NAME_CONFLICT error when adding service about puppet-firewalld HOT 5 CLOSED

On the system in question (or an equivalent one set up for testing), can you verify that prior to the puppet code you posted being run, firewall-cmd --permanent --get-services does not list the xrdp service (you may need to comment that code out and run the rest of it if this is a service puppet is installing)? While you're at it, check the running config too with firewall-cmd --get-services

If you can confirm that it doesn't appear, and your proposed workaround does work where the current implementation doesn't, I can refactor the code to do that in the next few days.

from puppet-firewalld.

I can confirm the error when the the xrdp service did not exist beforehand. Note that try-firewall.pp only contains the code block from my original comment. Here are the commands that I ran and the output:

# firewall-cmd --permanent --remove-service xrdp
success
# rm -f /etc/firewalld/services/xrdp.xml
# systemctl restart firewalld
# firewall-cmd --permanent --get-services | grep -i rdp
# firewall-cmd --get-services | grep -i rdp
# puppet apply ./try-firewall.pp 
Notice: Compiled catalog for linux.example.com in environment production in 0.47 seconds
Notice: /Stage[main]/Main/Firewalld::Custom_service[XRDP service]/File[/etc/firewalld/services/xrdp.xml]/ensure: created
Notice: /Stage[main]/Main/Firewalld::Custom_service[XRDP service]/Exec[firewalld::custom_service::reload-XRDP service]: Triggered 'refresh' from 1 events
Error: Execution of '/bin/firewall-cmd --permanent --new-service xrdp' returned 26: Error: NAME_CONFLICT: xrdp
Error: /Stage[main]/Main/Firewalld::Custom_service[XRDP service]/Firewalld_custom_service[xrdp]/ensure: change from absent to present failed: Execution of '/bin/firewall-cmd --permanent --new-service xrdp' returned 26: Error: NAME_CONFLICT: xrdp
Notice: /Stage[main]/Main/Firewalld_service[Allow XRDP from the public zone]/ensure: created
Notice: Finished catalog run in 6.54 seconds

from puppet-firewalld.

Thanks for the log, it perfectly identifies the issue. Your proposed fix is essentially correct, however your optional step 2 wouldn't work, as it's valid to create a custom service that overrides a built-in one (e.g. declare a custom service for SSH that uses a different port than the predefined one), and doing nothing if the service name appears in the active config would be wrong, as FirewallD would continue using the old service until something else triggered a reload (which may not happen automatically, depending on what else is in the catalog). That being said, it's an easy fix. I'll have a pull request in later today for this.

from puppet-firewalld.

Pull request opened, it's in crayfishx's hands now.

from puppet-firewalld.

Thanks for the pull request and explaining firewalld better.

from puppet-firewalld.