subnet's gateway ip can be unset while attached to router

Bug #2036423 reported by Weronika Sikora
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
neutron
Fix Released
Medium
Rodolfo Alonso

Bug Description

Hello

There's a weird issue with a subnet's gateway ip when it's attached to a router.

Normally, when you try to attach a subnet to a router, this subnet needs to have a gateway ip set. Otherwise the attachment will fail.

So we expect the subnet attached to a router to always have a gateway ip - this is used for creating the router interface after all.

However, when you attach a subnet with a gateway ip to a router and then attempt to unset this gateway ip... you can do that. There's no error, there's no connectivity lost, nothing is deleted. The router interface is still listed under "router show", the port exists, the connectivity is still working fine, as if nothing happened. But when you "subnet show", you can see the gateway ip is None.

This will result in error logs whenever the code tries to process certain things related to the router. Restarting the L3 agent will result in these errors, for example.

file: neutron/db/dvr_mac_db.py
method: get_subnet_for_dvr()
                LOG.error("Could not retrieve gateway port "
                          "for subnet %s", subnet_info)

file: neutron/plugins/ml2/drivers/openvswitch/agent/ovs_dvr_neutron_agent.py
method: _bind_centralized_snat_port_on_dvr_subnet()
                LOG.warning("DVR: Unable to retrieve subnet information "
                            "for subnet_id %s. The subnet or the gateway "
                            "may have already been deleted", subnet_uuid)

A user shouldn't be allowed to unset the gateway ip from a subnet that's already attached to a router. If they can't add a gateway-less subnet to a router, they shouldn't be allowed to unset it after the fact as well.

Tested on Stein and quickly checked if the behaviour still exists on Master.

To reproduce:

- Create a router
openstack router create r1
- Create a network with a subnet with gateway ip set (default behaviour)
openstack network create n1
openstack subnet create --subnet-range <blabla> --network n1 s1
- Add subnet to the router
openstack router add subnet r1 s1
- Unset the gateway ip from the subnet
openstack subnet set --gateway None s1

The gateway ip on the subnet will be listed as None, the router will still have the interface existing, the port will stil exist, all connectivity will remain intact, certain actions and agent restarts will trigger error logs.

tags: added: l3-dvr-backlog
removed: gateway gateway-ip router subnet unset
Revision history for this message
Brian Haley (brian-haley) wrote :

So there are a couple of things here.

1) Changing the gateway_ip of a subnet to None is valid as far as I know, it looks like the second sentence in the API doc is just a copy from the POST section, so should be removed.

"Gateway IP of this subnet. If the value is null that implies no gateway is associated with the subnet. If the gateway_ip is not specified, OpenStack Networking allocates an address from the CIDR for the gateway for the subnet by default."

And any instance booted that received DHCP info with that router as the gateway should continue to function.

2) Setting the gateway_ip to None won't remove the router interface, since in theory you could just be changing it to the interface of another router.

3) I didn't see the error/warning you mentioned in my quick testing when I restarted the l3-agent, so some more help would be required.

This isn't to say there's not a bug here, just that initial triage didn't reproduce it.

Changed in neutron:
status: New → Incomplete
Revision history for this message
Weronika Sikora (shushuda) wrote :

I did check again and while I couldn't see it on a singlenode Devstack, I did see it on multinode. The router needs to be DVR, in my case DVR-HA. The warning log prints on the snat node where the router is in backup mode, in the ovs agent. The error log prints then in the server.

Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for neutron because there has been no activity for 60 days.]

Changed in neutron:
status: Incomplete → Expired
Revision history for this message
Weronika Sikora (shushuda) wrote :

Hey, I see the ticket expired. I can still, however, reproduce this issue in the same way as described in my previous comment.

Changed in neutron:
status: Expired → Incomplete
Revision history for this message
Rodolfo Alonso (rodolfo-alonso-hernandez) wrote :

Hello:

The bug seems to be legit. When a router interface is added, the first check done is the GW IP: [1]. It is fair to consider that the subnet GW IP removal should not be allowed, inasmuch as the GW IP is required in the router interface addition ("router subnet add" command).

The subnet GW IP update is not allowed when the subnet has a router port already allocated [2].

Regards.

[1]https://github.com/openstack/neutron/blob/de58c1b99523104a471420ef0468147f13c9e98d/neutron/db/l3_db.py#L902-L904
[2]https://github.com/openstack/neutron/blob/de58c1b99523104a471420ef0468147f13c9e98d/neutron/db/db_base_plugin_v2.py#L715

Changed in neutron:
status: Incomplete → Confirmed
assignee: nobody → Rodolfo Alonso (rodolfo-alonso-hernandez)
importance: Undecided → Medium
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to neutron-tempest-plugin (master)

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/904710

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/904713

Changed in neutron:
status: Confirmed → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (master)

Reviewed: https://review.opendev.org/c/openstack/neutron/+/904713
Committed: https://opendev.org/openstack/neutron/commit/f9e40971e94e4fd239fcf7537b0f1200fbd4ee0f
Submitter: "Zuul (22348)"
Branch: master

commit f9e40971e94e4fd239fcf7537b0f1200fbd4ee0f
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Sun Jan 14 10:20:12 2024 +0000

    Forbid the subnet gateway IP deletion if a router interface is attached

    When a router interface is created, the corresponding subnet gateway IP
    is tested first [1]. If the subnet has no gateway IP, the router
    interface cannot be created. This IP will be assigned to this port.

    The Neutron API also prevents from modifying the subnet gateway IP
    if assigned to a router interface [2]. However the API is not
    preventing the subnet gateway IP deletion. This patch is adding
    this check.

    This patch is being tested in the neutron-tempest-plugin [3].

    [1]https://github.com/openstack/neutron/blob/de58c1b99523104a471420ef0468147f13c9e98d/neutron/db/l3_db.py#L902-L904
    [2]https://github.com/openstack/neutron/blob/de58c1b99523104a471420ef0468147f13c9e98d/neutron/db/db_base_plugin_v2.py#L715
    [3]https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/904710

    Closes-Bug: #2036423
    Change-Id: I4c7b399a3a052749abdb88fb50be628ee91b63a0

Changed in neutron:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (stable/2023.2)

Fix proposed to branch: stable/2023.2
Review: https://review.opendev.org/c/openstack/neutron/+/905665

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (stable/2023.1)

Fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/neutron/+/905666

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (stable/zed)

Fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/neutron/+/905667

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (stable/yoga)

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/neutron/+/905681

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (stable/2023.2)

Reviewed: https://review.opendev.org/c/openstack/neutron/+/905665
Committed: https://opendev.org/openstack/neutron/commit/debeab272abc1d69b416382b3e3da710feed3281
Submitter: "Zuul (22348)"
Branch: stable/2023.2

commit debeab272abc1d69b416382b3e3da710feed3281
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Sun Jan 14 10:20:12 2024 +0000

    Forbid the subnet gateway IP deletion if a router interface is attached

    When a router interface is created, the corresponding subnet gateway IP
    is tested first [1]. If the subnet has no gateway IP, the router
    interface cannot be created. This IP will be assigned to this port.

    The Neutron API also prevents from modifying the subnet gateway IP
    if assigned to a router interface [2]. However the API is not
    preventing the subnet gateway IP deletion. This patch is adding
    this check.

    This patch is being tested in the neutron-tempest-plugin [3].

    [1]https://github.com/openstack/neutron/blob/de58c1b99523104a471420ef0468147f13c9e98d/neutron/db/l3_db.py#L902-L904
    [2]https://github.com/openstack/neutron/blob/de58c1b99523104a471420ef0468147f13c9e98d/neutron/db/db_base_plugin_v2.py#L715
    [3]https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/904710

    Closes-Bug: #2036423
    Change-Id: I4c7b399a3a052749abdb88fb50be628ee91b63a0
    (cherry picked from commit f9e40971e94e4fd239fcf7537b0f1200fbd4ee0f)

tags: added: in-stable-zed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/neutron/+/905667
Committed: https://opendev.org/openstack/neutron/commit/905e2e430a0d645058e8db15f26d800db27b724d
Submitter: "Zuul (22348)"
Branch: stable/zed

commit 905e2e430a0d645058e8db15f26d800db27b724d
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Sun Jan 14 10:20:12 2024 +0000

    Forbid the subnet gateway IP deletion if a router interface is attached

    When a router interface is created, the corresponding subnet gateway IP
    is tested first [1]. If the subnet has no gateway IP, the router
    interface cannot be created. This IP will be assigned to this port.

    The Neutron API also prevents from modifying the subnet gateway IP
    if assigned to a router interface [2]. However the API is not
    preventing the subnet gateway IP deletion. This patch is adding
    this check.

    This patch is being tested in the neutron-tempest-plugin [3].

    [1]https://github.com/openstack/neutron/blob/de58c1b99523104a471420ef0468147f13c9e98d/neutron/db/l3_db.py#L902-L904
    [2]https://github.com/openstack/neutron/blob/de58c1b99523104a471420ef0468147f13c9e98d/neutron/db/db_base_plugin_v2.py#L715
    [3]https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/904710

    Closes-Bug: #2036423
    Change-Id: I4c7b399a3a052749abdb88fb50be628ee91b63a0
    (cherry picked from commit f9e40971e94e4fd239fcf7537b0f1200fbd4ee0f)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (stable/2023.1)

Reviewed: https://review.opendev.org/c/openstack/neutron/+/905666
Committed: https://opendev.org/openstack/neutron/commit/a72b44a3a9eb61d7c893c64418c7aeb81249d78d
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit a72b44a3a9eb61d7c893c64418c7aeb81249d78d
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Sun Jan 14 10:20:12 2024 +0000

    Forbid the subnet gateway IP deletion if a router interface is attached

    When a router interface is created, the corresponding subnet gateway IP
    is tested first [1]. If the subnet has no gateway IP, the router
    interface cannot be created. This IP will be assigned to this port.

    The Neutron API also prevents from modifying the subnet gateway IP
    if assigned to a router interface [2]. However the API is not
    preventing the subnet gateway IP deletion. This patch is adding
    this check.

    This patch is being tested in the neutron-tempest-plugin [3].

    [1]https://github.com/openstack/neutron/blob/de58c1b99523104a471420ef0468147f13c9e98d/neutron/db/l3_db.py#L902-L904
    [2]https://github.com/openstack/neutron/blob/de58c1b99523104a471420ef0468147f13c9e98d/neutron/db/db_base_plugin_v2.py#L715
    [3]https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/904710

    Closes-Bug: #2036423
    Change-Id: I4c7b399a3a052749abdb88fb50be628ee91b63a0
    (cherry picked from commit f9e40971e94e4fd239fcf7537b0f1200fbd4ee0f)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on neutron (stable/yoga)

Change abandoned by "Rodolfo Alonso <email address hidden>" on branch: stable/yoga
Review: https://review.opendev.org/c/openstack/neutron/+/905681
Reason: Transition Yoga to Unmaintained: https://review.opendev.org/c/openstack/releases/+/906564

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to neutron-tempest-plugin (master)

Reviewed: https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/904710
Committed: https://opendev.org/openstack/neutron-tempest-plugin/commit/780d81ec00abada9afb01546cb0c976562a502a6
Submitter: "Zuul (22348)"
Branch: master

commit 780d81ec00abada9afb01546cb0c976562a502a6
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Sun Jan 14 10:02:13 2024 +0000

    Add router check, subnet attached gateway IP update or deletion

    Added a new test to ``RoutersTest``. If a subnet has a router
    interface, the subnet gateway IP cannot be modified or deleted.
    Both operations will raise a ``GatewayIpInUse`` exception.

    Depends-On: https://review.opendev.org/c/openstack/neutron/+/904713

    Related-Bug: #2036423
    Change-Id: I46a39c53017589e23e03ceabc45c2f144ca2f3bb

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/neutron 24.0.0.0rc1

This issue was fixed in the openstack/neutron 24.0.0.0rc1 release candidate.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/neutron 21.2.1

This issue was fixed in the openstack/neutron 21.2.1 release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.