[Openstack-security] [Bug 1290486] Re: neutron-openvswitch-agent does not recreate flows after ovsdb-server restarts

OpenStack Infra 1290486 at bugs.launchpad.net
Sat Jun 7 05:07:01 UTC 2014


Reviewed:  https://review.openstack.org/96919
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=d00446be1739c93921e3b88763e05fc194ea9b2b
Submitter: Jenkins
Branch:    stable/icehouse

commit d00446be1739c93921e3b88763e05fc194ea9b2b
Author: Kyle Mestery <kmestery at cisco.com>
Date:   Fri May 16 04:21:32 2014 +0000

    Reprogram flows when ovs-vswitchd restarts
    
    When OVS is restarted, by default it will not reprogram flows which were
    programmed. For the case of the OVS agent, this means a restart will cause
    all traffic to be switched using the NORMAL action. This is undesirable for
    a number of reasons, including obvious security reasons.
    
    This change provides a way for the agent to check if a restart of ovs-vswitchd
    has happened in the main agent loop. If a restart of ovs-vswitchd is detected,
    the agent will run through the setup of the bridges on the host and reprogram
    flows for all the ports connected.
    
    DocImpact
    This changes adds a new table (table 23) to the integration bridge, with a
    single 'drop' flow. This is used to monitor OVS restarts and to reprogram
    flows from the agent.
    
    Conflicts:
    	neutron/plugins/openvswitch/common/constants.py
    
    Change-Id: If9e07465c43115838de23e12a4e0087c9218cea2
    Closes-Bug: #1290486
    (cherry picked from commit 8e9f00a19dab98e5cfc7ca32beb9f17ebb5bc1bb)


** Changed in: neutron/icehouse
       Status: In Progress => Fix Committed

-- 
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1290486

Title:
  neutron-openvswitch-agent does not recreate flows after ovsdb-server
  restarts

Status in OpenStack Neutron (virtual network service):
  Confirmed
Status in neutron icehouse series:
  Fix Committed
Status in tripleo - openstack on openstack:
  Triaged

Bug description:
  The DHCP requests were not being responded to after they were seen on
  the undercloud network interface.  The neutron services were restarted
  in an attempt to ensure they had the newest configuration and knew
  they were supposed to respond to the requests.

  Rather than using the heat stack create (called in
  devtest_overcloud.sh) to test, it was simple to use the following to
  directly boot a baremetal node.

      nova boot --flavor $(nova flavor-list | grep "|[[:space:]]*baremetal[[:space:]]*|" | awk '{print $2}) \
            --image $(nova image-list | grep "|[[:space:]]*overcloud-control[[:space:]]*|" | awk '{print $2}') \
            bm-test1

  Whilst the baremetal node was attempting to pxe boot a restart of the
  neutron services was performed.  This allowed the baremetal node to
  boot.

  It has been observed that a neutron restart was needed for each
  subsequent reboot of the baremetal nodes to succeed.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1290486/+subscriptions




More information about the Openstack-security mailing list