Bug 1347428

Summary: neutron-meter-agent - makes traffic between internal networks NATed
Product: Red Hat OpenStack Reporter: Jeremy <jmelvin>
Component: openstack-neutronAssignee: Assaf Muller <amuller>
Status: CLOSED ERRATA QA Contact: Toni Freger <tfreger>
Severity: high Docs Contact:
Priority: high    
Version: 7.0 (Kilo)CC: alsilva, amuller, chrisw, dmaley, mamorim, marcsilv, nyechiel, srevivo, vkommadi
Target Milestone: asyncKeywords: Triaged, ZStream
Target Release: 7.0 (Kilo)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openstack-neutron-2015.1.2-16.el7ost Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-07-20 23:54:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jeremy 2016-06-16 20:17:53 UTC 
Description of problem:Customer is requesting backport of the following upstream bug to RHOSP7.0.

https://bugs.launchpad.net/neutron/+bug/1544508

If neutron-meter-agent is installed and enabled, and a meter-label is created, all traffic between internal networks becomes NATed, which is unexpected and potentially causes firewall/routing issues. This happens because meter-agent does not define stateless flag during iptables initialization which later during _modify_rules in agent/linux/iptables_manager.py results in moving the following rules:

before:
-A POSTROUTING -j neutron-l3-agent-POSTROUTING
-A POSTROUTING -j neutron-postrouting-bottom

after:
-A POSTROUTING -j neutron-postrouting-bottom
-A POSTROUTING -j neutron-l3-agent-POSTROUTING


Version-Release number of selected component (if applicable):
Customer is currently on :
neutron]# rpm -qa | grep neutron
python-neutron-lbaas-2015.1.2-2.el7ost.noarch
openstack-neutron-lbaas-2015.1.2-2.el7ost.noarch
openstack-neutron-metering-agent-2015.1.2-14.el7ost.noarch
python-neutron-2015.1.2-14.el7ost.noarch
openstack-neutron-2015.1.2-14.el7ost.noarch
openstack-neutron-openvswitch-2015.1.2-14.el7ost.noarch
openstack-neutron-common-2015.1.2-14.el7ost.noarch
openstack-neutron-ml2-2015.1.2-14.el7ost.noarch
python-neutronclient-2.4.0-2.el7ost.noarch


Additional info:

OpenStack Infra (hudson-openstack) wrote on 2016-05-26: Fix merged to neutron (master)	

Reviewed: https://review.openstack.org/314250
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=3bf73801df169de40d365e6240e045266392ca63
Submitter: Jenkins
Branch: master
Comment 7 anil venkata 2016-06-27 13:03:28 UTC 
@Jeremy Melvin

Can you please deliver the hotfix to the customer?

Thanks
Anil
Comment 8 Jeremy 2016-06-27 15:15:06 UTC 
I have attached the hotfix packages to the customer's case.
Comment 10 Toni Freger 2016-06-30 12:24:55 UTC 
Code tested on latest version: openstack-neutron-2015.1.4-1.el7ost.noarch
Comment 13 errata-xmlrpc 2016-07-20 23:54:33 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2016:1474