In OVS hybrid, avoid "qbr" from replying ARP packets if the IP is local in the system

[Rodolfo Alonso]

This problem can arise if a tenant private network has the same subnet of the management network. I the management interface (which should be totally isolated from the tenant traffic) has the same IP of a new VM, the DHCP allocation process will fail. Some operating systems (RHEL, Centos, etc) will send an ARP request to confirm the IP address given by the DHCP server is not used by other network entity. In the case described, the hybrid bridge ("qbr...") will reply to this ARP because the IP is local (belongs to the management interface)

We should block this Linux Bridge ("qbr...") from replying to any ARP with an IP non local to this interface. Because it has no IP assigned, it should not reply to any confirmation ARP.

More info: http://kb.linuxvirtualserver.org/wiki/Using_arp_announce/arp_ignore_to_disable_ARP

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/655332

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/stein
Review: https://review.opendev.org/655678

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/rocky
Review: https://review.opendev.org/655692

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/queens
Review: https://review.opendev.org/655694

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/655332
Committed: https://git.openstack.org/cgit/openstack/os-vif/commit/?id=9ad9b8483913a38345133120b04c4677fab9cb68
Submitter: Zuul
Branch: master

commit 9ad9b8483913a38345133120b04c4677fab9cb68
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Wed Apr 24 07:09:21 2019 +0000

    Prevent "qbr" Linux Bridge from replying to ARP messages

    The Linux Bridge in between the VM TAP interface and OVS should [1][2]:
    - Reply only if the target IP address is local address configured
      on the incoming interface.
    - Always use the best local address.

    [1]http://kb.linuxvirtualserver.org/wiki/Using_arp_announce/arp_ignore_to_disable_ARP
    [2]http://linux-ip.net/html/ether-arp.html#ether-arp-flux

    Change-Id: I8721b680bbd9f59a67bd8e6855ffb291c208cdb8
    Closes-Bug: #1825888

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/655678
Committed: https://git.openstack.org/cgit/openstack/os-vif/commit/?id=c42e7641f00905ff2dd68096d733929bf84756b5
Submitter: Zuul
Branch: stable/stein

commit c42e7641f00905ff2dd68096d733929bf84756b5
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Wed Apr 24 07:09:21 2019 +0000

    Prevent "qbr" Linux Bridge from replying to ARP messages

    The Linux Bridge in between the VM TAP interface and OVS should [1][2]:
    - Reply only if the target IP address is local address configured
      on the incoming interface.
    - Always use the best local address.

    [1]http://kb.linuxvirtualserver.org/wiki/Using_arp_announce/arp_ignore_to_disable_ARP
    [2]http://linux-ip.net/html/ether-arp.html#ether-arp-flux

    Change-Id: I8721b680bbd9f59a67bd8e6855ffb291c208cdb8
    Closes-Bug: #1825888
    (cherry picked from commit 9ad9b8483913a38345133120b04c4677fab9cb68)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/655692
Committed: https://git.openstack.org/cgit/openstack/os-vif/commit/?id=ca9963c2944ebfd93757471f99e9185bf34f61d4
Submitter: Zuul
Branch: stable/rocky

commit ca9963c2944ebfd93757471f99e9185bf34f61d4
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Wed Apr 24 07:09:21 2019 +0000

    Prevent "qbr" Linux Bridge from replying to ARP messages

    The Linux Bridge in between the VM TAP interface and OVS should [1][2]:
    - Reply only if the target IP address is local address configured
      on the incoming interface.
    - Always use the best local address.

    Conflicts:
          vif_plug_linux_bridge/linux_net.py
          vif_plug_linux_bridge/tests/unit/test_linux_net.py
          vif_plug_ovs/linux_net.py
          vif_plug_ovs/tests/unit/test_linux_net.py

    [1]http://kb.linuxvirtualserver.org/wiki/Using_arp_announce/arp_ignore_to_disable_ARP
    [2]http://linux-ip.net/html/ether-arp.html#ether-arp-flux

    Change-Id: I8721b680bbd9f59a67bd8e6855ffb291c208cdb8
    Closes-Bug: #1825888
    (cherry picked from commit 9ad9b8483913a38345133120b04c4677fab9cb68)
    (cherry picked from commit c42e7641f00905ff2dd68096d733929bf84756b5)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/os-vif 1.16.0 release.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/655694
Committed: https://git.openstack.org/cgit/openstack/os-vif/commit/?id=7b84b527ec84f7649df8f20d743b1f7ea9e8e113
Submitter: Zuul
Branch: stable/queens

commit 7b84b527ec84f7649df8f20d743b1f7ea9e8e113
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Wed Apr 24 07:09:21 2019 +0000

    Prevent "qbr" Linux Bridge from replying to ARP messages

    The Linux Bridge in between the VM TAP interface and OVS should [1][2]:
    - Reply only if the target IP address is local address configured
      on the incoming interface.
    - Always use the best local address.

    [1]http://kb.linuxvirtualserver.org/wiki/Using_arp_announce/arp_ignore_to_disable_ARP
    [2]http://linux-ip.net/html/ether-arp.html#ether-arp-flux

    Change-Id: I8721b680bbd9f59a67bd8e6855ffb291c208cdb8
    Closes-Bug: #1825888
    (cherry picked from commit 9ad9b8483913a38345133120b04c4677fab9cb68)
    (cherry picked from commit c42e7641f00905ff2dd68096d733929bf84756b5)
    (cherry picked from commit ca9963c2944ebfd93757471f99e9185bf34f61d4)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/os-vif 1.15.2 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/os-vif 1.9.2 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/os-vif 1.11.2 release.