Bug 1823755

Created attachment 1678673 [details]
NBDB with reproducer

Description of problem:

When calling a service from VM that has no ingress ACLs configured and when the called service is unreachable (not listening on given port), the ICMP unrecheable or TCP reset packets are not send back to the caller, because of missing ingress ACLs on caller LSP, example:

This 'unreachable' messages weren't received by caller:

SERVICE = 10.0.0.15
CALLER = 10.0.0.10
SERVICE_PORT = 2222

FOR UDP:
07:56:36.495365 IP 10.0.0.10.33002 > 10.0.0.15.2222: UDP, length 29
07:56:36.497758 IP 10.0.0.15 > 10.0.0.10: ICMP 10.0.0.15 udp port 2222 unreachable, length 65

FOR TCP:
08:01:38.510137 IP 10.0.0.15.2222 > 10.0.0.10.37403: Flags [R.], seq 0, ack 4252833580, win 0, length 0


More detailed info is attached to the original Octavia BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1823661

Version-Release number of selected component (if applicable):
OVN upstream branch 20.03

How reproducible:
Spawn devstack + use this heat template:
http://paste.openstack.org/show/792100/

or 

1. Create 2 LSPs: VM1 and VM2
2. Configure INGRESS ACL TCP/UDP rules on VM2 LSP
3. Call from VM1 unreachable service on VM2
4. Check tcpdump and verify that TCP reset or ICMP port unreachable hasn't been send back to VM1 


Additional info:
Added attachment with NBDB: ovnnb_db.db
LS:

_uuid               : 0961c261-bc3f-4be1-8a33-f04a06da7dce
acls                : []
dns_records         : [e6754baa-4a9d-4088-a6d9-afe5746f5596]
external_ids        : {"neutron:mtu"="1442", "neutron:network_name"=private, "neutron:revision_number"="3"}
forwarding_groups   : []
load_balancer       : []
name                : neutron-c366b33a-fa1c-49a0-af40-fdf74280766f
other_config        : {mcast_flood_unregistered="false", mcast_snoop="false"}
ports               : [3fe38284-fcc7-4a96-8458-e99e7ddd069c, 99eb7c3e-c65a-4085-af7c-bca154ce5455, a0e5c8b7-1224-4aa2-b642-425f840cdfaa, e56ed560-8165-4b1c-962f-9beb6ba63dc4, ff410973-76f2-46cf-8979-f37ab9680d7e]
qos_rules           : []



VM1 (caller):

stack@mjozefcz-bz-1823661:~$ ovn-nbctl list logical_switch_port 139f0236-fac4-4774-99f8-0d3740c97ed7
_uuid               : e56ed560-8165-4b1c-962f-9beb6ba63dc4
addresses           : ["fa:16:3e:4d:56:c7 10.0.0.10 fd15:292b:c24f:0:f816:3eff:fe4d:56c7"]
dhcpv4_options      : a738a744-755a-47e0-8392-4e7e8f974acc
dhcpv6_options      : []
dynamic_addresses   : []
enabled             : true
external_ids        : {"neutron:cidrs"="10.0.0.10/26 fd15:292b:c24f:0:f816:3eff:fe4d:56c7/64", "neutron:device_id"="9dd33845-9ab2-4a90-8f56-bf8e53ffa8b2", "neutron:device_owner"="compute:nova", "neutron:network_name"=neutron-c366b33a-fa1c-49a0-af40-fdf74280766f, "neutron:port_name"=servers-server1-port-uaaabio3465c, "neutron:project_id"="514ce4bcf0e34761ba4c043f81afdd6f", "neutron:revision_number"="4", "neutron:security_group_ids"="e3fcf5f9-cf18-4d69-a485-5c1c4f20e505"}
ha_chassis_group    : []
name                : "139f0236-fac4-4774-99f8-0d3740c97ed7"
options             : {requested-chassis=mjozefcz-bz-1823661}
parent_name         : []
port_security       : ["fa:16:3e:4d:56:c7 10.0.0.10 fd15:292b:c24f:0:f816:3eff:fe4d:56c7"]
tag                 : []
tag_request         : []
type                : ""
up                  : true
stack@mjozefcz-bz-1823661:~$ 


VM2 (service):
stack@mjozefcz-bz-1823661:~$ ovn-nbctl list logical_switch_port 5e5a9963-3c6a-487d-8fbe-6b0427c9f357
_uuid               : ff410973-76f2-46cf-8979-f37ab9680d7e
addresses           : ["fa:16:3e:73:05:e8 10.0.0.15 fd15:292b:c24f:0:f816:3eff:fe73:5e8"]
dhcpv4_options      : a738a744-755a-47e0-8392-4e7e8f974acc
dhcpv6_options      : []
dynamic_addresses   : []
enabled             : true
external_ids        : {"neutron:cidrs"="10.0.0.15/26 fd15:292b:c24f:0:f816:3eff:fe73:5e8/64", "neutron:device_id"="787adb51-34ec-4364-ab9f-d3f37181279d", "neutron:device_owner"="compute:nova", "neutron:network_name"=neutron-c366b33a-fa1c-49a0-af40-fdf74280766f, "neutron:port_name"=servers-server2-port-lp4buvh3utef, "neutron:project_id"="514ce4bcf0e34761ba4c043f81afdd6f", "neutron:revision_number"="4", "neutron:security_group_ids"="bfe03794-1e7e-4cc9-9154-d6e11fe0625f"}
ha_chassis_group    : []
name                : "5e5a9963-3c6a-487d-8fbe-6b0427c9f357"
options             : {requested-chassis=mjozefcz-bz-1823661}
parent_name         : []
port_security       : ["fa:16:3e:73:05:e8 10.0.0.15 fd15:292b:c24f:0:f816:3eff:fe73:5e8"]
tag                 : []
tag_request         : []
type                : ""
up                  : true
stack@mjozefcz-bz-1823661:~$ 




I think this is valid bug and should be cherry-picked to OVN 2.11.