IGMP queries from address 0.0.0.0 being blocked

[Caio Bruchert]

Brief Description
-----------------
IGMP queries from address 0.0.0.0 on the cluster-host and mgmt networks are being blocked and it causes the heartbeat traffic to stop and the controller-0 to reboot.
IGMP queries with source address 0.0.0.0 are sent when the switch between the controllers has IGMP snooping enabled on a VLAN without an IP address configured.

Severity
--------
Critical

Steps to Reproduce
------------------
Configure the switch with IGMP snooping for the mgmt or cluster-host VLAN.
The VLAN must have no IP address configured.

Expected Behavior
------------------
IGMP queries with source address 0.0.0.0 from the switch should be allowed and IGMP reports should be seen.

Actual Behavior
----------------
IGMP queries with source address 0.0.0.0 from the switch are block and IGMP reports are not seen.

Reproducibility
---------------
Reproducible

System Configuration
--------------------
AIO-DX

Branch/Pull Time/Commit
-----------------------
master

Last Pass
---------
Before the firewall was implemented

Timestamp/Logs
--------------

Test Activity
-------------
Regression Testing

Workaround
Edit the firewall rules for mgmt and cluster-host networks to allow IGMP with source address 0.0.0.0/32 using:
kubectl edit globalnetworkpolicies.crd.projectcalico.org controller-mgmt-if-gnp
kubectl edit globalnetworkpolicies.crd.projectcalico.org controller-cluster-host-if-gnp

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/config/+/898856

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/config/+/898856
Committed: https://opendev.org/starlingx/config/commit/731a5a4d7bc918682e8d8658f2c6ed00d191cb77
Submitter: "Zuul (22348)"
Branch: master

commit 731a5a4d7bc918682e8d8658f2c6ed00d191cb77
Author: Caio Bruchert <email address hidden>
Date: Thu Oct 19 16:14:55 2023 -0300

    Firewall: allow IGMP queries from 0.0.0.0

    IGMP queries from address 0.0.0.0 on the cluster-host and mgmt networks
    are being blocked and it causes the heartbeat traffic to stop and the
    controller-0 to reboot.
    IGMP queries with source address 0.0.0.0 are sent when the switch
    between the controllers has IGMP snooping enabled on a VLAN without an
    IP address configured.

    Test Plan:
        PASS: check if IGMP rules for all networks are correct
        PASS: check if the IGMP queries from 0.0.0.0 are allowed and IGMP
              reports are replied
        PASS: check if heartbeat messages are exchanged between the
              controllers

    Closes-Bug: 2039881

    Signed-off-by: Caio Bruchert <email address hidden>
    Change-Id: Id930edf692dbd59fecef4647904abfc58e881669