> [1726580034.3837] agent-manager: agent[ba7895311d390c57,:1.229/nmcli-connect/0]: requesting permissions

      Sep 17 09:33:54 localhost.localdomain NetworkManager[796]: <trace> [1726580034.3838] auth: call[113]: CheckAuthorization(org.freedesktop.NetworkManager.wifi.share.protected), subject=unix-process[pid=6388, uid=0, start=1833956] (succeeding for root)

      Sep 17 09:33:54 localhost.localdomain NetworkManager[796]: <trace> [1726580034.3839] auth: call[114]: CheckAuthorization(org.freedesktop.NetworkManager.wifi.share.open), subject=unix-process[pid=6388, uid=0, start=1833956] (succeeding for root)

      Sep 17 09:33:54 localhost.localdomain NetworkManager[796]: <trace> [1726580034.3841] auth: call[113]: completed: authorized=1, challenge=0 (simulated)

      Sep 17 09:33:54 localhost.localdomain NetworkManager[796]: <trace> [1726580034.3842] auth: call[114]: completed: authorized=1, challenge=0 (simulated)

      Sep 17 09:33:54 localhost.localdomain NetworkManager[796]: <info>  [1726580034.3843] agent-manager: agent[ba7895311d390c57,:1.229/nmcli-connect/0]: agent registered

      Sep 17 09:33:54 localhost.localdomain NetworkManager[796]: <debug> [1726580034.3846] policy: re-enabling autoconnect for all connections (only clear no-secrets flag)

      Sep 17 09:33:54 localhost.localdomain NetworkManager[796]: <trace> [1726580034.3921] secret-agent[ba7895311d390c57]: name-owner-changed: has :1.229

      Sep 17 09:33:54 localhost.localdomain NetworkManager[796]: <info>  [1726580034.3936] audit: op="connection-activate" uuid="88e06407-e4fc-4ee6-ac50-ea648b215d16" name="enp7s0" result="fail" reason="No suitable device found for this connection (device enp1s0 not available because profile is not compatible with device (mismatching interface name))."

      Sep 17 09:33:54 localhost.localdomain NetworkManager[796]: <trace> [1726580034.4018] secret-agent[ba7895311d390c57]: name-owner-changed: disconnected

      Sep 17 09:33:54 localhost.localdomain NetworkManager[796]: <debug> [1726580034.4022] agent-manager: agent[ba7895311d390c57,:1.229/nmcli-connect/0]: agent unregistered or disappeared

      Sep 17 09:33:54 localhost.localdomain NetworkManager[796]: <trace> [1726580034.4024] secret-agent[ba7895311d390c57]: finalized

       

      Expectation:

      1. I expect atleast in trace log should print that connection is failing due to 802-3-ethernet.mac-address-denylist property set

      2. error logs says enp1s0 but error is for enp7s0, so it should print correct interface in  error.

      Error: Connection activation failed: No suitable device found for this connection (device enp1s0 not available because profile is not compatible with device (mismatching interface name)).

       

              rh-ee-sfaye Stanislas Faye
              prpatel@redhat.com Prijesh Patel
              Network Management Team Network Management Team
              Vladimir Benes Vladimir Benes
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: