vrouter segfaults when floating IPs is allocated to service instance

[Francois Eleouet]

This issue affects 1.2 as well as current trunk:

Create an in-network service instance, and associate it with a policy attached to 2 networks.
Attach a floating IP to an interface of the service instance

As soon as trafic coming from the instance hits the vrouter, it will soft-reset.
Here is the backtrace:

#0 DBEntryBase::get_table (this=this@entry=0x0) at controller/src/db/db_entry.cc:94
#1 0x0000000000a0c792 in RouteToOutInfo (rt=0x0, pkt=pkt@entry=0x1403790, info=info@entry=0x7fffee4f7980, in=in@entry=0x7fffee4f7900, out=out@entry=0x7fffee4f7940) at controller/src/vnsw/agent/pkt/pkt_flow_info.cc:255
#2 0x0000000000a0ef8e in PktFlowInfo::FloatingIpSNat (this=this@entry=0x7fffee4f7980, pkt=pkt@entry=0x1403790, in=in@entry=0x7fffee4f7900, out=out@entry=0x7fffee4f7940) at controller/src/vnsw/agent/pkt/pkt_flow_info.cc:730
#3 0x0000000000a0f5ae in PktFlowInfo::IngressProcess (this=this@entry=0x7fffee4f7980, pkt=pkt@entry=0x1403790, in=in@entry=0x7fffee4f7900, out=out@entry=0x7fffee4f7940) at controller/src/vnsw/agent/pkt/pkt_flow_info.cc:880
#4 0x0000000000a0f717 in PktFlowInfo::Process (this=this@entry=0x7fffee4f7980, pkt=0x1403790, in=in@entry=0x7fffee4f7900, out=out@entry=0x7fffee4f7940) at controller/src/vnsw/agent/pkt/pkt_flow_info.cc:996
#5 0x0000000000a0bf12 in FlowHandler::Run (this=0x7fffe0116760) at controller/src/vnsw/agent/pkt/flow_handler.cc:54
#6 0x00000000009f2fa6 in Proto::ProcessProto (this=<optimized out>, msg_info=...) at controller/src/vnsw/agent/pkt/proto.cc:44
#7 0x00000000009f39bc in operator() (a1=..., p=<optimized out>, this=<optimized out>) at /usr/include/boost/bind/mem_fn_template.hpp:165
#8 operator()<bool, boost::_mfi::mf1<bool, Proto, boost::shared_ptr<PktInfo> >, boost::_bi::list1<boost::shared_ptr<PktInfo>&> > (a=<synthetic pointer>, f=..., this=<optimized out>) at /usr/include/boost/bind/bind.hpp:303
#9 operator()<boost::shared_ptr<PktInfo> > (a1=..., this=<optimized out>) at /usr/include/boost/bind/bind_template.hpp:32
#10 boost::detail::function::function_obj_invoker1<boost::_bi::bind_t<bool, boost::_mfi::mf1<bool, Proto, boost::shared_ptr<PktInfo> >, boost::_bi::list2<boost::_bi::value<Proto*>, boost::arg<1> > >, bool, boost::shared_ptr<PktInfo> >::invoke (function_obj_ptr=...,
    a0=...) at /usr/include/boost/function/function_template.hpp:132
#11 0x00000000009f4e0f in operator() (a0=..., this=0x7fffee4f7b90) at /usr/include/boost/function/function_template.hpp:767
#12 QueueTaskRunner<boost::shared_ptr<PktInfo>, WorkQueue<boost::shared_ptr<PktInfo> > >::RunQueue (this=0x1401780) at controller/src/base/queue_task.h:53
#13 0x0000000000e6a3e0 in TaskImpl::execute (this=0x7fffeeaf3a40) at controller/src/base/task.cc:224
#14 0x00007ffff647bb3a in ?? () from /usr/lib/libtbb.so.2
#15 0x00007ffff6477816 in ?? () from /usr/lib/libtbb.so.2
#16 0x00007ffff6476f4b in ?? () from /usr/lib/libtbb.so.2
#17 0x00007ffff64730ff in ?? () from /usr/lib/libtbb.so.2
#18 0x00007ffff64732f9 in ?? () from /usr/lib/libtbb.so.2
#19 0x00007ffff6697182 in start_thread (arg=0x7fffee4f8700) at pthread_create.c:312
#20 0x00007ffff596ffbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

[Naveen N (naveenn)]

One option can be to also add a rule indicating floating ip to any to do routing in native vrf.

Sachin

========================================================================
Hi Sachin,
 In case of in-network service interface, interface has VRF assign acl entries present in it.
Rules are as below
  1> Self-IP to any —Do route lookup in native VRF
  2> Rest all — Do route lookup in internal VRF.

If this interface also has floating IP, then in agent we were applying this ACL after floating-ip
translation and eventually doing route lookup in internal VRF where destination route would
not be present.

Can this ACL be more precise specifying source VN and destination VN??
Or Should agent not apply interface ACL entries while doing floating IP translation??

Regards
Naveen N

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/6383
Committed: http://github.org/Juniper/contrail-controller/commit/ce5266f32768729ffaaf14a76688019856db9657
Submitter: Zuul
Branch: R2.1

commit ce5266f32768729ffaaf14a76688019856db9657
Author: Naveen N <email address hidden>
Date: Tue Jan 20 01:59:13 2015 -0800

* After vrf translation if ingress route or egress route is NULL,
then mark the flow as short flow. Added test case for same
Partial-Bug:#1394259

Change-Id: I4924dd37020d50af50fd044d29da4516934bfc53

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/6384
Committed: http://github.org/Juniper/contrail-controller/commit/bd5251b894ff0b14a4d5390ccd69362744a76412
Submitter: Zuul
Branch: master

commit bd5251b894ff0b14a4d5390ccd69362744a76412
Author: Naveen N <email address hidden>
Date: Tue Jan 20 02:36:51 2015 -0800

* After vrf translation if ingress route or egress route is NULL,
then mark the flow as short flow. Added test case for same
Partial-Bug:#1394259

Change-Id: I964bd69fe71ab804e74cbcb919ad47f8d4433fda

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/6784
Committed: http://github.org/Juniper/contrail-controller/commit/9f440491bb281a0be726d068e455fbf1d045cce2
Submitter: Zuul
Branch: master

commit 9f440491bb281a0be726d068e455fbf1d045cce2
Author: Sachin Bansal <email address hidden>
Date: Thu Jan 29 10:59:30 2015 -0800

Add more specific rules for VRF assign table.

For service instance interfaces, we use VRF assign table to assign transit
traffic to service RI. Traffic originating in the service instance is supposed
to be assigned to native RI. This was done by adding another rule based on SIP.
However, if floating ip is assigned to service instance, the traffic with FIP
will not match the SIP rule and will match the rule for transit traffic. Now we
add source and destination VN to the rule for transit traffic so that other
traffic will not match this rule.

Change-Id: I21d0fcc3abd66e7a7c64d015db4142bda9e64f08
Closes-Bug: 1394259

[Sachin Bansal (sbansal)]

Earlier fix was reverted. New fix is being worked on.

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/7530
Committed: http://github.org/Juniper/contrail-controller/commit/39562e85682d487fc19f15bf92ccca017b8402e5
Submitter: Zuul
Branch: master

commit 39562e85682d487fc19f15bf92ccca017b8402e5
Author: Sachin Bansal <email address hidden>
Date: Tue Feb 17 14:54:23 2015 -0800

Add vrf assign rules for floating ip on service interfaces

When floating ip is added to a service interface, traffic with that ip as source
should be assigned to native vrf instead of service vrf. Added logic for the
same.
Also added logic to read ip objects again and again. Instead, cache the ip
address and listen to messages about change in ip objets.

Change-Id: Icad4bdf270af10c07dd0063ae4e9810bbecc032b
Closes-Bug: 1394259