iptables manager doesn't properly handle duplicate non-wrapped chains

[Aaron Knister]

The iptables manager can fail to load iptables rules if a chain to be created already exists. The solution seems to be to decrement rule_index. This seems to cause vif plugging to fail.

[Openstack Gerrit (openstack-gerrit)]

Fix proposed to branch: master
Review: https://review.openstack.org/89952

[Openstack Gerrit (openstack-gerrit)]

Fix proposed to branch: stable/havana
Review: https://review.openstack.org/89953

[Openstack Gerrit (openstack-gerrit)]

Fix proposed to branch: stable/havana
Review: https://review.openstack.org/89956

[Openstack Gerrit (openstack-gerrit)]

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/89957

[Brian Haley (brian-haley)]

Can you give an example of this failure? I have an out-of-tree test that can pass duplicate chains and I don't see the failure. I'm not saying there isn't something broken though...

[Nachi Ueno (nati-ueno)]

yes. could you share how to reproduce this?

[Aaron Knister (aaron-knister)]

Sorry for the very long delay here. I've reproduced this with a minimal set of firewall rules that I've attached below. The neutron ovs agent will consistently blow up if it starts up after these rules have been applied.

[Aaron Knister (aaron-knister)]

I also re-based the patch just now

[Aaron Knister (aaron-knister)]

I snuck a debugging statement in the code and grabbed the list of rules just before they were applied. I'm attaching logs of the same step with and without the patch.

[Aaron Knister (aaron-knister)]

After creating the unit test, it looks like this specifically happens with duplicate rules (duplicate relative to the rules currently loaded in iptables) that are not wrapped (e.g. table.add_rule('myrule' ,wrap=False)).

[OpenStack Infra (hudson-openstack)]

Change abandoned by Aaron Knister (<email address hidden>) on branch: stable/havana
Review: https://review.openstack.org/89956
Reason: Abandoning until the merge into master is complete.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Aaron Knister (<email address hidden>) on branch: stable/icehouse
Review: https://review.openstack.org/89957
Reason: Abandoning until change is merged into master.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Kyle Mestery (<email address hidden>) on branch: master
Review: https://review.openstack.org/89952
Reason: This change is old enough and hasn't seen any updates since July 30, 2014. Abandoning it, please revive it if you plan to work on it again.

[Armando Migliaccio (armando-migliaccio)]

This bug is > 172 days without activity. We are unsetting assignee and milestone and setting status to Incomplete in order to allow its expiry in 60 days.

If the bug is still valid, then update the bug status.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]