Neutron DVR uses proxy ARP in fip namespaces to respond
to ARP requests for instance floating IPs. In doing so
it is susceptible to a random delay of up to (by
default) 800ms which is added to the time taken to
respond to ARP requests. This causes an initial delay
to ARP reponses that is entirely avoidable by changing this
parameter to one, instead of the default, to make it as
short as possible.
NOTE: Setting this to zero is actually undefined and will
cause the kernel to choose a random delay from 0 to
U32_MAX so is not advised. Gleaned from this comment in
__get_random_u32_below(), which is eventually called
from pneigh_enqueue():
/*
* This function is technically undefined for ceil == 0, and in fact
* for the non-underscored constant version in the header, we build bug
* on that. But for the non-constant case, it's convenient to have that
* evaluate to being a straight call to get_random_u32(), so that
* get_random_u32_inclusive() can work over its whole range without
* undefined behavior.
*/
Will propose a kernel change to fix this but cannot
assume it will be in a distro kernel for a while.
Change-Id: I0dc65b17ef436a97d0fcbd164d124ec59a1b2797
Closes-Bug: #1920975
Running with a stricter .pylintrc generates a lot of
C0330 warnings (hanging/continued indentation). Fix
the ones in neutron/agent and neutron/privileged/agent.
Trivialfix
Change-Id: Ib94257481e62b99b3d7648ae5137af5411b4867a
The agent side codes need consider three scenarios:
1. Non-dvr router. The all related rules are applied in
qrouter-namespace
2. Dvr router with the local agent mode is dvr_no_external.
The all related rules are applied in snat-namespace.
3. Dvr router with the local agent mode is dvr. In this scenario,
The all related rules are applied in fip-namespace.
Change-Id: Ie8729586d318be4a673858021a0116e09e193522
Partial-Bug: #1877301
Replace rootwrap execution with privsep context execution.
This series of patches will progressively replace any
rootwrap call.
This patch replaces some "IpNetnsCommand" command execution
methods.
Change-Id: Ic5fdf221a2a2cd0951539b0e040d2a941feee287
Story: #2007686
Task: #41558
The information needed to delete ip rules associated
with fips is held in memory between add and remove so
a restart of the l3-agent results in any fips that
existed before the restart having their ip rules
persist after the fips are removed. This patch
enures that an agent restart reloads this information
so that ip rules associated with a fip are correctly
removed when the fip is removed.
Change-Id: If656a703c996ccc7719b1b09d793c5bbdfd6f3c1
Closes-Bug: #1891673
The code that ensures the fpr/rfp veth pair exists
between the qrouter and fip namespace was only setting
the mtu of the devices if it had to create them. Set
it all the time to support the mtu being changed.
Change-Id: I176b5f4d4f12cf09f930e2c1944e98082a09bcc6
Closes-bug: #1823798
All of the externally consumed variables from neutron.common.constants
now live in neutron-lib. This patch removes neutron.common.constants
and switches all uses over to lib.
NeutronLibImpact
Depends-On: https://review.openstack.org/#/c/647836/
Change-Id: I3c2f28ecd18996a1cee1ae3af399166defe9da87
Reduces E128 warnings by ~260 to just ~900,
no way we're getting rid of all of them at once (or ever).
Files under neutron/tests still have a ton of E128 warnings.
Change-Id: I9137150ccf129bf443e33428267cd4bc9c323b54
Co-Authored-By: Akihiro Motoki <amotoki@gmail.com>
This option is deprecated and marked to be deleted in Ocata. So
as we are now in Stein development cycle I think that it's good time
to remove it.
Change-Id: I07474713206c218710544ad98c08caaa37dbf53a
Today the neutron common exceptions already live in neutron-lib and are
shimmed from neutron. This patch removes the neutron.common.exceptions
module and changes neutron's imports over to use their respective
neutron-lib exception module instead.
NeutronLibImpact
Change-Id: I9704f20eb21da85d2cf024d83338b3d94593671e
Currently the metadata proxy binds to default 0.0.0.0, which does not
add any advantage (metadata requests are not sent to random IP
addresses), and may allow access to cloud information from
third parties.
This changes the generated configuration to bind to METADATA_DEFAULT_IP
address instead.
This is not enabled in other metadata proxy configuration (in the L3
agent), as this would require net.ipv4.ip_nonlocal_bind everywhere
(currently only enabled for DVR) or transparent mode in haproxy (which
requires net.ipv4.ip_nonlocal_bind anyway)
Changed set_ip_nonlocal_bind_for_namespace() to support setting the
value in both the given and root namespace correctly, since it was
only used from inside the neutron codebase according to codesearch.
Change-Id: I388391cf697dade1a163d15ab568b33134f7b2d9
Co-Authored-By: Andrey Arapov <andrey.arapov@nixaid.com>
Closes-Bug: #1745618
An external network can have more than one subnet. Currently only the
first subnet is added to the FIP namespace routing table. Packets for
FIPs with addresses in other subnets can't pass through the external
port because there is no route for those FIP CIDRs.
This change adds routes for those CIDRs via the external port IP and
interface.
These routes doesn't collide with the existing ones, added to provide
a back path for the packets with a destination IP matching a FIP.
E.g.:
$ ip netns exec fip-e1ec0f98-b593-4514-ae08-f1c5cf1c2788 ip route
(1) 169.254.106.114/31 dev fpr-3937f879-d proto kernel scope link \
src 169.254.106.115
(2) 192.168.20.250 via 169.254.106.114 dev fpr-3937f879-d
(3) 192.168.30.0/24 dev fg-bee060f1-dd proto kernel scope link \
src 192.168.30.129
(4) 192.168.20.0/24 via 192.168.30.129 dev fg-bee060f1-dd scope link
Rule (2) is added when a FIP is assigned. This rule permits ingress
packets going into the router namespace. This FIP belongs to the second
subnet of the external network (note the external port CIDR is not the
same). Rule (4), added by this patch, allows egress packets to exit
the FIP namespace through the external port. Rule (2), because of the
prefix length (32), has more priority than rule (4).
Change-Id: I4d476b47e89fa5709dca2f66ffae72a27d88340a
Closes-Bug: #1805456
Since we know the IP and MAC addresses of both sides of the
fip/qrouter namespace veth pair device, just add permanent
ARP entries for them.
Change-Id: I6193b00681dfb79222eedfd00c89620321ac1b4f
Related-Bug: #1791989
FIP agent gateway port is tagged as a DEAD port by OVS when external
bridge is configured in neutron.
When external bridge is configured, the vlan tag should be removed
after the port is plugged in.
This patch fixes the issue.
Change-Id: I969b9d7e7cef4beff526a2b26de3f1a9f9de4c1c
Closes-Bug: #1778643
If a distributed router has interfaces on multiple tenant networks, with
'fast exit' functionality policy based rules are created in qrouter
namespace for every tenant network subnet and 'from <cidr>' is included
into an 'ip rule' command invocation.
When a port on a tenant network is deleted 'from <cidr>' part is not
included and a first rule matching specified parameters gets deleted.
For example with the following layout
ip netns exec qrouter-4f9ca9ef-303b-4082-abbc-e50782d9b800 ip rule
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
80000: from 192.168.100.0/24 lookup 16
80000: from 192.168.200.0/24 lookup 16
and neutron l3 agent will use this command
ip netns exec qrouter-4f9ca9ef-303b-4082-abbc-e50782d9b800 ip -4 rule\
del priority 80000 table 16 type unicast
and 192.168.100.0/24 rule will get deleted even if you actually removed
a port on 192.168.200.0.
This results in an extra rule present and not cleaned up and the right
rule removed. It is only recreated if a router is disabled and enabled
again.
additional changes:
1) Floating IP rules are identified by priority only as implemented
currently - for this reason this change adds fixed_ip to the rule
removal code. Rule priorities are 32-bit values in iproute2 so,
in theory, those should be not be used to cover IPv6.
2) IP protocol information for 'from all' rules is currently
derived from link-local address IP version. The same approach
is preserved by using version-specific /0 addresses without
changing the API provided by ip_lib.
Change-Id: I0ea6dddd26e17771be223a1fbdf21792c90f3e9c
Closes-Bug: #1759956
If callers of get_devices_with_ip(), or
device.addr.list(to=address) pass an ip_cidr, it
could match any ip_cidr in that range on the interface.
Callers need to pass the IP without the prefix portion in
order to match it exactly. Added a helper utility to
strip the cidr part from a ip_cidr.
Determined the unit test for this can't actually check
this case since we are mocking the return value from
/sbin/ip, so modified it to just make sure the dict
is correct.
Added a functional test that adds two IP addresses in
the same IP range to verify that we actually filter
correctly when a 'to=IP' is specified.
Change-Id: I3a95b3bb72a43f322ad23892d8959398aac22a1c
Closes-bug: #1728080
neutron-lib contains the synchronized lockutils decorator as well as
the SYNCHRONIZED_PREFIX global. This patch consumes them from
neutron-lib and removes them from neutron.
NeutronLibImpact
Change-Id: I729da348e340509f2d09f8a6436716e2398f1583
Since Pike log messages should not be translated.
This patch removes calls to i18n _LC, _LI, _LE, _LW from
logging logic throughout the code. Translators definition
from neutron._i18n is removed as well.
This patch also removes log translation verification from
ignore directive in tox.ini.
Change-Id: If9aa76fcf121c0e61a7c08088006c5873faee56e
When we create agent gateway port on all the nodes irrespective
of the floatingips we can basically use that agent gateway port to
forward traffic in and out of the nodes if the address_scopes match,
since we don't need SNAT functionality if address scopes match.
If a gateway is configured and if it has internal ports that belong
to the same address_scopes then no need to add the redirect rules.
At the same we should also add a static route in the fip namespace
for every interface that is connected to the router that belongs to
the same address scope.
Change-Id: I617e2fc5a70852c6f2e925ac7244f2a205d60de4
Closes-Bug: #1577488
This reverts commit fb2093c365.
This patch started spamming logstash like crazy with ERRORs.
Closes-Bug: #1693539
Change-Id: I81627f1bac1b981f930b66c126abd8285653bf49
When we create agent gateway port on all the nodes irrespective
of the floatingips we can basically use that agent gateway port to
forward traffic in and out of the nodes if the address_scopes match,
since we don't need SNAT functionality if address scopes match.
If a gateway is configured and if it has internal ports that belong
to the same address_scopes then no need to add the redirect rules.
At the same we should also add a static route in the fip namespace
for every interface that is connected to the router that belongs to
the same address scope.
Change-Id: Iaf6d3b38b1fb45772cf0b88706586c057ddb0230
Closes-Bug: #1577488
This is the most common use pattern for the method, so it makes sense to
make it default.
(Actually, it may be that there are no usage for the arguments
whatsoever, but better safe than sorry.)
NeutronLibImpact this change potentially breaks callers of get_devices
that may want to get the automatic devices by default. Those imaginary
callers may need to set exclude_gre_devices and/or exclude_loopback to
True from now on.
Change-Id: Ic32b8abc7f8502b8907ae21c996e13cb8fd5401d
Related-Bug: #1604115
Agents and netns_cleanup tool attempt to clean up devices from
namespaces before destroying namespaces, but they should skip doing it
for gre devices that are automatic and show up depending on kernel
modules loaded.
Change-Id: Ie95890ed92ac73ec8e2d118a9727b9e1624a5178
Related-Bug: #1604115
In order to route traffic between the internal subnets and the
external subnet that belong to the same address_scopes we need
to create the gateway port and the fip namespace irrespective of
the configured floatingips for the internal subnet.
This will consume an additional IP from the external subnet on
all nodes, but with the introduction of service_type networks,
this will not be an issue any more.
This patch is the first in series that creates the agent gateway
port and the fip namespace on every node when the gateway is set
for the router. For every router created it will connect the
router namespace to the fip namespace.
Partial-Bug: #1577488
DocImpact: Document the change in behavior for fip-agent-gw create
Change-Id: I30c4f7fc250e486fe9a71b68540e783e90a6cf15
Old versions of the DVR code used to configure floating
IP addresses directly on the rfp-* devices in the
qrouter namespace. This was changed in Mitaka to use
routes, but these stale floating IP addresses were
never cleaned-up when the l3-agent was restarted.
Add a check for these addresses and remove them at
startup if they exist. This can be removed in a cycle
since once they are cleaned they will not be added
back by the agent.
Change-Id: Id512d213cd7ee11da913a4e4b0da20c3ad5420b0
Closes-bug: #1675187
Now that get_ip_version() is in common/utils.py,
change all in-tree users to use it and not
generate removal warnings.
Trivialfix
Change-Id: I623a10f3a52f80b650e5410df8b03729eb823134
The static routes are currently only added to the router
namespace and snat namespace, but not added to the fip
namespace.
This patch adds the static routes configured for the router
to the FIP namespace, to its own table. So this will allow
the FIP namespace to be configured with different nexthop
routes for different routers.
Change-Id: Ida165d1ecf5c07af31dac11d9daed33ccaaf5605
Closes-Bug: #1571676
In large-scale environments, we have seen a router update
arrive for one tenant while we are still creating the
router for a different tenant and initializing the shared
floating IP gateway port. Sometimes these updates can
get scheduled simultaneously, with the second running
before we are done creating all the resources in the
first, causing an exception when trying to set the
default route since either the interface or IP address
does not exist yet.
Add a lock to better synchronize these functions so
a create can finish before an update can be done.
If it still fails, we will throw an exception so that
the namespace will be cleaned-up and the update can be
re-scheduled for the next iteration.
Closes-Bug: #1631513
Change-Id: Ia8c92cea2f8798582c39ad3450ab3b3c45a356f7
Not all callers use a device with sysctl calls, so move it
out of the IPDevice class to make it more generic.
This will help facilitate a future change to set accept_ra
to fix another bug.
Change-Id: Iaf85981a227234466863f00ee4e2209405a2b083
Related-bug: #1627902
We rely on keepalived to send gratuitous ARPs when floating IP is added.
Older versions of keepalived up to 1.2.20 (exclusive) contain bug [1] where
keepalived does not send GARP on receiving SIGHUP. Unfortunately, newer
versions containing the fix are not packaged yet for some distributions
like RHEL or CentOS or Ubuntu Xenial, so this patch adds a workaround for
such distributions until new packages are available.
The patch also sets net.ipv4.ip_nonlocal_bind kernel parameter to 0 for
Snat and HA router namespaces in order to avoid sending gratuitous ARPs
for IP addresses that are not bound to the interface anymore - possibly
because of failover or removal. Note that kernel < 3.19 contain a bug
where this knob is missing. In case it attempts to set the parameter and
it's missing on the system, it doesn't set the knob in root
namespace like it's done for fip namespaces, but only issues a warning
message.
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1391553
Change-Id: Ieab53624dc34dc687a0e8eebd84778f7fc95dd77
Closes-bug: 1639315
Previously, the function consumed a config object and picked only a
single option send_arp_for_ha from that object. This patch replaces the
config object with count itself in order to be able to send gratuitous
ARPs not relying on a single config option.
As per http://codesearch.openstack.org, this function is not called in
any other stadium project. The send_arp_for_ha option is deprecated as
for Ocata.
Related-bug: 1639315
Change-Id: I6efc539a969bebb4fd969e1648a787bf7dc9cd0b
The Namespace class can create namespaces and enable
IP forwarding. It also already initializes an ip_lib
class instance to run commands in the root namespace.
Change the DVR FIP code to use it.
Change-Id: I625c919af5b009999987382df64cd3491a932fe5
Router namespace absence may lead to infinite loop in l3 agent trying
to delete the router.
This patch adds checks before going into namespace to prevent RuntimeError
and following infinite loop.
Closes-Bug: #1606844
Change-Id: Iae95ccb8eeb06d0fd5fc7d71e63408b3f843b371
The right way to configure Neutron to work with infrastructure MTU is by
using plugin agnostic global_physnet_mtu and ml2 specific
path_mtu/physical_network_mtus options. The deprecated option is error
prone and does not allow to use different MTUs per network.
Closes-Bug: #1603493
Related-Bug: #1549470
Related-Bug: #1542108
Related-Bug: #1542475
DocImpact Remove all references to network_device_mtu option from
Neutron documentation. Note that Nova has a deprecated option
with the same name that will need a separate patch to be removed.
Depends-On: I8e6cc99fe70d0c41a705431fb3160e8fccacff10
Depends-On: I337b284076a794027fbd63796119d56bd1923cf2
Change-Id: I7287db9df25a78a59b2dfa28acfde7fe69d17f40
Currently, when the default route is added to device, there is no
way to delete it. Even if user clear the gateway ip of external
net, there is still a default route present in router namespace.
This patch will check the default route in namespace first. If its
gateway ip is not one of the gateway ips in external net. This
default route will be deleted.
Change-Id: If2ab88b392f3935306d73e3c2de0a35548567464
Closes-Bug: #1520775
Pinging a floatingip of VM1 from a second VM(VM2) which has SNAT
enabled connected to a DVR router on the same network returns
with fixed-ip address rather than the floatingip address.
The NAT forwarding rules for floatingip in the router namespace
does not check for the in coming port and tries to add the rule
for all in coming ports.
This causes the packets that are originating from the router
namespace to be modified and forwarded directly to the VM2 fixed
ip instead of forwarding the traffic to the SNAT namespace.
The fix in here will make sure that for all routers, the floatingip
forwarding rules will be applied only to the 'rfp-' internal ports
and not to all ports.
Change-Id: I9453beffd94bf685afd74b0820506fb6b7c996c4
Closes-Bug: #1462154
Co-Authored-By: Hong Hui Xiao <xiaohhui@cn.ibm.com>
Restarting the l3-agent when creating the fip namespace may
leave rfp and fpr devices with no IP addresses, since we will
not try and configure them if the devices already exist.
Fix this by always trying to configure the IP addresses,
even if the devices already exist.
Closes-Bug: #1566383
Change-Id: Idad3bb4808ec66b9a764bb621dfb04a10eb7ed6
Edward Hope-Morley