yahoo-eng-team team mailing list archive

[Ramu Ramamurthy <ramu.ramamurthy@xxxxxxxxxx>]

** Changed in: neutron
       Status: New => Invalid

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1494039

Title:
  Must audit SG chains upon ovs-agent restart

Status in neutron:
  Invalid

Bug description:
  I am running Kilo 2015.1.0, with neutron-OVS, and iptables firewall.

  I run into situations, where, the iptables SG chains/rules are
  inconsistent with ovs-ports, and system interfaces - see below for an
  example. In these situations, when I restart neutron-ovs-agent, I
  expect that such inconsistencies are cleaned up. But they are not -
  the iptables inconsistencies remain after the restart of neutron-ovs-
  agent.

  By design, the neutron-ovs-agent must audit hw-resources (iptables in
  this case) during startup , and cleanup inconsistencies/deltas between
  whats in iptables vs whats in the control plane (ports)

  The audit can look something like this:

         1.   IptablesManager  recovers iptables chains during startup and marks all of them as "To Be Audited".
         2.   NeutronOvsAgent programs firewall rules for devices during startup
         3.   As chains are programmed, Iptables clears the "to be audited" state
         4.  Chains which still have the "To Be Audited" flag at the end of the init phase are removed.

  ----- Inconsistency between OVS ports, System Interfaces and Iptables

  [root@rhel7-25 agent]# iptables -S
  -P INPUT ACCEPT
  -P FORWARD ACCEPT
  -P OUTPUT ACCEPT
  -N neutron-filter-top
  -N neutron-openvswi-FORWARD
  -N neutron-openvswi-INPUT
  -N neutron-openvswi-OUTPUT
  -N neutron-openvswi-i76845da1-5   <<<<<<<< inconsistent chains, these remain as garbage
  -N neutron-openvswi-ie3cb2e38-a
  -N neutron-openvswi-local
  -N neutron-openvswi-o76845da1-5
  -N neutron-openvswi-oe3cb2e38-a
  -N neutron-openvswi-s76845da1-5
  -N neutron-openvswi-se3cb2e38-a
  -N neutron-openvswi-sg-chain
  -N neutron-openvswi-sg-fallback

  [root@rhel7-25 agent]# ovs-vsctl show
  ce7f5dac-9d4d-4354-9cfd-4d94dfaf1697
      Bridge br-int
          fail_mode: secure
          Port patch-tun
              Interface patch-tun
                  type: patch
                  options: {peer=patch-int}
          Port br-int
              Interface br-int
                  type: internal
      Bridge br-tun
          fail_mode: secure
          Port "vxlan-0a0a0a1e"
              Interface "vxlan-0a0a0a1e"
                  type: vxlan
                  options: {csum="true", df_default="true", in_key=flow, local_ip="10.10.10.25", out_key=flow, remote_ip="10.10.10.30"}
          Port "vxlan-0a0a0a17"
              Interface "vxlan-0a0a0a17"
                  type: vxlan
                  options: {csum="true", df_default="true", in_key=flow, local_ip="10.10.10.25", out_key=flow, remote_ip="10.10.10.23"}
          Port patch-int
              Interface patch-int
                  type: patch
                  options: {peer=patch-tun}
          Port "vxlan-0a0a0a15"
              Interface "vxlan-0a0a0a15"
                  type: vxlan
                  options: {csum="true", df_default="true", in_key=flow, local_ip="10.10.10.25", out_key=flow, remote_ip="10.10.10.21"}
          Port br-tun
              Interface br-tun
                  type: internal
      ovs_version: "2.3.0"

  [root@rhel7-25 agent]# ip link
  1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT
      link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc mq state UP mode DEFAULT qlen 1000
      link/ether a0:36:9f:09:2c:20 brd ff:ff:ff:ff:ff:ff
  3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT qlen 1000
      link/ether a0:36:9f:09:2c:21 brd ff:ff:ff:ff:ff:ff
  4: eth2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN mode DEFAULT qlen 1000
      link/ether 34:40:b5:e5:68:60 brd ff:ff:ff:ff:ff:ff
  5: eth3: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN mode DEFAULT qlen 1000
      link/ether 34:40:b5:e5:68:64 brd ff:ff:ff:ff:ff:ff
  6: eth4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT qlen 1000
      link/ether 34:40:b5:e5:68:62 brd ff:ff:ff:ff:ff:ff
  7: eth5: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN mode DEFAULT qlen 1000
      link/ether 34:40:b5:e5:68:66 brd ff:ff:ff:ff:ff:ff
  8: usb0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN mode DEFAULT qlen 1000
      link/ether 36:40:b5:e8:b4:37 brd ff:ff:ff:ff:ff:ff
  29133: br-int: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT
      link/ether 56:bf:95:17:ad:4d brd ff:ff:ff:ff:ff:ff
  29134: br-tun: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT
      link/ether 66:6a:80:04:d8:4b brd ff:ff:ff:ff:ff:ff
  20695: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT
      link/ether 6e:c5:a4:c5:89:b5 brd ff:ff:ff:ff:ff:ff

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1494039/+subscriptions