Bug 1347428 - neutron-meter-agent - makes traffic between internal networks NATed
Summary: neutron-meter-agent - makes traffic between internal networks NATed
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-neutron
Version: 7.0 (Kilo)
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: async
: 7.0 (Kilo)
Assignee: Assaf Muller
QA Contact: Toni Freger
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-06-16 20:17 UTC by Jeremy
Modified: 2019-11-14 08:25 UTC (History)
9 users (show)

Fixed In Version: openstack-neutron-2015.1.2-16.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-07-20 23:54:33 UTC
Target Upstream Version:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1474 0 normal SHIPPED_LIVE Low: openstack-neutron security, bug fix, and enhancement update 2016-07-21 03:53:34 UTC

Description Jeremy 2016-06-16 20:17:53 UTC 
Description of problem:Customer is requesting backport of the following upstream bug to RHOSP7.0.

https://bugs.launchpad.net/neutron/+bug/1544508

If neutron-meter-agent is installed and enabled, and a meter-label is created, all traffic between internal networks becomes NATed, which is unexpected and potentially causes firewall/routing issues. This happens because meter-agent does not define stateless flag during iptables initialization which later during _modify_rules in agent/linux/iptables_manager.py results in moving the following rules:

before:
-A POSTROUTING -j neutron-l3-agent-POSTROUTING
-A POSTROUTING -j neutron-postrouting-bottom

after:
-A POSTROUTING -j neutron-postrouting-bottom
-A POSTROUTING -j neutron-l3-agent-POSTROUTING


Version-Release number of selected component (if applicable):
Customer is currently on :
neutron]# rpm -qa | grep neutron
python-neutron-lbaas-2015.1.2-2.el7ost.noarch
openstack-neutron-lbaas-2015.1.2-2.el7ost.noarch
openstack-neutron-metering-agent-2015.1.2-14.el7ost.noarch
python-neutron-2015.1.2-14.el7ost.noarch
openstack-neutron-2015.1.2-14.el7ost.noarch
openstack-neutron-openvswitch-2015.1.2-14.el7ost.noarch
openstack-neutron-common-2015.1.2-14.el7ost.noarch
openstack-neutron-ml2-2015.1.2-14.el7ost.noarch
python-neutronclient-2.4.0-2.el7ost.noarch


Additional info:

OpenStack Infra (hudson-openstack) wrote on 2016-05-26: Fix merged to neutron (master)	

Reviewed: https://review.openstack.org/314250
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=3bf73801df169de40d365e6240e045266392ca63
Submitter: Jenkins
Branch: master
Comment 7 anil venkata 2016-06-27 13:03:28 UTC 
@Jeremy Melvin

Can you please deliver the hotfix to the customer?

Thanks
Anil
Comment 8 Jeremy 2016-06-27 15:15:06 UTC 
I have attached the hotfix packages to the customer's case.
Comment 10 Toni Freger 2016-06-30 12:24:55 UTC 
Code tested on latest version: openstack-neutron-2015.1.4-1.el7ost.noarch
Comment 13 errata-xmlrpc 2016-07-20 23:54:33 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2016:1474
Note You need to log in before you can comment on or make changes to this bug.