Public bug reported:

2020-11-25 11:07:32.606 127 DEBUG oslo_concurrency.lockutils 
[req-ab14782d-80b1-43f6-8d1b-2874531aca5e - 9d40b483f885496896d81c487f420438 - 
- -] Releasing semaphore 
"iptables-qrouter-9e18395d-961d-46b3-a0e9-4c6a94c32baf" lock 
/var/lib/kolla/venv/lib/python2.7/site-packages/oslo_concurrency/lockutils.py:228
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
 [req-ab14782d-80b1-43f6-8d1b-2874531aca5e - 9d40b483f885496896d81c487f420438 - 
- -] Failed to update firewall: daedc38a-04ee-4818-b7a6-3d8311d7fc30: KeyError: 
'unknown'
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
 Traceback (most recent call last):
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
   File 
"/var/lib/kolla/venv/lib/python2.7/site-packages/neutron_fwaas/services/firewall/service_drivers/agents/drivers/linux/iptables_fwaas_v2.py",
 line 144, in update_firewall_group
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
     apply_list, self.pre_firewall, firewall)
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
   File 
"/var/lib/kolla/venv/lib/python2.7/site-packages/neutron_fwaas/services/firewall/service_drivers/agents/drivers/linux/iptables_fwaas_v2.py",
 line 327, in _remove_conntrack_updated_firewall
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
     ipt_mgr.namespace)
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
   File 
"/var/lib/kolla/venv/lib/python2.7/site-packages/neutron_fwaas/services/firewall/service_drivers/agents/drivers/linux/netlink_conntrack.py",
 line 41, in delete_entries
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
     entries = nl_lib.list_entries(namespace)
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
   File 
"/var/lib/kolla/venv/lib/python2.7/site-packages/oslo_privsep/priv_context.py", 
line 207, in _wrap
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
     return self.channel.remote_call(name, args, kwargs)
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
   File 
"/var/lib/kolla/venv/lib/python2.7/site-packages/oslo_privsep/daemon.py", line 
202, in remote_call
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
     raise exc_type(*result[2])
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
 KeyError: 'unknown'
2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2

This error appears when  configured the neutron-fwaas v2 with netlink_conntrack 
driver in fwaas_agent.ini
vim /etc/kolla/neutron-l3-agent/fwaas_driver.ini 
   [fwaas]
   enabled = True
   agent_version = v2
   driver = iptables_v2
   conntrack_driver = netlink_conntrack

And the conntrack list has 'unknown' rules, example below:
unknown  2 597 src=169.254.192.2 dst=224.0.0.22 [UNREPLIED] src=224.0.0.22 
dst=169.254.192.2 mark=0 use=1
unknown  112 598 src=169.254.192.2 dst=224.0.0.18 [UNREPLIED] src=224.0.0.18 
dst=169.254.192.2 mark=0 use=1

This may interrupt conntrack refresh when firewall rules update.

** Affects: neutron
     Importance: Undecided
     Assignee: Zhang Jian (jasonzhangj)
         Status: New

** Changed in: neutron
     Assignee: (unassigned) => Zhang Jian (q5536487)

** Changed in: neutron
     Assignee: Zhang Jian (jasonzhangj) => (unassigned)

** Changed in: neutron
     Assignee: (unassigned) => Zhang Jian (jasonzhangj)

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1905552

Title:
  neutron-fwaas netlink conntrack driver would catch error while
  conntrack rules protocol is 'unknown'

Status in neutron:
  New

Bug description:
  2020-11-25 11:07:32.606 127 DEBUG oslo_concurrency.lockutils 
[req-ab14782d-80b1-43f6-8d1b-2874531aca5e - 9d40b483f885496896d81c487f420438 - 
- -] Releasing semaphore 
"iptables-qrouter-9e18395d-961d-46b3-a0e9-4c6a94c32baf" lock 
/var/lib/kolla/venv/lib/python2.7/site-packages/oslo_concurrency/lockutils.py:228
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
 [req-ab14782d-80b1-43f6-8d1b-2874531aca5e - 9d40b483f885496896d81c487f420438 - 
- -] Failed to update firewall: daedc38a-04ee-4818-b7a6-3d8311d7fc30: KeyError: 
'unknown'
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
 Traceback (most recent call last):
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
   File 
"/var/lib/kolla/venv/lib/python2.7/site-packages/neutron_fwaas/services/firewall/service_drivers/agents/drivers/linux/iptables_fwaas_v2.py",
 line 144, in update_firewall_group
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
     apply_list, self.pre_firewall, firewall)
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
   File 
"/var/lib/kolla/venv/lib/python2.7/site-packages/neutron_fwaas/services/firewall/service_drivers/agents/drivers/linux/iptables_fwaas_v2.py",
 line 327, in _remove_conntrack_updated_firewall
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
     ipt_mgr.namespace)
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
   File 
"/var/lib/kolla/venv/lib/python2.7/site-packages/neutron_fwaas/services/firewall/service_drivers/agents/drivers/linux/netlink_conntrack.py",
 line 41, in delete_entries
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
     entries = nl_lib.list_entries(namespace)
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
   File 
"/var/lib/kolla/venv/lib/python2.7/site-packages/oslo_privsep/priv_context.py", 
line 207, in _wrap
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
     return self.channel.remote_call(name, args, kwargs)
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
   File 
"/var/lib/kolla/venv/lib/python2.7/site-packages/oslo_privsep/daemon.py", line 
202, in remote_call
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
     raise exc_type(*result[2])
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2
 KeyError: 'unknown'
  2020-11-25 11:07:32.609 127 ERROR 
neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2

  This error appears when  configured the neutron-fwaas v2 with 
netlink_conntrack driver in fwaas_agent.ini
  vim /etc/kolla/neutron-l3-agent/fwaas_driver.ini 
     [fwaas]
     enabled = True
     agent_version = v2
     driver = iptables_v2
     conntrack_driver = netlink_conntrack

  And the conntrack list has 'unknown' rules, example below:
  unknown  2 597 src=169.254.192.2 dst=224.0.0.22 [UNREPLIED] src=224.0.0.22 
dst=169.254.192.2 mark=0 use=1
  unknown  112 598 src=169.254.192.2 dst=224.0.0.18 [UNREPLIED] src=224.0.0.18 
dst=169.254.192.2 mark=0 use=1

  This may interrupt conntrack refresh when firewall rules update.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1905552/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to     : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

Reply via email to