linux bridge agent hung and openvswitch raise an exception if we enable security group

[Nachi Ueno]

It looks regression of this patch.
https://github.com/openstack/quantum/commit/9acc988725ac202724c15c2ed3adaf9520ce9a6e

Stderr: "iptables-restore v1.4.12: Invalid chain name `quantum-linuxbri-o54b26c46-cb' (28 chars max)\nError occurred at line: 50\nTry `iptables-restore -h' or 'iptables-restore --help' for more information.\n"
2013-02-26 18:24:46.261 21308 TRACE quantum Traceback (most recent call last):
2013-02-26 18:24:46.261 21308 TRACE quantum File "/opt/stack/quantum/bin/quantum-linuxbridge-agent", line 24, in <module>
2013-02-26 18:24:46.261 21308 TRACE quantum main()
2013-02-26 18:24:46.261 21308 TRACE quantum File "/opt/stack/quantum/quantum/plugins/linuxbridge/agent/linuxbridge_quantum_agent.py", line 645, in main
2013-02-26 18:24:46.261 21308 TRACE quantum plugin.daemon_loop()
2013-02-26 18:24:46.261 21308 TRACE quantum File "/opt/stack/quantum/quantum/plugins/linuxbridge/agent/linuxbridge_quantum_agent.py", line 611, in daemon_loop
2013-02-26 18:24:46.261 21308 TRACE quantum sync = self.process_network_devices(device_info)
2013-02-26 18:24:46.261 21308 TRACE quantum File "/opt/stack/quantum/quantum/plugins/linuxbridge/agent/linuxbridge_quantum_agent.py", line 536, in process_network_devices
2013-02-26 18:24:46.261 21308 TRACE quantum resync_a = self.treat_devices_added(device_info['added'])
2013-02-26 18:24:46.261 21308 TRACE quantum File "/opt/stack/quantum/quantum/plugins/linuxbridge/agent/linuxbridge_quantum_agent.py", line 544, in treat_devices_added
2013-02-26 18:24:46.261 21308 TRACE quantum self.prepare_devices_filter(devices)
2013-02-26 18:24:46.261 21308 TRACE quantum File "/opt/stack/quantum/quantum/agent/securitygroups_rpc.py", line 102, in prepare_devices_filter
2013-02-26 18:24:46.261 21308 TRACE quantum self.firewall.prepare_port_filter(device)
2013-02-26 18:24:46.261 21308 TRACE quantum File "/usr/lib/python2.7/contextlib.py", line 24, in __exit__
2013-02-26 18:24:46.261 21308 TRACE quantum self.gen.next()
2013-02-26 18:24:46.261 21308 TRACE quantum File "/opt/stack/quantum/quantum/agent/firewall.py", line 105, in defer_apply
2013-02-26 18:24:46.261 21308 TRACE quantum self.filter_defer_apply_off()
2013-02-26 18:24:46.261 21308 TRACE quantum File "/opt/stack/quantum/quantum/agent/linux/iptables_firewall.py", line 284, in filter_defer_apply_off
2013-02-26 18:24:46.261 21308 TRACE quantum self.iptables.defer_apply_off()
2013-02-26 18:24:46.261 21308 TRACE quantum File "/opt/stack/quantum/quantum/agent/linux/iptables_manager.py", line 294, in defer_apply_off
2013-02-26 18:24:46.261 21308 TRACE quantum self._apply()
2013-02-26 18:24:46.261 21308 TRACE quantum File "/opt/stack/quantum/quantum/openstack/common/lockutils.py", line 229, in inner
2013-02-26 18:24:46.261 21308 TRACE quantum retval = f(*args, **kwargs)
2013-02-26 18:24:46.261 21308 TRACE quantum File "/opt/stack/quantum/quantum/agent/linux/iptables_manager.py", line 330, in _apply
2013-02-26 18:24:46.261 21308 TRACE quantum root_helper=self.root_helper)
2013-02-26 18:24:46.261 21308 TRACE quantum File "/opt/stack/quantum/quantum/agent/linux/utils.py", line 60, in execute
2013-02-26 18:24:46.261 21308 TRACE quantum raise RuntimeError(m)
2013-02-26 18:24:46.261 21308 TRACE quantum RuntimeError:
2013-02-26 18:24:46.261 21308 TRACE quantum Command: ['sudo', '/usr/local/bin/quantum-rootwrap', '/etc/quantum/rootwrap.conf', 'iptables-restore']
2013-02-26 18:24:46.261 21308 TRACE quantum Exit code: 2
2013-02-26 18:24:46.261 21308 TRACE quantum Stdout: ''
2013-02-26 18:24:46.261 21308 TRACE quantum Stderr: "iptables-restore v1.4.12: Invalid chain name `quantum-linuxbri-o54b26c46-cb' (28 chars max)\nError occurred at line: 50\nTry `iptables-restore -h' or 'iptables-restore --help' for more information.\n"
2013-02-26 18:24:46.261 21308 TRACE quantum

[Akihiro Motoki (amotoki)]

Nachi,
Does it affect only linux bridge plugin? OVS plugin implementation is not affected?

[Nachi Ueno (nati-ueno)]

Hi Akihiro

OVS looks also has problems.
Even if not crash, but it raises exception and iptables will not be set.

[Akihiro Motoki (amotoki)]

I already have a patch to fix it. Let me take it.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/23216

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/23216
Committed: http://github.com/openstack/quantum/commit/0b3f9f61b070b86ad0335d905a57357035ce2e59
Submitter: Jenkins
Branch: master

commit 0b3f9f61b070b86ad0335d905a57357035ce2e59
Author: Akihiro MOTOKI <email address hidden>
Date: Fri Mar 1 07:19:20 2013 +0900

    Ensure max length of iptables chain name w/o prefix is up to 11 chars.

    The maximum length of Linux iptables chain name must be less than or
    equal to 28 characters. In iptables_manager binary_name up to 16 chars
    is used as a prefix and a '-' follows it, so a chain name passed to
    iptables_manager must be less than 12 character long. Accordingky
    MAX_CHAIN_LEN should be changed from 28 to 12. Also this commit
    introduces a method to get a chain name with valid length.

    Since iptables_firewall module constructs a rule by directly using
    a chain name, iptable_firewall also must take care of the length.

    Fixes bug #1133833

    Change-Id: I6157d519f3cb91ec32dc6a92eae45439b8717b2d