yahoo-eng-team team mailing list archive

[Qin Zhao <chaochin@xxxxxxxxx>]

Public bug reported:

The logic of _modify_rules() seems not correct. For instance, assuming
that we have a in-memory table like this:

:bn-chain001 - [0:0]
:chain002 - [0:0]
[0:0] -A bn-chain001 rule001
[0:0] -A chain002 rule002

and iptables-save output like this:

# Generated by zhaoqin on mars
*zhaoqin
:bn-chain001 - [0:0]
[0:0] -A bn-chain001 rule001
[0:0] -A chain002 rule002
COMMIT
# Completed on moon

The current code of _modify_rules() will generate the following result:

# Generated by zhaoqin on mars
:chain002 - [0:0]
:bn-chain001 - [0:0]
[0:0] -A bn-chain001 rule001
[0:0] -A chain002 rule002
*zhaoqin
COMMIT
# Completed on moon

The root cause is that rule '[0:0] -A chain002 rule002' is in new_filter
list is removed, so that the current code will do 'rules_index -= 1'.
That is an incorrect action. The correct action is to do 'rules_index -=
1', if one chain entry in new_filter list is removed, because the chain
list is above the rule list.

** Affects: neutron
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1359072

Title:
  Incorrect logic of _modify_rules() in IptablesManager

Status in OpenStack Neutron (virtual network service):
  New

Bug description:
  The logic of _modify_rules() seems not correct. For instance, assuming
  that we have a in-memory table like this:

  :bn-chain001 - [0:0]
  :chain002 - [0:0]
  [0:0] -A bn-chain001 rule001
  [0:0] -A chain002 rule002

  and iptables-save output like this:

  # Generated by zhaoqin on mars
  *zhaoqin
  :bn-chain001 - [0:0]
  [0:0] -A bn-chain001 rule001
  [0:0] -A chain002 rule002
  COMMIT
  # Completed on moon

  The current code of _modify_rules() will generate the following
  result:

  # Generated by zhaoqin on mars
  :chain002 - [0:0]
  :bn-chain001 - [0:0]
  [0:0] -A bn-chain001 rule001
  [0:0] -A chain002 rule002
  *zhaoqin
  COMMIT
  # Completed on moon

  The root cause is that rule '[0:0] -A chain002 rule002' is in
  new_filter list is removed, so that the current code will do
  'rules_index -= 1'. That is an incorrect action. The correct action is
  to do 'rules_index -= 1', if one chain entry in new_filter list is
  removed, because the chain list is above the rule list.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1359072/+subscriptions