openstack
/
neutron
Code Issues Proposed changes

Do not release DHCP lease when no client ID is set on port 

The DHCP agent has a really strict enforcement of client ID, which
is part of the DHCP extra options. If a VM advertises a client ID,
DHCP agent will automatically release it's lease whenever *any* other
port is updated/deleted, even if no client ID is set on the port,
because it thinks the client ID has changed.

When reload_allocations() is called, the DHCP agent parses the leases
and hosts files, and gets the list of all the ports in the network from the
DB, computing 3 different sets. The set from the leases file (v4_leases)
could have a client ID, but the set from the port DB and hosts file will
have None.

As a result, the set subtraction does not filter out the entry,
and all ports that have an active lease with a client ID are released.

The Client ID should only be enforced and leases released
if it's actually set in the port DB's DHCP extra Opts.
In that case it means someone knows what they are doing,
and we want to check for a mismatch. If the client ID on a port is
empty, it should not be treated like an unused lease.

We can't expect end users that just create VMs with auto created ports
to know/care about DHCP client IDs, then manually update ports or
change app templates.

In some cases, like Windows VMs, the client ID is advertised as the MAC by default.
In fact, there is a Windows bug which prevents you from even turning this off:
https://support.microsoft.com/en-us/help/3004537/dhcp-client-always-includes-option-61-in-the-dhcp-request-in-windows-8

Linux VMs don't have this on by default, but it may be enabled
in some templates unknown to users.

Change-Id: I8021f740bd78e654915337bd3287b45b2c422e95
Closes-Bug: #1806770
This commit is contained in:
Arjun Baindur 2018-12-05 12:43:05 -08:00 committed by Brian Haley
parent 8914f8247f
commit f2111e0354
2 changed files with 56 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
neutron/agent/linux/dhcp.py
View File

@ -856,6 +856,19 @@ class Dnsmasq(DhcpLocalProcess):
if not entries_to_release:
return
# If the VM advertises a client ID in its lease, but its not set in
# the port's Extra DHCP Opts, the lease will not be filtered above.
# Release the lease only if client ID is set in port DB and a mismatch
# Otherwise the lease is released when other ports are deleted/updated
entries_with_no_client_id = set()
for ip, mac, client_id in entries_to_release:
if client_id:
entry_no_client_id = (ip, mac, None)
if (entry_no_client_id in old_leases and
entry_no_client_id in new_leases):
entries_with_no_client_id.add((ip, mac, client_id))
entries_to_release -= entries_with_no_client_id
# Try DHCP_RELEASE_TRIES times to release a lease, re-reading the
# file each time to see if it's still there. We loop +1 times to
# check the lease file one last time before logging any remaining

43
neutron/tests/unit/agent/linux/test_dhcp.py
View File

@ -2258,6 +2258,49 @@ class TestDnsmasq(TestBase):
dnsmasq._release_lease.assert_called_once_with(
mac1, ip1, constants.IP_VERSION_4, client_id1, 'server_id', mac1)
def test_release_unused_leases_one_lease_with_client_id_none(self):
dnsmasq = self._get_dnsmasq(FakeDualNetwork())
ip1 = '192.168.0.2'
mac1 = '00:00:80:aa:bb:cc'
client_id1 = 'client1'
ip2 = '192.168.0.4'
mac2 = '00:16:3E:C2:77:1D'
client_id2 = 'test4'
ip6 = '2001:0db8:11a3:09d7:1f34:8a2e:07a0:765d'
old_leases = set([(ip1, mac1, client_id1), (ip2, mac2, None)])
dnsmasq._read_hosts_file_leases = mock.Mock(return_value=old_leases)
dnsmasq._output_hosts_file = mock.Mock()
# Because the lease release code could fire multiple times, the
# second read of the lease file must not have the entries that
# would have been released.
dnsmasq._read_leases_file_leases = mock.Mock(
side_effect=[{ip6: {'iaid': 0xff,
'client_id': 'client_id',
'server_id': 'server_id'},
ip1: {'iaid': mac1,
'client_id': client_id1,
'server_id': 'server_id'},
ip2: {'iaid': mac2,
'client_id': client_id2,
'server_id': 'server_id'}
},
{ip6: {'iaid': 0xff,
'client_id': 'client_id',
'server_id': 'server_id'},
ip2: {'iaid': mac2,
'client_id': client_id2,
'server_id': 'server_id'}
}])
dnsmasq._release_lease = mock.Mock()
dnsmasq.network.ports = [FakePort4()]
dnsmasq._release_unused_leases()
dnsmasq._release_lease.assert_called_once_with(
mac1, ip1, constants.IP_VERSION_4, client_id1, 'server_id', mac1)
def test_release_unused_leases_one_lease_from_leases_file(self):
# leases file has a stale entry that is not in the host file
dnsmasq = self._get_dnsmasq(FakeDualNetwork())