Neutron + security group + OVS is broken

[Nachi Ueno]

Background of this issue:
ML2 + OVSDriver + IptablesBasedFirewall combination is a default plugin setting in the Neutron.
In this case, we need a special handing in VIF. Because OpenVSwitch don't support iptables, we are
using linuxbride + openvswitch bridge. We are calling this as hybrid driver.

On the other discussion, we generalized the Nova side VIF plugging to the Libvirt GenericVIFDriver.
The idea is let neturon tell the VIF plugging configration details to the GenericDriver, and GerericDriver
takes care of it.

Unfortunatly, HybridDriver is removed before GenericDriver is ready for security group.
This makes ML2 + OVSDriver + IptablesBasedFirewall combination unfunctional.
We were working on realfix, but we can't make it until Icehouse release due to design discussions [1].
# Even if neturon side patch isn't merged yet.

So we are proposing a workaround fix to Nova side.
In this fix, we are adding special version of the GenericVIFDriver which can work with the combination.
There is two point on this new Driver.
(1) It prevent set conf.filtername. Because we should use NoopFirewallDriver, we need conf.filtername should be None
when we use it.
(2) use plug_ovs_hybrid and unplug_ovs_hybrid by enforcing get_require_firewall as True.

Here is patchs with UT.

Workaournd fix:
Nova
https://review.openstack.org/#/c/82904/

Devstack patch for ML2 (Tested with 82904)
https://review.openstack.org/#/c/82937/

We have tested the patch 82904 with following test, and this works.

- Launch VM
- Assign floating ip
- make sure ping to the floating ip is failing from GW
- modify security group rule to allow ping from anywhere
- make sure ping is working

[1] Real fix: (defered to Juno)

Improve vif attributes related with firewalling
https://review.openstack.org/#/c/21946/

Support binding:vif_security parameter in neutron
https://review.openstack.org/#/c/44596/

[Russell Bryant (russellb)]

nova workaround for icehouse in progress: https://review.openstack.org/#/c/82904/1

[Nachi Ueno (nati-ueno)]

I added some notes and status update on
https://etherpad.openstack.org/p/neturon_security_group_fix_workaround_icehouse

[Thierry Carrez (ttx)]

@Sandeep: does this really constitute a vulnerabililty ? Sounds like a bug to me (with the limited information I have on the bug)

[Salvatore Orlando (salvatore-orlando)]

it's a bug, which might result in a deployer thinking the environment is secured where it actually isn't

[Thierry Carrez (ttx)]

OK adding OSSA task to judge the need for advisory

[Salvatore Orlando (salvatore-orlando)]

I have played a bit with this problem.
find three attachment, for two alternative to the new drivers.
I'm attaching here for not polluting gerrit (so just disregard if you think the proposed approach with the inherited vif driver is ok).

hack.patch basically just does always hybrid vif plugging, and does not set a nw filter name when using neutron.
It's similar to the driver only not configurable.
It does not break the NSX plugin. And I think similarly for other plugins which do not require hybrid plugging.
I'm still not super happy about the extra hop we'd introduce for those plugins.
This approach is similar to the one currently on gerrit, but does not introduce the need for a new driver value in nova.conf (so no devstack patch). However, it's not configurable for plugins which do not need hybrid.

anyway the patch is just +5,-5

then vif_type_nova.patch and vif_type_neutron.patch basically promote "hybrid" as a first class citizen vif type for neutron, while preserving current plugging mode for nova network.
The change is mainly that nova will nova use neutr_on's instructions regarding vif plugging. So if neutron specifies it needs a hybrid vif, it will do the hybrid thing.

These are two patches, relatively small, but still larger than the workaround:
Nova: +18,-4
Neutron: +8,-7

I think the benefit of this approach is that it's somethign we can keep building on rather than a workaround creating technical debt. The neutron patch applies to:
- Cisco (mostly)
- ML2 with OVS mech
- NEC
- OVS
- RYU

there might be other plugins still affected.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/83190
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=304df046eaaad6d64ee16898b1eaa76918e98878
Submitter: Jenkins
Branch: master

commit 304df046eaaad6d64ee16898b1eaa76918e98878
Author: Robert Kukura <email address hidden>
Date: Wed Mar 26 15:25:55 2014 -0400

    Use binding:vif_details to control firewall

    Neutron can include 'ovs_hybrid_plug' and 'port_filter' boolean keys in
    the binding:vif_details port attribute. 'port_filter' indicates whether
    or not neutron is handling port filtering for nova to determine if it needs
    to filter for that port. 'ovs_hybrid_plug' can be set to True to indicate
    that the neutron plugin still requires the bridge plugging strategy to attach
    firewall rules.

    Corresponding neutron patch:
    Review - https://review.openstack.org/#/c/83280/
    Commit - 8c42ba115b58cc2c7486be9fee89e1facedb5f76

    Closes-Bug: 1297469
    Change-Id: I3bbcfc67036ab7389c82720add0bc0fc627bfee0