Associating a floatingip with a dual stack port requires the fixed-address to be specified

Bug #1469322 reported by Dustin Lundquist on 2015-06-26
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
neutron
High
Dustin Lundquist
Kilo
Undecided
Unassigned

Bug Description

Associating a floatingip with a dual stack port fails unless the IPv4 address is specified with the fixed-ip-address parameter. Presently when a user attempts to associate a floatingip with a port which an IPv4 and IPv6 address Neutron returns 'Bad floatingip request: Port %s has multiple fixed IPs. Must provide a specific IP when assigning a floating IP'.

While this is a helpful error message, it would be better if Neutron could infer that the floating IP must be associated with the fixed-ip of the same address family.

See also https://bugs.launchpad.net/neutron/+bug/1323766, restricting floating IPs to IPv4 would simply things since associating an dual stack floating IP with a dual stack port could result in any of the following:

1. 1:1 NAT between the IPv4 address of the floating IP and IPv4 address of
the associated port.
2. 1:1 NAT between the IPv6 address of the floating IP and IPv6 address of the associated port.
3. Both 1 and 2 (Neutron presently only uses the first fixed-ip of the port owned by the floating IP)
4. a NAT-PT between the IPv4 address of the floating IP and IPv6 address of
the associated port
5. a NAT-PT between the IPv6 address of the floating IP and IPv4 address of
the associated port

Since NAT-PT and IPv6 NAT are not widely supported option 1 would be preferable and the most intuitive of these results.

description: updated
Kyle Mestery (mestery) wrote :

Yes please.

Changed in neutron:
status: New → Confirmed
importance: Undecided → High
tags: added: l3-ipam-dhcp
Changed in neutron:
assignee: nobody → Dustin Lundquist (dlundquist)
status: Confirmed → In Progress
Carl Baldwin (carl-baldwin) wrote :

This seems to be related to https://bugs.launchpad.net/neutron/+bug/1323766 . I suspect that a single fix could hit both these bugs.

Reviewed: https://review.openstack.org/198908
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=4cdc71e7d0e5220a5f12ee2dfea1ff3db045c041
Submitter: Jenkins
Branch: master

commit 4cdc71e7d0e5220a5f12ee2dfea1ff3db045c041
Author: Dustin Lundquist <email address hidden>
Date: Mon Jul 6 13:53:46 2015 -0700

    Ensure floating IPs only use IPv4 addresses

    Description:
    Presently Neutron doesn't validate the address family of floating IP
    addresses or the internal addresses they are associated with. It merely
    associates the first IP of the floating IP's port with the first IP of
    the internal port, unless a specified fixed IP is specified. This can
    lead to incorrect or poorly defined behavior when IPv6 is present.

    The existing L3 agent implementation only manages IPv4 NAT rules. While
    IPv6 NAT and NAT protocol translation are possible, the existing
    implementation does not support these configurations.

    Presently a floating IP can be created on an IPv6 only external network
    or associated with an IPv6 fixed IP, but the L3 agent is unable to bind
    these configurations.

    Implementation:
    When creating and updating a floating IP, only consider IPv4 addresses
    on both the floating IPs port and the internal port he floating IP is
    associated with. Additionally disallow creating floating IPs on networks
    without any IPv4 subnets, since these floating IPs could not be
    allocated an IPv4 address.

    DocImpact
    APIImpact

    Co-Authored-By: Bradley Jones <email address hidden>
    Change-Id: I79b28a304b38ecdafc17eddc41213df1c24ec202
    Related-Bug: #1437855
    Closes-Bug: #1323766
    Closes-Bug: #1469322

Changed in neutron:
status: In Progress → Fix Committed
Changed in neutron:
milestone: none → liberty-2
status: Fix Committed → Fix Released
Download full text (70.7 KiB)

Reviewed: https://review.openstack.org/207903
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=9badcd249dab2d3330f0cd608496b59c9f44499a
Submitter: Jenkins
Branch: feature/pecan

commit 991ea00e6c115343eabecc62e86072175823f81f
Author: Moshe Levi <email address hidden>
Date: Thu Jul 30 12:04:15 2015 +0300

    SR-IOV: Fix SR-IOV agent to run ip link commands as root

    Commit https://review.openstack.org/#/c/155523/
    remove the remaining root_helper args, but didn't
    update the SR-IOV agent to execute them as root.

    This patch updates the agent to execute ip link commands
    as root and pass options argument as a list in the
    self._as_root method.

    Closes-Bug: #1479694
    Change-Id: I53cafd61845a69fae3a759fb7526950d655ffa20

commit 5b3bacedf6c014815bef03c2e821b5eb8ef92dcb
Author: Saksham Varma <email address hidden>
Date: Thu Jul 23 22:46:23 2015 -0700

    Moved out cisco n1kv mech driver and db models

    Moving out Cisco N1Kv database models and the mech driver
    to the openstack/networking-cisco repo as part of the second
    phase vendor-core decomposition

    Partial-Bug: #1479123
    Partial-implements: blueprint core-vendor-decomposition

    Change-Id: I65a704b238d8cbe2951a6912fa4f1e8518c6f412

commit 65ac8cd0a80548e115b8ec1d4cfd47a94422fddf
Author: OpenStack Proposal Bot <email address hidden>
Date: Wed Jul 29 20:44:01 2015 +0000

    Updated from global requirements

    Change-Id: I3a884a73d51df0f93b5cc88b3e3250d81bb1f455

commit f0e8356d04d04600c072a1c0f0bdf274ff19ab8c
Author: sridhargaddam <email address hidden>
Date: Mon Jul 27 03:46:48 2015 +0000

    Update dhcp agent cache for network:dhcp ports

    When a network with a dhcp_enabled subnet is scheduled on a dhcp
    agent, dhcp driver creates the network:dhcp port for the subnet.
    However, the port info is not updated in dhcp agents internal cache.
    Subsequently if the user deletes the network:dhcp port, the port is
    properly deleted on the server side (i.e., in the database) and when
    the port_delete_end notification is sent to the dhcp agent, it simply
    ignores it as the port entry would be missing in the cache. This patch
    fixes this issue by updating the dhcp agents cache when dhcp driver
    creates the network:dhcp port for the subnets.

    Closes-Bug: #1478426
    Change-Id: I69f5834dd964a4320c606c4e0aa2cdba70416943

commit cb60d0bb4e0cc0cba68f59fdf5f4e89d6ec52950
Author: changzhi <email address hidden>
Date: Thu Jul 16 10:14:16 2015 +0800

    Keep dns nameserver order consistency

    Currently, there is no dns servers prioritization for subnets
    for Neutron.

    Generally speaking, it is useful to keep the order of dns
    nameservers consistent. Add a new column named 'order' in table
    'dnsnameservers' and add nameserver into DB one by one.

    Closes-Bug: #1218629
    Implements: blueprint keep-dns-nameserver-orderconsistency
    Change-Id: Id937aea411397d39370368a4eb45be26c4eefa9e

commit b39e1469e824bc8bc79e1ecafa98825a94811c0b
Author: Salvatore Orlando <email address hidden>
Date: Tue Jun 23 04:54:2...

tags: added: in-feature-pecan
Thierry Carrez (ttx) on 2015-10-15
Changed in neutron:
milestone: liberty-2 → 7.0.0

Reviewed: https://review.openstack.org/267891
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=4858cd7cb97354ae54f8e7d47aeaaddad714c9dd
Submitter: Jenkins
Branch: stable/kilo

commit 4858cd7cb97354ae54f8e7d47aeaaddad714c9dd
Author: Dustin Lundquist <email address hidden>
Date: Mon Jul 6 13:53:46 2015 -0700

    Ensure floating IPs only use IPv4 addresses

    Description:
    Presently Neutron doesn't validate the address family of floating IP
    addresses or the internal addresses they are associated with. It merely
    associates the first IP of the floating IP's port with the first IP of
    the internal port, unless a specified fixed IP is specified. This can
    lead to incorrect or poorly defined behavior when IPv6 is present.

    The existing L3 agent implementation only manages IPv4 NAT rules. While
    IPv6 NAT and NAT protocol translation are possible, the existing
    implementation does not support these configurations.

    Presently a floating IP can be created on an IPv6 only external network
    or associated with an IPv6 fixed IP, but the L3 agent is unable to bind
    these configurations.

    Implementation:
    When creating and updating a floating IP, only consider IPv4 addresses
    on both the floating IPs port and the internal port he floating IP is
    associated with. Additionally disallow creating floating IPs on networks
    without any IPv4 subnets, since these floating IPs could not be
    allocated an IPv4 address.

    DocImpact
    APIImpact

    Co-Authored-By: Bradley Jones <email address hidden>
    Change-Id: I79b28a304b38ecdafc17eddc41213df1c24ec202
    Related-Bug: #1437855
    Closes-Bug: #1323766
    Closes-Bug: #1469322
    (cherry picked from commit 4cdc71e7d0e5220a5f12ee2dfea1ff3db045c041)

tags: added: in-stable-kilo

This issue was fixed in the openstack/neutron 2015.1.4 release.

This issue was fixed in the openstack/neutron 2015.1.4 release.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers