Policy rule change does not affect active flows.

[Ritam Gangopadhyay]

Change in policy rule does not effect traffic on active flows.

Steps to reproduce:-

1. create a VN "vn-1"
2. create a Policy with rule:-
        source vn - vn-1
        dest-vn - vn-1
        protocol - ICMP
        action - deny
3. create 2 VM's "vm-11" and "vm-12" in "vn-1"
4. start ping to vm-12 from vm-11
5. packets should get dropped.
6. a drop flow should get created which show action as - Dropped by Policy - D(Policy)
7. agent introspect page should show the policy action for ICMP as drop
8. change the rule action to "PASS" from "DENY"
9. agent introspect page shows the policy action for ICMP as "pass"
10. but packets are still not allowed and the flow shows as dropped. - Dropped by Policy - D(Policy)

root@nodec55:~# flow -l
Flow table(size 68157440, entries 532480)

Entries: Created 6 Added 6 Processed 6 Used Overflow entries 0
(Created Flows/CPU: 1 1 2 2)(oflows 0)

Action:F=Forward, D=Drop N=NAT(S=SNAT, D=DNAT, Ps=SPAT, Pd=DPAT, L=Link Local Port)
 Other:K(nh)=Key_Nexthop, S(nh)=RPF_Nexthop, M=Mirror Index
 Flags:E=Evicted, Ec=Evict Candidate, N=New Flow, M=Modified
TCP(r=reverse):S=SYN, F=FIN, R=RST, C=HalfClose, E=Established, D=Dead

 Index Source:Port Destination:Port Proto(V)
-------------------------------------------------------------------------
326684<=>355124 17.1.1.3:54272 17.1.1.4:0 1 (1)
(K(nh):36, Action:D(Policy), Flags:, S(nh):36, Stats:206/20188, SPort:61506)

355124<=>326684 17.1.1.4:54272 17.1.1.3:0 1 (1)
(K(nh):14, Action:D(Policy), Flags:, S(nh):14, Stats:0/0, SPort:49907)

root@nodec55:~#

11. if we stop and restart the ping, i.e. when new flows get created it takes up the proper action of pass. So only "live flows" are not affected by change is policy rules.

root@nodec55:~# flow -l
Flow table(size 68157440, entries 532480)

Entries: Created 7 Added 7 Processed 7 Used Overflow entries 0
(Created Flows/CPU: 2 1 2 2)(oflows 0)

Action:F=Forward, D=Drop N=NAT(S=SNAT, D=DNAT, Ps=SPAT, Pd=DPAT, L=Link Local Port)
 Other:K(nh)=Key_Nexthop, S(nh)=RPF_Nexthop, M=Mirror Index
 Flags:E=Evicted, Ec=Evict Candidate, N=New Flow, M=Modified
TCP(r=reverse):S=SYN, F=FIN, R=RST, C=HalfClose, E=Established, D=Dead

 Index Source:Port Destination:Port Proto(V)
-------------------------------------------------------------------------
 64912<=>481500 17.1.1.4:54528 17.1.1.3:0 1 (1)
(K(nh):14, Action:F, Flags:, S(nh):14, Stats:4/392, SPort:59060)

326684<=>355124 17.1.1.3:54272 17.1.1.4:0 1 (1)
(K(nh):36, Action:D(Policy), Flags:, S(nh):36, Stats:436/42728, SPort:61506)

355124<=>326684 17.1.1.4:54272 17.1.1.3:0 1 (1)
(K(nh):14, Action:D(Policy), Flags:, S(nh):14, Stats:0/0, SPort:49907)

481500<=>64912 17.1.1.3:54528 17.1.1.4:0 1 (1)
(K(nh):36, Action:F, Flags:, S(nh):36, Stats:4/392, SPort:56645)

root@nodec55:~#

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/19931
Submitter: RAVI KIRAN (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/19931
Committed: http://github.org/Juniper/contrail-controller/commit/6fa64f74f1b61fc4b67d61ada4f6ae6646fc9063
Submitter: Zuul
Branch: R3.0

commit 6fa64f74f1b61fc4b67d61ada4f6ae6646fc9063
Author: Ravi BK <email address hidden>
Date: Thu May 5 19:34:54 2016 +0530

Issue: For live flows, if any policy changes are made,
flow actions for reverse flow is not updated. As a result, ping
traffic is failing even when policy action is modified to PASS.
Fix: While revaluating the flow, make sure reverse flow entry is
updated with proper parameters.

Change-Id: Ifb2c612b842a3c486b75d8d2a4d7ec52f0cb4895
closes-bug: #1548173

[RAVI KIRAN (ravibk)]

no longer affects: juniperopenstack/r2.20

[RAVI KIRAN (ravibk)]

no longer affects: juniperopenstack/r2.22.x

[RAVI KIRAN (ravibk)]

no longer affects: juniperopenstack/mainline

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/20368
Submitter: RAVI KIRAN (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/20368
Committed: http://github.org/Juniper/contrail-controller/commit/573a51ba1d7c911106cd4aac89a1c8f5ac52f6cc
Submitter: Zuul
Branch: master

commit 573a51ba1d7c911106cd4aac89a1c8f5ac52f6cc
Author: Ravi BK <email address hidden>
Date: Wed May 18 20:50:16 2016 +0530

Issue: Reverse flow to be updated for active flows

Fix: Porting fix of reverse flow updation in mainline

Change-Id: I2080d43ed5937c41c6073e9407516372a0e89df5
Closes-bug: #1548173