[SRU] When router has no ports _process_updated_router fails because the namespace does not exist

[Saverio Proto]

[Description]
[Testcase]
Happens in Kilo. Cannot test on other releases.

Steps to reproduce:

1) create a router and set at least a port, also the gateway is fine
2) check that the namespace exists with
   ip netns show | grep qrouter-<uuid>
3) check the ports are there
   ip netns exec qrouter-<uuid> ip addr show
4) delete all ports from the router
5) check that only loopback interface is present
   ip netns exec qrouter-<uuid> ip addr show
6) run the cronjob task that is installed in the file
   /etc/cron.d/neutron-l3-agent-netns-cleanup
    so basically run this command:
   /usr/bin/neutron-netns-cleanup --config-file=/etc/neutron/neutron.conf --config-file=/etc/neutron/l3_agent.ini
7) the namespace should be gone:
   ip netns show | grep qrouter-<uuid>
8) delete the neutron router.
9) check log file /var/log/neutron/vpn-agent.log

When the router has no ports the namespace is deleted from the network node by the cronjob. However this brakes the router updates and the file vpn-agent.log is flooded with this traces:

2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info Traceback (most recent call last):
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info File "/usr/lib/python2.7/dist-packages/neutron/common/utils.py", line 343, in call
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info return func(*args, **kwargs)
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info File "/usr/lib/python2.7/dist-packages/neutron/agent/l3/router_info.py", line 628, in process
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info self._process_internal_ports()
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info File "/usr/lib/python2.7/dist-packages/neutron/agent/l3/router_info.py", line 404, in _process_internal_ports
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info existing_devices = self._get_existing_devices()
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info File "/usr/lib/python2.7/dist-packages/neutron/agent/l3/router_info.py", line 328, in _get_existing_devices
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info ip_devs = ip_wrapper.get_devices(exclude_loopback=True)
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info File "/usr/lib/python2.7/dist-packages/neutron/agent/linux/ip_lib.py", line 102, in get_devices
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info log_fail_as_error=self.log_fail_as_error
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info File "/usr/lib/python2.7/dist-packages/neutron/agent/linux/utils.py", line 137, in execute
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info raise RuntimeError(m)
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info RuntimeError:
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info Command: ['sudo', 'neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-8fc0f640-35bb-4d0b-bbbd-80c22be0e762', 'find', '/sys/class/net', '-maxdepth', '1', '-type', 'l', '-printf', '%f ']
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info Exit code: 1
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info Stdin:
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info Stdout:
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info Stderr: Cannot open network namespace "qrouter-8fc0f640-35bb-4d0b-bbbd-80c22be0e762": No such file or directory
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info
2016-04-21 16:22:17.771 23382 TRACE neutron.agent.l3.router_info
2016-04-21 16:22:17.774 23382 ERROR neutron.agent.l3.agent [-] Failed to process compatible router '8fc0f640-35bb-4d0b-bbbd-80c22be0e762'
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent Traceback (most recent call last):
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent File "/usr/lib/python2.7/dist-packages/neutron/agent/l3/agent.py", line 467, in _process_router_update
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent self._process_router_if_compatible(router)
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent File "/usr/lib/python2.7/dist-packages/neutron/agent/l3/agent.py", line 414, in _process_router_if_compatible
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent self._process_updated_router(router)
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent File "/usr/lib/python2.7/dist-packages/neutron/agent/l3/agent.py", line 428, in _process_updated_router
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent ri.process(self)
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent File "/usr/lib/python2.7/dist-packages/neutron/common/utils.py", line 346, in call
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent self.logger(e)
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent File "/usr/lib/python2.7/dist-packages/oslo_utils/excutils.py", line 85, in __exit__
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent six.reraise(self.type_, self.value, self.tb)
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent File "/usr/lib/python2.7/dist-packages/neutron/common/utils.py", line 343, in call
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent return func(*args, **kwargs)
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent File "/usr/lib/python2.7/dist-packages/neutron/agent/l3/router_info.py", line 628, in process
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent self._process_internal_ports()
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent File "/usr/lib/python2.7/dist-packages/neutron/agent/l3/router_info.py", line 404, in _process_internal_ports
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent existing_devices = self._get_existing_devices()
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent File "/usr/lib/python2.7/dist-packages/neutron/agent/l3/router_info.py", line 328, in _get_existing_devices
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent ip_devs = ip_wrapper.get_devices(exclude_loopback=True)
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent File "/usr/lib/python2.7/dist-packages/neutron/agent/linux/ip_lib.py", line 102, in get_devices
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent log_fail_as_error=self.log_fail_as_error
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent File "/usr/lib/python2.7/dist-packages/neutron/agent/linux/utils.py", line 137, in execute
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent raise RuntimeError(m)
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent RuntimeError:
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent Command: ['sudo', 'neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-8fc0f640-35bb-4d0b-bbbd-80c22be0e762', 'find', '/sys/class/net', '-maxdepth', '1', '-type', 'l', '-printf', '%f ']
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent Exit code: 1
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent Stdin:
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent Stdout:
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent Stderr: Cannot open network namespace "qrouter-8fc0f640-35bb-4d0b-bbbd-80c22be0e762": No such file or directory
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent
2016-04-21 16:22:17.774 23382 TRACE neutron.agent.l3.agent

[Regression Potential]
The patches that we're picking up in our packages have already landed upstream in master (zesty), stable/newton (yakkety), and stable/mitaka (xenial).

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/309050

[Saverio Proto (zioproto)]

The namespaces with only the loopback interfaces are purged by a cronjob automatically installed with the ubuntu packages:

Filename: /etc/cron.d/neutron-l3-agent-netns-cleanup
Content:

# vim: set filetype=crontab:
# Periodically cleans Neutron's network namespaces on behalf of the Neutron
# L3 agent.
0 * * * * neutron if [ -x /usr/bin/neutron-netns-cleanup ] ; then /usr/bin/neutron-netns-cleanup --config-file=/etc/neutron/neutron.conf --config-file=/etc/neutron/l3_agent.ini >/dev/null 2>&1; fi

So basically this command:

/usr/bin/neutron-netns-cleanup --config-file=/etc/neutron/neutron.conf --config-file=/etc/neutron/l3_agent.ini

Will delete the namespaces if there is only the loopback interface.

So if you create a router in neutron and then you delete all interfaces and you clear the gateway, you will end up with a router in the neutron database but not a namespace in the network node.

This is why neutron code should always check if the namespace really exists before trying to exec commands in the namespace.

[Saverio Proto (zioproto)]

I was able to workaround this bug in Kilo applying to my production system this patch:
https://gist.github.com/zioproto/9aba7336b18e9769a85d55d520540456

This contribution was not accepted upstream but it fixed the problem for me in Kilo.

The bug is still there in Liberty. I now need to rework the patch for Liberty.

[Saverio Proto (zioproto)]

Patch for Liberty submitted to Neutron packages in Ubuntu

https://code.launchpad.net/~zioproto/ubuntu/+source/neutron/+git/neutron/+merge/309457

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/309050
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=7675495f260daf0174f4e04b36279513889df19a
Submitter: Jenkins
Branch: master

commit 7675495f260daf0174f4e04b36279513889df19a
Author: Saverio Proto <email address hidden>
Date: Thu Apr 21 16:50:07 2016 +0200

    Check if namespace exists before getting devices

    If a neutron router has no ports defined, its namespace is deleted
    by the cronjob /etc/cron.d/neutron-l3-agent-netns-cleanup.
    It is required to check if the namespace exists before calling
    iproute2 commands against the namespace.
    It is not enough for the string of the namespace uuid to be defined,
    the namespace must really exist on the network node.
    This patch checks if the namespace exists when calling get_devices().
    Otherwise the agent log file will be flooded with messages like
    Cannot open network namespace "qrouter-<uuid>": No such file or directory
    Failed to process compatible router '<uuid>'

    Related-bug: 1573073

    Change-Id: I744ef11529f9da5cbfdb812de0b35b95f9d078bb

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/newton
Review: https://review.openstack.org/393739

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/393754

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/393754
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=4339740b931dbf4e44f487dfdc91acfb84992d4a
Submitter: Jenkins
Branch: stable/mitaka

commit 4339740b931dbf4e44f487dfdc91acfb84992d4a
Author: Saverio Proto <email address hidden>
Date: Thu Apr 21 16:50:07 2016 +0200

    Check if namespace exists before getting devices

    If a neutron router has no ports defined, its namespace is deleted
    by the cronjob /etc/cron.d/neutron-l3-agent-netns-cleanup.
    It is required to check if the namespace exists before calling
    iproute2 commands against the namespace.
    It is not enough for the string of the namespace uuid to be defined,
    the namespace must really exist on the network node.
    This patch checks if the namespace exists when calling get_devices().
    Otherwise the agent log file will be flooded with messages like
    Cannot open network namespace "qrouter-<uuid>": No such file or directory
    Failed to process compatible router '<uuid>'

    Related-bug: 1573073

    Change-Id: I744ef11529f9da5cbfdb812de0b35b95f9d078bb
    (cherry picked from commit 7675495f260daf0174f4e04b36279513889df19a)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/393739
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=5a3dadc60103a8c2dc88446fe4b2412c9bdf0790
Submitter: Jenkins
Branch: stable/newton

commit 5a3dadc60103a8c2dc88446fe4b2412c9bdf0790
Author: Saverio Proto <email address hidden>
Date: Thu Apr 21 16:50:07 2016 +0200

    Check if namespace exists before getting devices

    If a neutron router has no ports defined, its namespace is deleted
    by the cronjob /etc/cron.d/neutron-l3-agent-netns-cleanup.
    It is required to check if the namespace exists before calling
    iproute2 commands against the namespace.
    It is not enough for the string of the namespace uuid to be defined,
    the namespace must really exist on the network node.
    This patch checks if the namespace exists when calling get_devices().
    Otherwise the agent log file will be flooded with messages like
    Cannot open network namespace "qrouter-<uuid>": No such file or directory
    Failed to process compatible router '<uuid>'

    Related-bug: 1573073

    Change-Id: I744ef11529f9da5cbfdb812de0b35b95f9d078bb
    (cherry picked from commit 7675495f260daf0174f4e04b36279513889df19a)

[Corey Bryant (corey.bryant)]

Hi Savario, Thanks again for getting your patch upstream. The upstream patches have landed for master, newton, and mitaka, so I've picked those patches into our packages and uploaded to zesty, yakkety, and xenial. yakkety and xenial are awaiting SRU team review before they'll be accepted into the -proposed pockets for testing. Once those get accepted we can get those backported to corresponding cloud archives, and start the backport to the liberty cloud archive.

[Launchpad Janitor (janitor)]

This bug was fixed in the package neutron - 2:9.0.0-0ubuntu3.1

---------------
neutron (2:9.0.0-0ubuntu3.1) zesty; urgency=medium

  * d/p/check-namespace-before-getting-devices.patch: Cherry-pick patch
    from upstream master branch to check if router namespace exists before
    getting devices (LP: #1573073).

 -- Corey Bryant <email address hidden> Thu, 10 Nov 2016 17:01:15 -0500

[Brian Murray (brian-murray)]

Hello Saverio, or anyone else affected,

Accepted neutron into yakkety-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/neutron/2:9.0.0-0ubuntu1.16.10.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Brian Murray (brian-murray)]

Hello Saverio, or anyone else affected,

Accepted neutron into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/neutron/2:8.3.0-0ubuntu1.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Ryan Beisner (1chb1n)]

Hello Saverio, or anyone else affected,

Accepted neutron into liberty-proposed. The package will build now and be available in the Ubuntu Cloud Archive in a few hours, and then in the -proposed repository.

Please help us by testing this new package. To enable the -proposed repository:

  sudo add-apt-repository cloud-archive:liberty-proposed
  sudo apt-get update

Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-liberty-needed to verification-liberty-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-liberty-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Ryan Beisner (1chb1n)]

Hello Saverio, or anyone else affected,

Accepted neutron into mitaka-proposed. The package will build now and be available in the Ubuntu Cloud Archive in a few hours, and then in the -proposed repository.

Please help us by testing this new package. To enable the -proposed repository:

  sudo add-apt-repository cloud-archive:mitaka-proposed
  sudo apt-get update

Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-mitaka-needed to verification-mitaka-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-mitaka-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[James Page (james-page)]

The verification of the Stable Release Update for neutron has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[James Page (james-page)]

This bug was fixed in the package neutron - 2:7.2.0-0ubuntu1~cloud1
---------------

 neutron (2:7.2.0-0ubuntu1~cloud1) trusty-liberty; urgency=medium
 .
   * Fix router namespace cleanup (LP: #1573073)
     - d/p/ns-exists-before-get-devices.patch

[Corey Bryant (corey.bryant)]

Regression tested successfully on all releases.

[Launchpad Janitor (janitor)]

This bug was fixed in the package neutron - 2:8.3.0-0ubuntu1.2

---------------
neutron (2:8.3.0-0ubuntu1.2) xenial; urgency=medium

  * d/p/check-namespace-before-getting-devices.patch: Cherry-pick patch
    from upstream stable/mitaka branch to check if router namespace exists
    before getting devices (LP: #1573073).

 -- Corey Bryant <email address hidden> Thu, 10 Nov 2016 14:10:37 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package neutron - 2:9.0.0-0ubuntu1.16.10.2

---------------
neutron (2:9.0.0-0ubuntu1.16.10.2) yakkety; urgency=medium

  * d/p/check-namespace-before-getting-devices.patch: Cherry-pick patch
    from upstream stable/newton branch to check if router namespace exists
    before getting devices (LP: #1573073).

 -- Corey Bryant <email address hidden> Thu, 10 Nov 2016 14:05:14 -0500

[Ryan Beisner (1chb1n)]

This bug was fixed in the package neutron - 2:9.0.0-0ubuntu1.16.10.2~cloud0
---------------

 neutron (2:9.0.0-0ubuntu1.16.10.2~cloud0) xenial-newton; urgency=medium
 .
   * New update for the Ubuntu Cloud Archive.
 .
 neutron (2:9.0.0-0ubuntu1.16.10.2) yakkety; urgency=medium
 .
   * d/p/check-namespace-before-getting-devices.patch: Cherry-pick patch
     from upstream stable/newton branch to check if router namespace exists
     before getting devices (LP: #1573073).

[Ryan Beisner (1chb1n)]

The verification of the Stable Release Update for neutron has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Ryan Beisner (1chb1n)]

This bug was fixed in the package neutron - 2:8.3.0-0ubuntu1.2~cloud0
---------------

 neutron (2:8.3.0-0ubuntu1.2~cloud0) trusty-mitaka; urgency=medium
 .
   * New update for the Ubuntu Cloud Archive.
 .
 neutron (2:8.3.0-0ubuntu1.2) xenial; urgency=medium
 .
   * d/p/check-namespace-before-getting-devices.patch: Cherry-pick patch
     from upstream stable/mitaka branch to check if router namespace exists
     before getting devices (LP: #1573073).

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/450271

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/450271
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=3889b0f214fbb1d32531395cff232cf57daf7b17
Submitter: Jenkins
Branch: master

commit 3889b0f214fbb1d32531395cff232cf57daf7b17
Author: Saverio Proto <email address hidden>
Date: Mon Mar 27 16:39:16 2017 +0200

    Dont try to apply iptables rules in a endless loop

    If the namespace does not exist the current behavior
    is to try to apply the iptables rules forever in a
    endless loop. This fills up the logs on the network
    node and leads to outage.

    Change-Id: I628b18a66f9478d7349fa1817431aae2f62ee105
    Related-bug: #1623664
    Related-bug: #1573073

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/ocata
Review: https://review.openstack.org/457467

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/newton
Review: https://review.openstack.org/457468

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/457468
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=44c3ee8cb2bc9adb6f4f95ba3f6be4c3abe344df
Submitter: Jenkins
Branch: stable/newton

commit 44c3ee8cb2bc9adb6f4f95ba3f6be4c3abe344df
Author: Saverio Proto <email address hidden>
Date: Mon Mar 27 16:39:16 2017 +0200

    Dont try to apply iptables rules in a endless loop

    If the namespace does not exist the current behavior
    is to try to apply the iptables rules forever in a
    endless loop. This fills up the logs on the network
    node and leads to outage.

    Change-Id: I628b18a66f9478d7349fa1817431aae2f62ee105
    Related-bug: #1623664
    Related-bug: #1573073
    (cherry picked from commit 3889b0f214fbb1d32531395cff232cf57daf7b17)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/457467
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=8fed89b12b3eb6d3c73a4f53dcf66f85f5bd4e8f
Submitter: Jenkins
Branch: stable/ocata

commit 8fed89b12b3eb6d3c73a4f53dcf66f85f5bd4e8f
Author: Saverio Proto <email address hidden>
Date: Mon Mar 27 16:39:16 2017 +0200

    Dont try to apply iptables rules in a endless loop

    If the namespace does not exist the current behavior
    is to try to apply the iptables rules forever in a
    endless loop. This fills up the logs on the network
    node and leads to outage.

    Change-Id: I628b18a66f9478d7349fa1817431aae2f62ee105
    Related-bug: #1623664
    Related-bug: #1573073
    (cherry picked from commit 3889b0f214fbb1d32531395cff232cf57daf7b17)