Salt - Qubes R4 RC1 - fails to set sys-whonix's NetVM to default (sys-firewall)

[adrelanos]

Salt - Qubes R4 RC1 - fails to set sys-whonix's NetVM to default (sys-firewall)

Qubes OS version:

Qubes R4 with all Qubes testing repositories

Affected TemplateVMs:

Dom0

---

Steps to reproduce the behavior:

Install Qubes R4 with all Qubes testing repositories.

Enable Qubes community templates repository in /etc/yum.repos.d/qubes-templates.repo.

sudo qubes-dom0-update qubes-template-whonix-gw qubes-template-whonix-ws

(Did last command because of #3188.)

sudo qubesctl state.sls qvm.sys-whonix

Expected behavior:

sys-whonix's NetVM set to default (sys-firewall).

Actual behavior:

sys-whonix's NetVM set to none.

General notes:

While running sudo qubesctl state.sls qvm.sys-whonix it is showing

===== [prefs] =====
[Skipped] netvm: sys-firewall

---

Related issues:

#2157
#2954

[marmarek]

Does it also happen when you remove sys-whonix and create it from scratch using salt?

[marmarek]

Does it also happen when you remove sys-whonix and create it from scratch using salt?

[adrelanos]

It was created from scratch using salt as far as I understand.

[adrelanos]

It was created from scratch using salt as far as I understand.

[marmarek]

But #3188 should not apply if you have template already installed.

[marmarek]

But #3188 should not apply if you have template already installed.

[adrelanos]

Is this a duplicate / follow-up issue of #3190?

[adrelanos]

Is this a duplicate / follow-up issue of #3190?

[marmarek]

While running sudo qubesctl state.sls qvm.sys-whonix it is showing

===== [prefs] =====
[Skipped] netvm: sys-firewall

I assume it was [SKIP] netvm: sys-firewall. That means netvm was already set to sys-firewall (the default value). But later changing provides_network to True made it changed to None as in #3190.

Is this a duplicate / follow-up issue of #3190?

Depends on what we want here. If sys-whonix following default_fw_netvm is ok, then it's dupplicate of #3190. If should be set statically to sys-firewall, regardless of default_*, then it's independent bug.

[marmarek]

While running sudo qubesctl state.sls qvm.sys-whonix it is showing

===== [prefs] =====
[Skipped] netvm: sys-firewall

I assume it was [SKIP] netvm: sys-firewall. That means netvm was already set to sys-firewall (the default value). But later changing provides_network to True made it changed to None as in #3190.

Is this a duplicate / follow-up issue of #3190?

Depends on what we want here. If sys-whonix following default_fw_netvm is ok, then it's dupplicate of #3190. If should be set statically to sys-firewall, regardless of default_*, then it's independent bug.

[marmarek]

BTW default_fw_netvm should be set to sys-net, not sys-firewall. It is a default netvm for "ProxyVMs", which include sys-firewall.

[marmarek]

BTW default_fw_netvm should be set to sys-net, not sys-firewall. It is a default netvm for "ProxyVMs", which include sys-firewall.

[adrelanos]

Marek Marczykowski-Górecki:

> While running sudo qubesctl state.sls qvm.sys-whonix it is showing > > ===== [prefs] ===== > [Skipped] netvm: sys-firewall I assume it was `[SKIP] netvm: sys-firewall`.

Yes.

That means netvm was already set to sys-firewall (the default value). But later changing `provides_network` to `True` made it changed to `None` as in #3190.

I see.

> Is this a duplicate / follow-up issue of #3190? Depends on what we want here. If `sys-whonix` following `default_fw_netvm` is ok, then it's dupplicate of #3190. If should be set statically to `sys-firewall`, regardless of `default_*`, then it's independent bug.

Alright, let's consider it an independent bug. Let's keep sys-whonix default NetVM set to sys-firewall. This is what we decided for R3.2. (Reasoning was iirr: let's see what awesome features sys-firewall might get in future.) Maybe we would need a property `default_fw_proxyvm`? Then we regards Whonix a ProxyVM and set to `default_fw_netvm`?

[adrelanos]

Marek Marczykowski-Górecki:

> While running sudo qubesctl state.sls qvm.sys-whonix it is showing > > ===== [prefs] ===== > [Skipped] netvm: sys-firewall I assume it was `[SKIP] netvm: sys-firewall`.

Yes.

That means netvm was already set to sys-firewall (the default value). But later changing `provides_network` to `True` made it changed to `None` as in #3190.

I see.

> Is this a duplicate / follow-up issue of #3190? Depends on what we want here. If `sys-whonix` following `default_fw_netvm` is ok, then it's dupplicate of #3190. If should be set statically to `sys-firewall`, regardless of `default_*`, then it's independent bug.

Alright, let's consider it an independent bug. Let's keep sys-whonix default NetVM set to sys-firewall. This is what we decided for R3.2. (Reasoning was iirr: let's see what awesome features sys-firewall might get in future.) Maybe we would need a property `default_fw_proxyvm`? Then we regards Whonix a ProxyVM and set to `default_fw_netvm`?

[adrelanos]

To provide the requested debug output...

qvm-kill sys-whonix
qvm-remove sys-whonix
sudo qubesctl state.sls qvm.sys-whonix

(If that is what you wanted me to test...?)

Currently cannot test this. Blocked by qvm-remove sys-whonix broken for me as per #3193.

[adrelanos]

To provide the requested debug output...

qvm-kill sys-whonix
qvm-remove sys-whonix
sudo qubesctl state.sls qvm.sys-whonix

(If that is what you wanted me to test...?)

Currently cannot test this. Blocked by qvm-remove sys-whonix broken for me as per #3193.

[marmarek]

Let's keep sys-whonix default NetVM set to sys-firewall. This is what we decided for R3.2. (Reasoning was iirr: let's see what awesome features sys-firewall might get in future.)

I'm not sure what sys-firewall could do with tor traffic, but lets not change this last minute.

[marmarek]

Let's keep sys-whonix default NetVM set to sys-firewall. This is what we decided for R3.2. (Reasoning was iirr: let's see what awesome features sys-firewall might get in future.)

I'm not sure what sys-firewall could do with tor traffic, but lets not change this last minute.

[adrelanos]

Marek Marczykowski-Górecki:

> Let's keep sys-whonix default NetVM set to sys-firewall. This is what we decided for R3.2. (Reasoning was iirr: let's see what awesome features sys-firewall might get in future.) I'm not sure what sys-firewall could do with tor traffic,

Perhaps something like corridor [1], traffic shaping or whatever other creative use I cannot envision yet.

but lets not change this last minute.

Yes. [1] https://www.whonix.org/wiki/Corridor

[adrelanos]

Marek Marczykowski-Górecki:

> Let's keep sys-whonix default NetVM set to sys-firewall. This is what we decided for R3.2. (Reasoning was iirr: let's see what awesome features sys-firewall might get in future.) I'm not sure what sys-firewall could do with tor traffic,

Perhaps something like corridor [1], traffic shaping or whatever other creative use I cannot envision yet.

but lets not change this last minute.

Yes. [1] https://www.whonix.org/wiki/Corridor

[adrelanos]

To provide the debug output...

qvm-remove sys-whonix
sudo qubesctl state.sls qvm.sys-whonix

Same is happening.

===== [prefs] =====
[Skipped] netvm: sys-firewall

[adrelanos]

To provide the debug output...

qvm-remove sys-whonix
sudo qubesctl state.sls qvm.sys-whonix

Same is happening.

===== [prefs] =====
[Skipped] netvm: sys-firewall

[qubesos-bot]

Automated announcement from builder-github

The package qubes-mgmt-salt-dom0-qvm-4.0.5-1.fc25 has been pushed to the r4.0 testing repository for dom0.
To test this update, please install it with the following command:

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-mgmt-salt-dom0-qvm-4.0.5-1.fc25 has been pushed to the r4.0 testing repository for dom0.
To test this update, please install it with the following command:

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-mgmt-salt-dom0-qvm-4.0.5-1.fc25 has been pushed to the r4.0 stable repository for dom0.
To install this update, please use the standard update command:

sudo qubes-dom0-update

Or update dom0 via Qubes Manager.

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-mgmt-salt-dom0-qvm-4.0.5-1.fc25 has been pushed to the r4.0 stable repository for dom0.
To install this update, please use the standard update command:

sudo qubes-dom0-update

Or update dom0 via Qubes Manager.

Changes included in this update