Hairpin traffic does not work with centralized NAT gw
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
Invalid
|
Undecided
|
Unassigned | ||
Focal |
Fix Released
|
Medium
|
Unassigned | ||
Impish |
Won't Fix
|
Undecided
|
Unassigned | ||
Jammy |
Fix Released
|
Medium
|
Unassigned | ||
Kinetic |
Invalid
|
Undecided
|
Unassigned | ||
openvswitch (Ubuntu) |
Invalid
|
High
|
Unassigned | ||
Focal |
Invalid
|
Undecided
|
Unassigned | ||
Impish |
Won't Fix
|
Undecided
|
Unassigned | ||
Jammy |
Invalid
|
Undecided
|
Unassigned | ||
Kinetic |
Invalid
|
High
|
Unassigned | ||
ovn (Ubuntu) |
Invalid
|
Undecided
|
Unassigned | ||
Focal |
Invalid
|
Undecided
|
Unassigned | ||
Impish |
Won't Fix
|
Undecided
|
Unassigned | ||
Jammy |
Invalid
|
Undecided
|
Unassigned | ||
Kinetic |
Invalid
|
Undecided
|
Unassigned |
Bug Description
[Impact]
Users of Open vSwitch on Focal will not be able to upgrade to v2.16.0 or newer until this long standing kernel bug has been fixed.
Users of Open vSwitch on Jammy will be affected by this bug and
have no user space fix available. This bug currently blocks the
OpenStack Engineering team's charm product gate.
[Test Plan]
Execute the OVN system testsuite utilizing the kernel data path with the test synthesis patch in comment #7 applied.
In addition to that validating that the OpenStack charm test gate is unblocked would be valuable.
[Regression Potential]
The regression potential can be considered as low because:
- The calls added in the openvswitch kernel datapath code would
prior to Open vSwitch 2.16.0 have been initiated from the
userspace code and by chance concealed this bug.
- After an optimization done in 2.16.0 the kernel bug was
revealed and these calls now must be made from the kernel
datapath to retain functionality in use in the wild.
[Original Bug Description]
If you have two hvs where hv1 is the gateway chassis and you have an instance running on hv2.
On instance on hv2 hairpin traffic works for the first session, but not for the next:
$ ping -c1 10.78.95.89
PING 10.78.95.89 (10.78.95.89) 56(84) bytes of data.
64 bytes from 10.78.95.89: icmp_seq=1 ttl=62 time=1.07 ms
--- 10.78.95.89 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.078/1.
$ sudo ovs-appctl -t ovs-vswitchd dpctl/dump-
icmp,orig=
icmp,orig=
$ ping -c1 10.78.95.89
PING 10.78.95.89 (10.78.95.89) 56(84) bytes of data.
--- 10.78.95.89 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms
$ sudo ovs-appctl -t ovs-vswitchd dpctl/dump-
icmp,orig=
icmp,orig=
icmp,orig=
We made an attempt at using OVN built with [0], but that did unfortunately not help.
If we however revert [1] it works again:
$ ping -c1 10.78.95.89
PING 10.78.95.89 (10.78.95.89) 56(84) bytes of data.
64 bytes from 10.78.95.89: icmp_seq=1 ttl=62 time=1.31 ms
--- 10.78.95.89 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.318/1.
$ sudo ovs-appctl -t ovs-vswitchd dpctl/dump-
icmp,orig=
icmp,orig=
icmp,orig=
$ ping -c1 10.78.95.89
PING 10.78.95.89 (10.78.95.89) 56(84) bytes of data.
64 bytes from 10.78.95.89: icmp_seq=1 ttl=62 time=0.307 ms
--- 10.78.95.89 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.307/0.
$ sudo ovs-appctl -t ovs-vswitchd dpctl/dump-
icmp,orig=
icmp,orig=
icmp,orig=
icmp,orig=
icmp,orig=
icmp,orig=
0: https:/
1: https:/
---
ProblemType: Bug
AlsaDevices:
total 0
crw-rw---- 1 root audio 116, 1 Jun 9 11:35 seq
crw-rw---- 1 root audio 116, 33 Jun 9 11:35 timer
AplayDevices: Error: [Errno 2] No such file or directory: 'aplay'
ApportVersion: 2.20.11-0ubuntu82.1
Architecture: amd64
ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord'
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1:
CRDA: N/A
CasperMD5CheckR
DistroRelease: Ubuntu 22.04
IwConfig: Error: [Errno 2] No such file or directory: 'iwconfig'
Lsusb:
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Lsusb-t:
/: Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/8p, 5000M
/: Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/8p, 480M
MachineType: QEMU Standard PC (Q35 + ICH9, 2009)
Package: linux (not installed)
PciMultimedia:
ProcEnviron:
TERM=xterm-
PATH=(custom, no user)
LANG=C.UTF-8
SHELL=/bin/bash
ProcFB: 0 virtio_gpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=
ProcVersionSign
RelatedPackageV
linux-
linux-
linux-firmware 20220329.
RfKill: Error: [Errno 2] No such file or directory: 'rfkill'
Tags: jammy uec-images
Uname: Linux 5.15.0-37-generic x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: N/A
_MarkForUpload: True
dmi.bios.date: 02/06/2015
dmi.bios.release: 0.0
dmi.bios.vendor: EFI Development Kit II / OVMF
dmi.bios.version: 0.0.0
dmi.board.name: LXD
dmi.board.vendor: Canonical Ltd.
dmi.board.version: pc-q35-7.0
dmi.chassis.type: 1
dmi.chassis.vendor: QEMU
dmi.chassis.
dmi.modalias: dmi:bvnEFIDevel
dmi.product.name: Standard PC (Q35 + ICH9, 2009)
dmi.product.
dmi.sys.vendor: QEMU
CVE References
Changed in ovn (Ubuntu): | |
status: | New → Triaged |
importance: | Undecided → High |
Changed in openvswitch (Ubuntu): | |
status: | New → Triaged |
importance: | Undecided → High |
Changed in ovn (Ubuntu): | |
status: | Triaged → Invalid |
Changed in ovn (Ubuntu): | |
importance: | High → Undecided |
Changed in openvswitch (Ubuntu): | |
status: | Triaged → Invalid |
Changed in linux (Ubuntu Jammy): | |
status: | New → Confirmed |
Changed in linux (Ubuntu Focal): | |
status: | New → Confirmed |
Changed in linux (Ubuntu Impish): | |
status: | New → Confirmed |
Changed in linux (Ubuntu Jammy): | |
importance: | Undecided → Medium |
Changed in linux (Ubuntu Focal): | |
importance: | Undecided → Medium |
Changed in linux (Ubuntu Impish): | |
status: | Confirmed → Won't Fix |
Changed in linux (Ubuntu Kinetic): | |
status: | Confirmed → Invalid |
Changed in linux (Ubuntu Jammy): | |
status: | Confirmed → Fix Committed |
Changed in linux (Ubuntu Focal): | |
status: | Confirmed → Fix Committed |
description: | updated |
Changed in openvswitch (Ubuntu Impish): | |
status: | New → Won't Fix |
Changed in ovn (Ubuntu Impish): | |
status: | New → Won't Fix |
Is it possible to attach the OVN dbs ?
I'm not able to reproduce it locally. For me a different zone for snat is used on the gateway chassis for the hairpin traffic.