4.0rc1 VM Settings window fails to load with error: FirewallModifiedOutsideError: it does not add up

[seandilda]

Qubes OS version (e.g., R3.2):

4.0rc1

Affected TemplateVMs (e.g., fedora-23, if applicable):

fedora-25

---

Expected behavior:

When clicking on 'VM Settings', the vm settings window should appear.

Actual behavior:

A window with the title 'Houson, we have a problem...' appears with the error message:

FirewallModifiedOutsideError: it does not add up
at line 9
of file /usr/bin/qubes-vm-settings

Expanding the details shows:

----
line: raise FirewallModifiedOutsideError('it does not add up')
func: get_firewall_conf
line no.: 288
file: /usr/lib/python3.5/site-packages/qubesmanager/firewall.py
----
line: conf = self.get_firewall_conf(vm)
func: set_vm
line no.: 331
file: /usr/lib/python3.5/site-packages/qubesmanager/firewall.py
----
line: model.set_vm(vm)
func: __init__
line no.: 98
file: /usr/lib/python3.5/site-packages/qubesmanager/settings.py
----
line: settings_window = VMSettingsWindow(vm, qapp, args.tab)
func: main
line no.: 999
file: /usr/lib/python3.5/site-packages/qubesmanager/settings.py
----
line: load_entry_point('qubesmanager==4.0.4', 'console_scripts', 'qubes-vm-settings')()
func: <module>
line no.: 9
file: /usr/bin/qubes-vm-settings

The firewall.xml for the VM is:

<firewall version="2">
  <rules>
    <rule>
      <properties>
        <property name="action">accept</property>
        <property name="dsthost">10.0.0.0/8</property>
      </properties>
    </rule>
    <rule>
      <properties>
        <property name="action">accept</property>
        <property name="specialtarget">dns</property>
      </properties>
    </rule>
  </rules>
</firewall>

Steps to reproduce the behavior:

Edit a VM's firewalls in the UI, select 'Deny network access except...', select 'Allow DNS queries', add '10.0.0.0/8' with protocol of 'any'.

Close and try to open the VM settings window again.

General notes:

---

Related issues:

[marmarek]

As a workaround there is qvm-firewall tool...

[marmarek]

As a workaround there is qvm-firewall tool...

[kitambi]

It appears that the trigger for this is actually the "Allow DNS Queries" checkbox. If you use qvm-firewall to remove the "special target" rule, then you're able to open the manager without this recurring. I was unable to check the "Allow connections to Updates Proxy" in my AppVM. I'm unsure of whether this just doesn't apply to AppVMs or if there's a bug selecting it, but the dialog disappears with rules added when OK is selected (and when qubes-vm-settings is reopened, the checkbox is empty).

[kitambi]

It appears that the trigger for this is actually the "Allow DNS Queries" checkbox. If you use qvm-firewall to remove the "special target" rule, then you're able to open the manager without this recurring. I was unable to check the "Allow connections to Updates Proxy" in my AppVM. I'm unsure of whether this just doesn't apply to AppVMs or if there's a bug selecting it, but the dialog disappears with rules added when OK is selected (and when qubes-vm-settings is reopened, the checkbox is empty).

[pugege]

Unable to access VM settings of restored appvms from R3.2 because of this persistent
error. Disabling the DNS box in those appvms before 3.2 backup did not correct the issue. Will this problem be addressed in the upcoming 4.0-rc2? Was unable to qvm-firewall appvm del, the "special target" rule. Kindly advise the specific cli required to accomplish the work around.
Thanks

[pugege]

Unable to access VM settings of restored appvms from R3.2 because of this persistent
error. Disabling the DNS box in those appvms before 3.2 backup did not correct the issue. Will this problem be addressed in the upcoming 4.0-rc2? Was unable to qvm-firewall appvm del, the "special target" rule. Kindly advise the specific cli required to accomplish the work around.
Thanks

[marmarta]

Fixed in QubesOS/qubes-manager@dd990c0 - now, an error in firewall does not error out the whole settings window; furthermore, reading existing rules and writing rules have been also been improved.

[marmarta]

Fixed in QubesOS/qubes-manager@dd990c0 - now, an error in firewall does not error out the whole settings window; furthermore, reading existing rules and writing rules have been also been improved.