File 0001-DVR-properly-track-SNAT-traffic.patch of Package openstack-neutron
From 5a25690da31f142bc551cde8b3bd8ba1119cf8d4 Mon Sep 17 00:00:00 2001
From: David Wahlstrom <david.wahlstrom@dreamhost.com>
Date: Tue, 6 Sep 2016 12:11:41 -0700
Subject: [PATCH] DVR: properly track SNAT traffic
When running DVR, it's possible for traffic to get confused and sent
through SNAT thanks to the way conntrack tracks "new" connections. This
patch sets "nf_connctrack_tcp_loose" inside the SNAT namespace to more
intelligently handle SNAT traffic (and ignore what should be FIP
traffic) - basically, don't track a connection where we didn't
see the initial SYN.
https://www.kernel.org/doc/Documentation/networking/nf_conntrack-sysctl.txt
Change-Id: Ia5b8bd3794d22808ee1718d429f0bbdbe61e94ec
Closes-Bug: 1620824
(cherry picked from commit 299d08ed3f3f170a129fb2096df73fd5af7e647d)
(cherry picked from commit 185116fd9df9b8d15b8de97c0ae89cb7be55639a)
---
neutron/agent/l3/dvr_snat_ns.py | 4 ++
.../tests/unit/agent/l3/test_dvr_snat_ns.py | 49 +++++++++++++++++++
2 files changed, 53 insertions(+)
create mode 100644 neutron/tests/unit/agent/l3/test_dvr_snat_ns.py
diff --git a/neutron/agent/l3/dvr_snat_ns.py b/neutron/agent/l3/dvr_snat_ns.py
index 9fe374363b..d769de7a99 100644
--- a/neutron/agent/l3/dvr_snat_ns.py
+++ b/neutron/agent/l3/dvr_snat_ns.py
@@ -34,6 +34,10 @@ class SnatNamespace(namespaces.Namespace):
# This might be an HA router namespaces and it should not have
# ip_nonlocal_bind enabled
ip_lib.set_ip_nonlocal_bind_for_namespace(self.name)
+ # Set nf_conntrack_tcp_loose to 0 to ensure mid-stream
+ # TCP conversations aren't taken over by SNAT
+ ip_lib.IPWrapper(namespace=self.name).netns.execute(
+ ['sysctl', '-w', 'net.netfilter.nf_conntrack_tcp_loose=0'])
@classmethod
def get_snat_ns_name(cls, router_id):
diff --git a/neutron/tests/unit/agent/l3/test_dvr_snat_ns.py b/neutron/tests/unit/agent/l3/test_dvr_snat_ns.py
new file mode 100644
index 0000000000..2185d5344b
--- /dev/null
+++ b/neutron/tests/unit/agent/l3/test_dvr_snat_ns.py
@@ -0,0 +1,49 @@
+# Copyright (c) 2016 OpenStack Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import mock
+from oslo_config import cfg
+from oslo_utils import uuidutils
+
+from neutron.agent.common import utils
+from neutron.agent.l3 import dvr_snat_ns
+from neutron.tests import base
+
+_uuid = uuidutils.generate_uuid
+
+
+class TestDvrSnatNs(base.BaseTestCase):
+ def setUp(self):
+ super(TestDvrSnatNs, self).setUp()
+ self.conf = mock.Mock()
+ self.conf.state_path = cfg.CONF.state_path
+ self.driver = mock.Mock()
+ self.driver.DEV_NAME_LEN = 14
+ self.router_id = _uuid()
+ self.snat_ns = dvr_snat_ns.SnatNamespace(self.router_id,
+ self.conf,
+ self.driver,
+ use_ipv6=False)
+
+ @mock.patch.object(utils, 'execute')
+ def test_create(self, execute):
+ self.snat_ns.create()
+
+ netns_cmd = ['ip', 'netns', 'exec', self.snat_ns.name]
+ loose_cmd = ['sysctl', '-w', 'net.netfilter.nf_conntrack_tcp_loose=0']
+ expected = [mock.call(netns_cmd + loose_cmd,
+ check_exit_code=True, extra_ok_codes=None,
+ log_fail_as_error=True, run_as_root=True)]
+
+ execute.assert_has_calls(expected)
--
2.19.1
