[fullstack] test_vm_is_accessible_by_local_ip fails sometimes

[Oleg Bondarev]

Happens for "with_conntrack_rules" scenario.
Examples:

- https://b4c71a9e78e49e1ca534-33cd363c3f72485dda255154bdda0fc8.ssl.cf1.rackcdn.com/829247/2/check/neutron-fullstack-with-uwsgi/cdc875c/testr_results.html

- https://1c11d883c451b6b39e08-76fe6537709af1be557ea31f3d630d58.ssl.cf5.rackcdn.com/829022/3/check/neutron-fullstack-with-uwsgi/0243e12/testr_results.html

Traceback (most recent call last):
  File "/home/zuul/src/opendev.org/openstack/neutron/neutron/tests/base.py", line 183, in func
    return f(self, *args, **kwargs)
  File "/home/zuul/src/opendev.org/openstack/neutron/neutron/tests/fullstack/test_local_ip.py", line 111, in test_vm_is_accessible_by_local_ip
    vms.ping_all()
  File "/home/zuul/src/opendev.org/openstack/neutron/neutron/tests/fullstack/resources/machine.py", line 46, in ping_all
    vm_1.block_until_ping(vm_2.ip)
  File "/home/zuul/src/opendev.org/openstack/neutron/neutron/tests/common/machine_fixtures.py", line 67, in block_until_ping
    utils.wait_until_true(
  File "/home/zuul/src/opendev.org/openstack/neutron/neutron/common/utils.py", line 722, in wait_until_true
    raise exception
neutron.tests.common.machine_fixtures.FakeMachineException: No ICMP reply obtained from IP address 10.0.0.38

The test fails even before Local IP creation - on initial VMs connectivity check

[Oleg Bondarev (obondarev)]

The fact that it only fails for conntrack scenario and even before Local IP creation makes me think it might be related to iptables_hybrid firewall driver used for this scenario.
Looking at comments [1] and [2] I remembered that iptables_hybrid lacks isolation between hosts in fullstack tests. Since local_ip test uses 2 hosts we better use noop firewall for conntrack scenario.

[1] https://github.com/openstack/neutron/blob/3dfe6072421e3d5dc708a3bf065fb1a64ea3129a/neutron/tests/fullstack/test_securitygroup.py#L96

[2] https://github.com/openstack/neutron/blob/3dfe6072421e3d5dc708a3bf065fb1a64ea3129a/neutron/tests/fullstack/test_securitygroup.py#L536

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/829659

[Balazs Gibizer (balazs-gibizer)]

Two hits in the last 7 days: https://paste.opendev.org/show/bnVbsrh9kzuqcsMOyfQe/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/829659
Committed: https://opendev.org/openstack/neutron/commit/8217979fdcbab1304f3102419945ee7dc9931d51
Submitter: "Zuul (22348)"
Branch: master

commit 8217979fdcbab1304f3102419945ee7dc9931d51
Author: Oleg Bondarev <email address hidden>
Date: Thu Feb 17 11:21:21 2022 +0300

    [fullstack] use noop fw driver for Local IP conntrack test

    iptables_hybrid lacks isolation between hosts in fullstack tests.
    Since LocalIPTestCase uses 2 hosts we better set noop fw driver
    for conntrack scenario to avoid connectivity issues.

    Closes-Bug: #1961173
    Change-Id: Ib3238142daa0becbd7034b2faa66c6a9cf668d7e

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 20.0.0.0rc1 release candidate.