Conntrack rules in the qrouter are not deleted when a fip is removed with dvr
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
neutron |
Fix Released
|
Low
|
Rodolfo Alonso |
Bug Description
If a fip ip is removed of a network with a distributed router:
openstack server remove floating ip X
The conntrack rules aren't deleted in the qrouter and the qrouter continues doing nating of the ongoing connections.
overcloud) [stack@undercloud-0 ~]$ openstack router show router
+------
| Field | Value |
+------
| admin_state_up | UP |
| availability_
| availability_zones | nova |
| created_at | 2019-02-
| description | |
| distributed | True |
| external_
| flavor_id | None |
| ha | False |
| id | d01c89b0-
| interfaces_info | [{"subnet_id": "5e8ddfa7-
| name | router |
| project_id | 9447276fedbf4c4
| revision_number | 13 |
| routes | |
| status | ACTIVE |
| tags | |
| updated_at | 2019-03-
+------
(overcloud) [stack@undercloud-0 ~]$
(overcloud) [stack@undercloud-0 ~]$
(overcloud) [stack@undercloud-0 ~]$
(overcloud) [stack@undercloud-0 ~]$ openstack server list
+------
| ID | Name | Status | Networks | Image | Flavor |
+------
| 8aad2992-
| 028e0696-
| 46432868-
| fca6541e-
+------
$ ip a
1: lo: <LOOPBACK,
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,
link/ether fa:16:3e:6e:0e:f7 brd ff:ff:ff:ff:ff:ff
inet 10.2.0.12/24 brd 10.2.0.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::f816:
valid_lft forever preferred_lft forever
$ hostname
selfservice2-
$
$
$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=116 time=49.554 ms
64 bytes from 8.8.8.8: seq=1 ttl=116 time=48.893 ms
64 bytes from 8.8.8.8: seq=2 ttl=116 time=48.897 ms
64 bytes from 8.8.8.8: seq=3 ttl=116 time=48.988 ms
....
[heat-admin@
[root@compute-1 heat-admin]# yum install conntrack-tools
....
[root@compute-1 heat-admin]# conntrack -L
icmp 1 29 src=10.2.0.12 dst=8.8.8.8 type=8 code=0 id=45825 src=8.8.8.8 dst=10.0.0.210 type=0 code=0 id=45825 mark=0 secctx=
conntrack v1.4.4 (conntrack-tools): 1 flow entries have been shown.
[root@compute-1 heat-admin]#
(overcloud) [stack@undercloud-0 ~]$ openstack server remove floating ip selfservice2-
(overcloud) [stack@undercloud-0 ~]$ date
Wed Mar 6 04:59:40 EST 2019
(overcloud) [stack@undercloud-0 ~]$
Then connectivity is lost:
64 bytes from 8.8.8.8: seq=813 ttl=116 time=48.753 ms
64 bytes from 8.8.8.8: seq=814 ttl=116 time=48.895 ms
because conntrack flow is not deleted:
[root@compute-1 heat-admin]# conntrack -L
icmp 1 29 src=10.2.0.12 dst=8.8.8.8 type=8 code=0 id=45825 src=8.8.8.8 dst=10.0.0.210 type=0 code=0 id=45825 mark=0 secctx=
conntrack v1.4.4 (conntrack-tools): 1 flow entries have been shown.
[root@compute-1 heat-admin]# date
Wed Mar 6 10:02:04 UTC 2019
[root@compute-1 heat-admin]# conntrack -L
icmp 1 29 src=10.2.0.12 dst=8.8.8.8 type=8 code=0 id=45825 src=8.8.8.8 dst=10.0.0.210 type=0 code=0 id=45825 mark=0 secctx=
conntrack v1.4.4 (conntrack-tools): 1 flow entries have been shown.
[root@compute-1 heat-admin]#
If I delete the flow the connectiviy is recovered(same behavior that without dvr):
[root@compute-1 heat-admin]# conntrack -D
icmp 1 29 src=10.2.0.12 dst=8.8.8.8 type=8 code=0 id=45825 src=8.8.8.8 dst=10.0.0.210 type=0 code=0 id=45825 mark=0 secctx=
conntrack v1.4.4 (conntrack-tools): 1 flow entries have been deleted.
[root@compute-1 heat-admin]# conntrack -L
icmp 1 28 src=10.2.0.12 dst=8.8.8.8 type=8 code=0 id=45825 [UNREPLIED] src=8.8.8.8 dst=10.2.0.12 type=0 code=0 id=45825 mark=0 secctx=
conntrack v1.4.4 (conntrack-tools): 1 flow entries have been shown.
[root@compute-1 heat-admin]#
....
64 bytes from 8.8.8.8: seq=812 ttl=116 time=48.791 ms
64 bytes from 8.8.8.8: seq=813 ttl=116 time=48.753 ms
64 bytes from 8.8.8.8: seq=814 ttl=116 time=48.895 ms
64 bytes from 8.8.8.8: seq=980 ttl=117 time=49.979 ms
64 bytes from 8.8.8.8: seq=981 ttl=117 time=49.164 ms
64 bytes from 8.8.8.8: seq=982 ttl=117 time=49.524 ms
64 bytes from 8.8.8.8: seq=983 ttl=117 time=49.143 ms
....
tags: | added: l3-dvr-backlog |
tags: | added: pike-backport-potential queens-backport-potential |
Fix proposed to branch: master /review. openstack. org/641747
Review: https:/