Bug 1393603

Summary:	Security groups iptables can block legitimate traffic as INVALID
Product:	Red Hat OpenStack	Reporter:	James Biao <jbiao>
Component:	openstack-neutron	Assignee:	Bernard Cafarelli <bcafarel>
Status:	CLOSED WONTFIX	QA Contact:	Toni Freger <tfreger>
Severity:	medium	Docs Contact:
Priority:	low
Version:	6.0 (Juno)	CC:	amuller, bcafarel, chrisw, jbiao, nyechiel, oblaut, rcernin, srevivo
Target Milestone:	async	Keywords:	Triaged, ZStream
Target Release:	6.0 (Juno)	Flags:	bcafarel: needinfo? (jbiao)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-02-22 20:35:43 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description James Biao 2016-11-10 00:11:49 UTC

Description of problem:

Request to backport upstream fix to Juno
https://bugs.launchpad.net/neutron/+bug/1460741

SCTP association can't be etablished because security groups set the following rule :
DROP all -- any any anywhere anywhere state INVALID 

When we delete this rule the association is etablished.


Version-Release number of selected component (if applicable):

use rhel-osp-installer 0.5.7-3 on a  Red Hat Enterprise Linux 7.1 virtual machine in order to deploy Openstack controller and compute on UCSB-B200-M4 blades.

Neutron's rpm used on our controllers are :
python-neutronclient-2.3.9-1.el7ost.noarch
openstack-neutron-common-2014.2.3-33.el7ost.noarch
openstack-neutron-openvswitch-2014.2.3-33.el7ost.noarch
openstack-neutron-ml2-2014.2.3-33.el7ost.noarch
openstack-neutron-cisco-2014.2.3-33.el7ost.noarch
openstack-neutron-2014.2.3-33.el7ost.noarch
python-neutron-2014.2.3-33.el7ost.noarch

Neutron's rpm used on our compute are :
openstack-neutron-2014.2.3-33.el7ost.noarch
openstack-neutron-openvswitch-2014.2.3-33.el7ost.noarch
python-neutronclient-2.3.9-1.el7ost.noarch
openstack-neutron-common-2014.2.3-33.el7ost.noarch
python-neutron-2014.2.3-33.el7ost.noarch


Additional info:
If we delete the DROP rules, the behavior occur at every security rules modification.

Comment 3 Bernard Cafarelli 2017-01-17 13:27:16 UTC

Can you confirm the versions? The backport already is in OSP 6, bug #1268413
The version that first included the fix is openstack-neutron-2014.2.3-23.el7ost so 2014.2.3-33.el7ost should work (and still has the patch)

Comment 6 Scott Lewis 2018-02-22 20:35:43 UTC

OSP6 has been retired, and will not receive further updates. See https://access.redhat.com/support/policy/updates/openstack/platform/ for details.