[Yahoo-eng-team] [Bug 1657260] Re: Established connection don't stops when rule is removed

[OpenStack Infra]

Reviewed:  https://review.openstack.org/441353
Committed: 
https://git.openstack.org/cgit/openstack/neutron/commit/?id=c76164c058a0cfeee3eb46b523a9ad012f93dd51
Submitter: Jenkins
Branch:master

commit c76164c058a0cfeee3eb46b523a9ad012f93dd51
Author: Kevin Benton 
Date:   Fri Mar 3 11:18:28 2017 -0800

Move conntrack zones to IPTablesFirewall

The regular IPTablesFirewall needs zones to support safely
clearly conntrack entries.

In order to support the single bridge use case, the conntrack
manager had to be refactored slightly to allow zones to be
either unique to ports or unique to networks.

Since all ports in a network share a bridge in the IPTablesDriver
use case, a zone per port cannot be used since there is no way
to distinguish which zone traffic should be checked against when
traffic enters the bridge from outside the system.

A zone per network is adequate for the single bridge per network
solution since it implicitly does not suffer from the double-bridge
cross in a single network that led to per port usage in OVS.[1]

This had to adjust the functional firewall tests to use the correct
bridge name now that it's relevant in the non hybrid IPTables case.

1. Ibe9e49653b2a280ea72cb95c2da64cd94c7739da

Closes-Bug: #1668958
Closes-Bug: #1657260
Change-Id: Ie88237d3fe4807b712a7ec61eb932748c38952cc


** Changed in: neutron
   Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1657260

Title:
  Established connection don't stops when rule is removed

Status in neutron:
  Fix Released

Bug description:
  If iptables driver is used for Security groups (e.g. in Linuxbridge L2 agent) 
there is an issue with update rules. When You have rule which allows some kind 
of traffic (like ssh for example from some src IP address) and You have 
established, active connection which match this rule, connection will be still 
active even if rule will be removed/changed.
  It is because in iptables in chain for each SG as first there is rule to 
accept packets with "state RELATED,ESTABLISHED".
  I'm not sure if it is in fact bug or maybe it's just design decision to have 
better performance of iptables.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1657260/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1657260] Re: Established connection don't stops when rule is removed

[Jakub Libosvar]

The issue still exists and currently is failing fullstack tests.

I was able to reproduce the issue locally. After SG rule was removed, I
still see

tcp  6 431985 ESTABLISHED src=20.0.0.10 dst=20.0.0.9 sport=42308
dport=3355 src=20.0.0.9 dst=20.0.0.10 sport=3355 dport=42308 [ASSURED]
mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1

in conntrack and increasing counters in iptables for following rule:

Chain neutron-linuxbri-i886980ff-0 (1 references)
 pkts bytes target prot opt in out source   destination
   25  1460 RETURN all  --  *  *   0.0.0.0/00.0.0.0/0   
 state RELATED,ESTABLISHED /* Direct packets associated with a known 
session to the RETURN chain. */

linuxbridge-agent logs say:

2017-03-15 11:50:06.179 11755 DEBUG neutron.agent.linux.ip_conntrack
[req-b776ebc8-72f4-4385-98d4efa38ecb63a9 - - - - -] No zone for device
tap886980ff-0c. Will not try to clear conntrack state. Zone map: {}
_get_conntrack_cmds
/opt/stack/neutron/neutron/agent/linux/ip_conntrack.py:83

** Changed in: neutron
   Status: Fix Released => Confirmed

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1657260

Title:
  Established connection don't stops when rule is removed

Status in neutron:
  Confirmed

Bug description:
  If iptables driver is used for Security groups (e.g. in Linuxbridge L2 agent) 
there is an issue with update rules. When You have rule which allows some kind 
of traffic (like ssh for example from some src IP address) and You have 
established, active connection which match this rule, connection will be still 
active even if rule will be removed/changed.
  It is because in iptables in chain for each SG as first there is rule to 
accept packets with "state RELATED,ESTABLISHED".
  I'm not sure if it is in fact bug or maybe it's just design decision to have 
better performance of iptables.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1657260/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1657260] Re: Established connection don't stops when rule is removed

[OpenStack Infra]

Reviewed:  https://review.openstack.org/426429
Committed: 
https://git.openstack.org/cgit/openstack/neutron/commit/?id=10bfa690885f06316ccec1fee39e51ca64058443
Submitter: Jenkins
Branch:master

commit 10bfa690885f06316ccec1fee39e51ca64058443
Author: Sławek Kapłoński 
Date:   Fri Jan 27 23:19:25 2017 +

Clear conntrack entries without zones if CT zones are not used

CT zones are used only in OVSHybridIptablesFirewallDriver.
Such zones are not set in IptablesFirewallDriver class but
even if iptables driver was is not using CT zones, it was
used by conntrack manager class during delete of conntrack
entry.
This cause issue that for Linuxbridge agent established and
active connection stayed active even after security group
rule was deleted.
This patch changes conntrack manager class that it will not
use CT zone (-w option) if zone for port was not assigned
earlier.

Change-Id: Ib9c8d0a09d0858ff6f36db406c6b2a9191f304d1
Closes-bug: 1657260


** Changed in: neutron
   Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1657260

Title:
  Established connection don't stops when rule is removed

Status in neutron:
  Fix Released

Bug description:
  If iptables driver is used for Security groups (e.g. in Linuxbridge L2 agent) 
there is an issue with update rules. When You have rule which allows some kind 
of traffic (like ssh for example from some src IP address) and You have 
established, active connection which match this rule, connection will be still 
active even if rule will be removed/changed.
  It is because in iptables in chain for each SG as first there is rule to 
accept packets with "state RELATED,ESTABLISHED".
  I'm not sure if it is in fact bug or maybe it's just design decision to have 
better performance of iptables.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1657260/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp