DeviceManager's fill_dhcp_udp_checksums assumes IPv6 available

[David Comay]

The following code in DeviceManager's fill_dhcp_udp_checksums assumes IPv6 is always enabled:

iptables_mgr = iptables_manager.IptablesManager(use_ipv6=True,
                                                namespace=namespace)

When iptables_mgr.apply() is later called, an attempt to add the UDP checksum rule for DHCP is done via iptables-save/iptables-restore and if IPv6 has been disabled on a hypervisor (eg, by setting `ipv6.disable=1` on the kernel command line) then an many-line error occurs in the DHCP agent logfile.

There should be a way of telling the agent that IPv6 is disabled and as such, it should ignore trying to set up the UDP checksum rule for IPv6. This can be easily achieved given that IptablesManager already has support for disabling it.

We've seen this on Rocky on Ubuntu Bionic but it appears the issue still exists on the master branch.

=================================
Ubuntu SRU details:

[Impact]

See above

[Test Plan]

Disable IPv6 on a hypervisor.
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=1
Deploy Openstack Ussuri or Victoria with one compute node, using the hypervisor which has IPv6 disabled as a neutron gateway.
Create a network which has a subnetwork with DHCP enabled. Eg:
openstack network create net1
openstack subnet create subnet1 --network net1 --subnet-range 192.0.2.0/24 --dhcp
Search the `/var/log/neutron/neutron-dhcp-agent.log` (with debug log enabled) and check if there are any `ip6tables-restore` commands. Eg:
sudo grep ip6tables-restore /var/log/neutron/neutron-dhcp-agent.log

[Where problems could occur]

Users which were relying on the setting to always be true could be affected.

[Lajos Katona (lajos-katona)]

Could you please check this proposal: https://review.opendev.org/c/openstack/neutron/+/778395
I added netutils.is_ipv6_enabled(), which should be used for all IptablesManager instance as I see

[David Comay (comay)]

Yes, looks like a good solution (glad to see `oslo.utils` has this function available already).

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 18.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/c/openstack/neutron/+/804496

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/victoria
Review: https://review.opendev.org/c/openstack/neutron/+/804499

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/804499
Committed: https://opendev.org/openstack/neutron/commit/6adfdd74f4ae4ca2426602c8041eab354975b3ac
Submitter: "Zuul (22348)"
Branch: stable/victoria

commit 6adfdd74f4ae4ca2426602c8041eab354975b3ac
Author: Alin-Gabriel Serdean <email address hidden>
Date: Fri Aug 13 11:43:02 2021 +0300

    Trivial: check if ipv6 is available for IptablesManager

    Conflicts:
            neutron/agent/ovn/metadata/agent.py

    To resolve conflict, rearrange alphabetically the imports from
    oslo_utils.

    Change-Id: I3caf131041a852671a556b064c641fe34f8f5ed0
    Closes-Bug: #1915480
    (cherry picked from commit 6cf71cbd6a71b4849470874379877c7ca2a8fc25)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/804496
Committed: https://opendev.org/openstack/neutron/commit/b6a6065f9f90f83f80e3a3a997bf382b38763b29
Submitter: "Zuul (22348)"
Branch: stable/ussuri

commit b6a6065f9f90f83f80e3a3a997bf382b38763b29
Author: Alin-Gabriel Serdean <email address hidden>
Date: Fri Aug 13 11:13:20 2021 +0300

    Trivial: check if ipv6 is available for IptablesManager

    Conflicts:
            neutron/agent/ovn/metadata/agent.py

    To resolve conflict, rearrange alphabetically the imports from
    oslo_utils.

    Change-Id: I3caf131041a852671a556b064c641fe34f8f5ed0
    Closes-Bug: #1915480
    (cherry picked from commit 6cf71cbd6a71b4849470874379877c7ca2a8fc25)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 16.4.1 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 17.2.1 release.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "neutron-focal-ussuri.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Edward Hope-Morley (hopem)]

ussuri 16.4.1 will be included in https://bugs.launchpad.net/cloud-archive/+bug/1943712 and victoria 17.2.1 in https://bugs.launchpad.net/cloud-archive/+bug/1943711

[Brian Murray (brian-murray)]

16.4.1 is included in focal-updates and hirsute has 18.0 so I'm setting this to Fix Released.

 $ rmadison neutron
 neutron | 1:2014.1-0ubuntu1 | trusty | source
 neutron | 1:2014.1.3-0ubuntu1.1 | trusty-security | source
 neutron | 1:2014.1.5-0ubuntu8 | trusty-updates | source
 neutron | 2:8.0.0-0ubuntu1 | xenial | source
 neutron | 2:8.4.0-0ubuntu7.4 | xenial-security | source
 neutron | 2:8.4.0-0ubuntu7.5 | xenial-updates | source
 neutron | 2:12.0.1-0ubuntu1 | bionic | source
 neutron | 2:12.1.1-0ubuntu8 | bionic-updates | source
 neutron | 2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu2 | focal | source
 neutron | 2:16.4.1-0ubuntu2 | focal-updates | source
 neutron | 2:18.0.0-0ubuntu2 | hirsute | source
 neutron | 2:18.1.1-0ubuntu2 | hirsute-updates | source
 neutron | 2:19.0.0-0ubuntu1 | impish | source
 neutron | 2:19.0.0-0ubuntu1 | jammy | source