Bug 1575706 - Neutron agents attach untagged ports to br-int, which will be trunk port if neutron-openvswitch-agent never handles them
Summary: Neutron agents attach untagged ports to br-int, which will be trunk port if n...
Keywords:
Status: CLOSED EOL
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-neutron
Version: 11.0 (Ocata)
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: zstream
: 11.0 (Ocata)
Assignee: Miguel Angel Ajo
QA Contact: Toni Freger
URL:
Whiteboard:
Depends On:
Blocks: 1558336 1579400
TreeView+ depends on / blocked
 
Reported: 2018-05-07 17:01 UTC by Miguel Angel Ajo
Modified: 2018-06-22 12:37 UTC (History)
7 users (show)

Fixed In Version: openstack-neutron-10.0.5-5.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1579400 (view as bug list)
Environment:
Last Closed: 2018-06-22 12:37:37 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Miguel Angel Ajo 2018-05-07 17:01:43 UTC
Description of problem:


Neutron agent ports are added to br-int without any tag. That makes them trunk ports (receiving traffic for all VLANs) until neutron-openvswitch-agent will handle them.

Sometimes the ports are left untagged forever, meaning that for example ha-router ha port will receive traffic directly from the external network (jumps to br-int to br-ex , and also back), or dnsmasq receives requests on the external network.

Outgoing traffic is dropped in br-ex though..

Vague details here (it's all we have so far):
This also becomes an issue (still under investigation) with the ovs-vswitchd agent and the revalidator thread (the thread that will check the kernel datapath flows under some circumstances to get stuck, for some reason it slows down a lot while analyzing trunk ports, eventually crashing the node on CPU usage).

This is also related to one security lp here: https://bugs.launchpad.net/bugs/1734320


How reproducible:

100% if neutron-openvswitch-agent is down or broken

Steps to Reproduce:
1. stop neutron-openvswitch-agent
2. create a new router

Actual results:
The network node router ports will be inserted to br-int but left as untagged (trunk)


Expected results:
Ports are left on a dead vlan (4095) which will have no connectivity to other ports until they are finally tagged by agent.

Please note that such vlan is handled internally by openvswitch as a normal vlan and traffic could still happen over all local ports on 4095, although this is much less severe


Additional info:
This also serves as a workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1558336 where the issues becomes much worse were untagged ports exist in the system.

Comment 5 Scott Lewis 2018-06-22 12:37:37 UTC
OSP11 is now retired, see details at https://access.redhat.com/errata/product/191/ver=11/rhel---7/x86_64/RHBA-2018:1828


Note You need to log in before you can comment on or make changes to this bug.