generating duplicate LLA iptables rules

[Kevin Benton]

Spotted in gate. Looks like we are generating duplicate iptables rules for LLA v6 entries.

2016-09-13 08:10:15.769 13401 WARNING neutron.agent.linux.iptables_manager [req-4534b4a3-484e-4fc5-8b44-0e91d70feb88 - -] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-linuxbri-sa16bbb04-2 -s fe80::f816:3eff:fecd:f5b1/128 -m mac --mac-source FA:16:3E:CD:F5:B1 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
2016-09-13 08:10:41.844 13401 WARNING neutron.agent.linux.iptables_manager [req-4534b4a3-484e-4fc5-8b44-0e91d70feb88 - -] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-linuxbri-sd39667db-b -s fe80::f816:3eff:fe30:7756/128 -m mac --mac-source FA:16:3E:30:77:56 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
2016-09-13 08:10:41.844 13401 WARNING neutron.agent.linux.iptables_manager [req-4534b4a3-484e-4fc5-8b44-0e91d70feb88 - -] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-linuxbri-sa16bbb04-2 -s fe80::f816:3eff:fecd:f5b1/128 -m mac --mac-source FA:16:3E:CD:F5:B1 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
2016-09-13 08:10:55.708 13401 WARNING neutron.agent.linux.iptables_manager [req-4534b4a3-484e-4fc5-8b44-0e91d70feb88 - -] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-linuxbri-sd39667db-b -s fe80::f816:3eff:fe30:7756/128 -m mac --mac-source FA:16:3E:30:77:56 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
2016-09-13 08:10:55.708 13401 WARNING neutron.agent.linux.iptables_manager [req-4534b4a3-484e-4fc5-8b44-0e91d70feb88 - -] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-linuxbri-sa16bbb04-2 -s fe80::f816:3eff:fecd:f5b1/128 -m mac --mac-source FA:16:3E:CD:F5:B1 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
2016-09-13 08:10:55.798 13401 WARNING neutron.agent.linux.iptables_manager [req-4534b4a3-484e-4fc5-8b44-0e91d70feb88 - -] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-linuxbri-sd39667db-b -s fe80::f816:3eff:fe30:7756/128 -m mac --mac-source FA:16:3E:30:77:56 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
2016-09-13 08:10:55.798 13401 WARNING neutron.agent.linux.iptables_manager [req-4534b4a3-484e-4fc5-8b44-0e91d70feb88 - -] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-linuxbri-sa16bbb04-2 -s fe80::f816:3eff:fecd:f5b1/128 -m mac --mac-source FA:16:3E:CD:F5:B1 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
2016-09-13 08:10:59.713 13401 WARNING neutron.agent.linux.iptables_manager [req-4534b4a3-484e-4fc5-8b44-0e91d70feb88 - -] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-linuxbri-sd39667db-b -s fe80::f816:3eff:fe30:7756/128 -m mac --mac-source FA:16:3E:30:77:56 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
2016-09-13 08:10:59.713 13401 WARNING neutron.agent.linux.iptables_manager [req-4534b4a3-484e-4fc5-8b44-0e91d70feb88 - -] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-linuxbri-sa16bbb04-2 -s fe80::f816:3eff:fecd:f5b1/128 -m mac --mac-source FA:16:3E:CD:F5:B1 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
2016-09-13 08:11:03.825 13401 WARNING neutron.agent.linux.iptables_manager [req-4534b4a3-484e-4fc5-8b44-0e91d70feb88 - -] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-linuxbri-sd39667db-b -s fe80::f816:3eff:fe30:7756/128 -m mac --mac-source FA:16:3E:30:77:56 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
2016-09-13 08:11:03.825 13401 WARNING neutron.agent.linux.iptables_manager [req-4534b4a3-484e-4fc5-8b44-0e91d70feb88 - -] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-linuxbri-sa16bbb04-2 -s fe80::f816:3eff:fecd:f5b1/128 -m mac --mac-source FA:16:3E:CD:F5:B1 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
2016-09-13 08:11:09.679 13401 WARNING neutron.agent.linux.iptables_manager [req-4534b4a3-484e-4fc5-8b44-0e91d70feb88 - -] Duplicate iptables rule detected. This may indicate a bug in the the iptables rule generation code. Line: -A neutron-linuxbri-sa16bbb04-2 -s fe80::f816:3eff:fecd:f5b1/128 -m mac --mac-source FA:16:3E:CD:F5:B1 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/369269

[Armando Migliaccio (armando-migliaccio)]

Gate where? What job, etc?

[Kevin Benton (kevinbenton)]

linux bridge jobs

[Kevin Benton (kevinbenton)]

dvr jobs

[Kevin Benton (kevinbenton)]

http://logs.openstack.org/50/369550/2/check/gate-tempest-dsvm-neutron-linuxbridge-ubuntu-xenial/7602646/logs/screen-q-agt.txt.gz?level=WARNING

http://logs.openstack.org/06/363206/6/check/gate-tempest-dsvm-neutron-dvr-ubuntu-xenial/c19c4a2/logs/screen-q-agt.txt.gz?level=WARNING

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/369269
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=d1b9026729d085a9f986fb6c394a04b9aa5a87f6
Submitter: Jenkins
Branch: master

commit d1b9026729d085a9f986fb6c394a04b9aa5a87f6
Author: Kevin Benton <email address hidden>
Date: Mon Sep 12 23:51:11 2016 -0700

    Prevent duplicate LLA iptables rules

    Check if lla,mac tuple is in pairs before appending
    it again. Otherwise we end up generating duplicate
    iptables rules.

    Closes-Bug: #1622938
    Change-Id: I43658a31f9853cbc94784f497193210990f769dd

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 9.0.0.0rc1 release candidate.