Red Hat OpenStack Platform deployments that use the Linux bridge ML2 driver and agent are unprotected against Address Resolution Protocol (ARP) spoofing. The version of Ethernet bridge frame table administration (ebtables) that is part of Red Hat Enterprise Linux 8 is incompatible with the Linux bridge ML2 driver.
The Linux Bridge ML2 driver and agent were deprecated in Red Hat OpenStack Platform 11, and should not be used.
Red Hat recommends that you use instead the ML2 Open Virtual Network (OVN) driver and services, the default deployed by the Red Hat OpenStack Platform director.
I did a small investigation on this one and I found that tests are failing with error like:
2019-06-14 05:56:35.110 26575 DEBUG neutron.agent.linux.utils [-] Running command (rootwrap daemon): ['ip', 'netns', 'exec', 'test-26150a31-5291-4b93-9ac0-a8c143a680ae', 'ebtables', '-t', 'nat', '--concurrent', '-A', 'neutronMAC-test-veth0be0dc', '-i', 'test-veth0be0dc',
'--among-src', 'fa:16:3e:e6:dd:20', '-j', 'RETURN'] execute_rootwrap_daemon /home/cloud-user/neutron/neutron/agent/linux/utils.py:103
2019-06-14 05:56:35.129 26575 ERROR neutron.agent.linux.utils [-] Exit code: 255; Stdin: ; Stdout: ; Stderr: Unknown argument: '--among-src'.
So I checked manually:
$ sudo ebtables -t nat --concurrent -A OUTPUT --among-src fa:16:3e:e6:dd:20 -j RETURN
Unknown argument: '--among-src'.
And looked into man page where I found "BUGS" section:
BUGS
The version of ebtables this man page ships with does not support the broute table. Also there is no support for
the among match. And finally, this list is probably not complete.
So it looks that this will simply not work and we have to workaround it somehow.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHEA-2019:2811
I did a small investigation on this one and I found that tests are failing with error like: 2019-06-14 05:56:35.110 26575 DEBUG neutron.agent.linux.utils [-] Running command (rootwrap daemon): ['ip', 'netns', 'exec', 'test-26150a31-5291-4b93-9ac0-a8c143a680ae', 'ebtables', '-t', 'nat', '--concurrent', '-A', 'neutronMAC-test-veth0be0dc', '-i', 'test-veth0be0dc', '--among-src', 'fa:16:3e:e6:dd:20', '-j', 'RETURN'] execute_rootwrap_daemon /home/cloud-user/neutron/neutron/agent/linux/utils.py:103 2019-06-14 05:56:35.129 26575 ERROR neutron.agent.linux.utils [-] Exit code: 255; Stdin: ; Stdout: ; Stderr: Unknown argument: '--among-src'. So I checked manually: $ sudo ebtables -t nat --concurrent -A OUTPUT --among-src fa:16:3e:e6:dd:20 -j RETURN Unknown argument: '--among-src'. And looked into man page where I found "BUGS" section: BUGS The version of ebtables this man page ships with does not support the broute table. Also there is no support for the among match. And finally, this list is probably not complete. So it looks that this will simply not work and we have to workaround it somehow.