Bad MAC address format in Allowed Address Pairs brings down openvswitch agent

[Aditya Vajjha]

Problem Statement:
I am trying to attach Allowed Address Pairs on a neutron port which is attached to an instance. When the format of the MAC address is not as expected, the OpenvSwitch agent throws an error saying "[req-b1607450-7cd9-4284-ac1a-0850900a0a90 None] Error while processing VIF ports" and no further instances can be created on that Compute Node.

Steps to Reproduce:
1. Create a CentOS/Cirros instance on a compute node.

2. Note down the ID of the port attached to the instance.

3. Run the command: neutron port-update <id> --allowed-address-pairs type=dict list=true mac_address=cc3e-5f81-1234,ip_address=192.168.100.0/24

4. Note the format of the MAC here. (it should ideally be: cc:3e:5f:81:12:34

5. Now create a new instance on the same compute node.

6. The instance does not get created.

It looks like the API is not performing a check of the format which is causing this issue.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/185222

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/185222
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=9b893767a5214177e30f596b6eed8324278d5050
Submitter: Jenkins
Branch: master

commit 9b893767a5214177e30f596b6eed8324278d5050
Author: Anand Shanmugam <email address hidden>
Date: Sat May 23 01:22:23 2015 -0700

    Ensure mac address added to iptables is always in unix format

    When a allowed address pair entry is added with a mac format
    other than unix format the ovs-vs agent keeps on restarting as
    it is not able to save the proper iptables due to the error
    "Error while processing VIF ports". This fix makes sure
    that the mac address sent to the iptables firewall is always
    in the unix format

    Change-Id: I86bbf3cb2adf9b998190e472691c01d068ebab9c
    Closes-Bug: #1457971

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: feature/pecan
Review: https://review.openstack.org/196701

[OpenStack Infra (hudson-openstack)]

Change abandoned by Kyle Mestery (<email address hidden>) on branch: feature/pecan
Review: https://review.openstack.org/196701
Reason: This is lacking the functional fix [1], so I'll propose a new merge commit which includes that one.

[1] https://review.openstack.org/#/c/196711/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: feature/pecan
Review: https://review.openstack.org/196920

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/196920
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=7f759c077f8f860c13db92d2ea6b353ef6b70900
Submitter: Jenkins
Branch: feature/pecan

commit 8123144fadd7c5d5e6e56a76ea860512619a2cf6
Author: Moshe Levi <email address hidden>
Date: Sun Jun 28 14:37:14 2015 +0300

    Fix Consolidate sriov agent and driver code

    This patch add mising __init to mech_sriov/mech_driver/
    and update the setup.cfg to the new agent entrypoint

    Trivial Fix

    Change-Id: I53a527081feb78472f496675bbb3c5121d38a14a

commit 8942fccf02e6e179d47582fdb2792a1ca972da21
Author: Assaf Muller <email address hidden>
Date: Mon Jun 29 11:38:51 2015 -0400

    Remove failing SafeFixture tests

    The fixtures 1.3 release attempted to fix the fixtures resource
    leak issue, but failed to do so completely. Our own SafeFixture
    is still needed: The 1.3 release broke our SafeFixture tests,
    but not the usage of SafeFixture itself. This patch removes
    those failing tests for now to unbreak the gate. Jakub reported
    a bug on fixtures 1.3:
    https://bugs.launchpad.net/python-fixtures/+bug/1469759

    We will continue to use SafeFixture until that bug is fixed
    in fixtures, at which point we will be able to require
    fixtures > 1.3.

    Change-Id: I59457c3bb198ff86d5ad55a1e623d008f0034b8f
    Closes-Bug: #1469734

commit 71dffb0a2c1720cd8233a329d32958a0160dd6f5
Author: Kevin Benton <email address hidden>
Date: Mon Jun 29 08:27:41 2015 +0000

    Revert "Removed test_lib module"

    This reverts commit 9a6536de6e1a7fe9b2552adc142e254426b82b6f.

    We pulled all of the plugins out of the tree, many of which still inherit
    from neutron test classes. This change then stated that we no longer
    support testing other plugins. I think this is a bit premature and should
    have been discussed under the subject
    "Neutron plugins can't use neutron plugin unit tests" or something
    similar.

    Change-Id: I68318589f010b731574ea3bfa8df98492bab31fc

commit b20fd81dbd497e058384a0af065dd0f1fdc4c728
Author: Jakub Libosvar <email address hidden>
Date: Fri Jun 5 14:32:51 2015 +0000

    Refactor NetcatTester class

    Following capabilities were added:
       - used transport protocol is passed as a constant instead of bool
       - src port for testing was added
       - connection can be established explicitly
       - change constructor parameters of NetcatTester

    As a part of removing bool for protocol definition
    get_free_namespace_port() was also modified to match the behavior.

    Change-Id: Id2ec322e7f731c05a3754a65411c9a5d8b258126

commit 83e37980dcd0b2bad6d64dd2cb23bcd2891cafca
Author: jingliuqing <email address hidden>
Date: Sat Jun 27 13:41:54 2015 +0800

    Use REST rather than ReST

    Change-Id: I06c9deaab58c5ec13bfeec39fb8fd4b1fe21f42d

commit 1b60df85ba3ad442c2e4e7e52538e1b9a1bf9378
Author: Kevin Benton <email address hidden>
Date: Thu Jun 25 18:34:38 2015 -0700

    Add a double-mock guard to the base test case

    Use mock to patch mock with a check to prevent multiple active
    patches to the...