yahoo-eng-team team mailing list archive

Thread
Date

[Bug 1658460] [NEW] Duplicate metadata iptables rules in HA router

To: yahoo-eng-team@xxxxxxxxxxxxxxxxxxx
From: Quan Tian <tianquan@xxxxxxxxxx>
Date: Sun, 22 Jan 2017 11:45:17 -0000
Reply-to: Bug 1658460 <1658460@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

Public bug reported:

For a HA router, when it's updated, the l3 agents which are standby
would always call the after_router_added method, due to that only the
active node spawn monitored metadata proxy. Then duplicate metadata
rules are added to iptables table. Althrough these rules will not be
applied to system because of the _weed_out_duplicates method, they will
grow linearly with router update operations. For example, 10 updates
result in 4*10 duplicate rules.

How to reproduce:
1. create a ha router
2. update the router in anyway, ex: do router-gateway-set and router-gateway-clear repeatedly
3. on standby l3 agents, you can see the warnings:
2017-01-22 15:53:47.632 WARNING neutron.agent.linux.iptables_manager [-] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-l3-agent-INPUT -p tcp -m tcp --dport 9697 -j DROP
2017-01-22 15:53:47.633 WARNING neutron.agent.linux.iptables_manager [-] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-l3-agent-INPUT -m mark --mark 0x1/0xffff -j ACCEPT
2017-01-22 15:53:47.634 WARNING neutron.agent.linux.iptables_manager [-] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-l3-agent-INPUT -p tcp -m tcp --dport 9697 -j DROP
2017-01-22 15:53:47.634 WARNING neutron.agent.linux.iptables_manager [-] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-l3-agent-INPUT -m mark --mark 0x1/0xffff -j ACCEPT
2017-01-22 15:53:47.635 WARNING neutron.agent.linux.iptables_manager [-] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -i qr-+ -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x1/0xffff
2017-01-22 15:53:47.636 WARNING neutron.agent.linux.iptables_manager [-] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -i qr-+ -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x1/0xffff
2017-01-22 15:53:47.637 WARNING neutron.agent.linux.iptables_manager [-] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -i qr-+ -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9697
2017-01-22 15:53:47.637 WARNING neutron.agent.linux.iptables_manager [-] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -i qr-+ -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9697
4. the warnings grow linearly with router update times.

** Affects: neutron
Importance: Undecided
Assignee: Quan Tian (tianquan23)
Status: In Progress

--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1658460

Title:
Duplicate metadata iptables rules in HA router

Status in neutron:
In Progress

Bug description:
For a HA router, when it's updated, the l3 agents which are standby
would always call the after_router_added method, due to that only the
active node spawn monitored metadata proxy. Then duplicate metadata
rules are added to iptables table. Althrough these rules will not be
applied to system because of the _weed_out_duplicates method, they
will grow linearly with router update operations. For example, 10
updates result in 4*10 duplicate rules.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1658460/+subscriptions

Follow ups

[Bug 1658460] Re: Duplicate metadata iptables rules in HA router
From: OpenStack Infra, 2017-03-21