Source and dest ports in acl are set to 0 causing snat packets to get dropped

[Vedamurthy Joshi]

2.0 Build 18 multi-node icehouse Ubuntu 14.04 setup

In a typical snat setup with 2 compute nodes, it was seen snatted packets were getting dropped

Per Naveen, the issue was due to both source and dest ports set to 0 causing flow action drops

We tried his change in schema code and snat worked fine then.

diff --git a/src/config/schema-transformer/to_bgp.py b/src/config/schema-transformer/to_bgp.py
index 04af4f5..94eca8c 100644
--- a/src/config/schema-transformer/to_bgp.py
+++ b/src/config/schema-transformer/to_bgp.py
@@ -2132,7 +2132,7 @@ class VirtualMachineInterfaceST(DictST):

             address = AddressType(subnet=SubnetType(
                 ip_obj.get_instance_ip_address(), 32))
- mc = MatchConditionType(src_address=address)
+ mc = MatchConditionType(src_address=address, src_port=PortType(-1, -1), dst_port=PortType(-1, -1), protocol="any")

--------------

From: Naveen N <email address hidden>
Date: Monday, December 8, 2014 at 9:01 PM
To: Sachin Bansal <email address hidden>
Cc: Vedamurthy Joshi <email address hidden>, Sandip Dey <email address hidden>, Divakar Dharanalakota <email address hidden>
Subject: Re: [Bug 1392260] [NEW] Ubuntu mainline 2453: Kernel route lookup failing for SNAT

Hi Sachin,
  Port range comes as 0 to 0, for both source and destination port,
Can you please take care of it.
<vrf-assign-rule>
   <match-condition>
    <protocol></protocol>
    <src-address>
     <subnet>
      <ip-prefix>192.168.0.2</ip-prefix>
      <ip-prefix-len>32</ip-prefix-len>
     </subnet>
     <virtual-network></virtual-network>
     <security-group></security-group>
     <network-policy></network-policy>
    </src-address>
    <src-port>
     <start-port>0</start-port>
     <end-port>0</end-port>
    </src-port>
    <dst-address>
     <subnet>
      <ip-prefix></ip-prefix>
      <ip-prefix-len>0</ip-prefix-len>
     </subnet>
     <virtual-network></virtual-network>
     <security-group></security-group>
     <network-policy></network-policy>
    </dst-address>

Regards
Naveen N

[Ashish Ranjan (aranjan-n)]

Fix is in zuul