Bug 1898052 - [OSP16.1][OVN][Multicast] With default settings IGMP snooping works only if there are subscribed clients
Summary: [OSP16.1][OVN][Multicast] With default settings IGMP snooping works only if t...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: python-networking-ovn
Version: 16.1 (Train)
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: z4
: 16.1 (Train on RHEL 8.2)
Assignee: Lucas Alvares Gomes
QA Contact: Roman Safronov
URL:
Whiteboard:
Depends On:
Blocks: 1575512
TreeView+ depends on / blocked
 
Reported: 2020-11-16 09:40 UTC by Roman Safronov
Modified: 2023-09-15 00:51 UTC (History)
16 users (show)

Fixed In Version: python-networking-ovn-7.3.1-1.20201114024049.el8ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-03-17 15:35:42 UTC
Target Upstream Version:
Embargoed:
ffernand: needinfo-
ffernand: needinfo-


Attachments (Terms of Use)
multicast script I used for tests (3.02 KB, text/plain)
2020-11-16 12:41 UTC, Roman Safronov
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Launchpad 1904399 0 None None None 2020-11-16 10:14:24 UTC
OpenStack gerrit 762818 0 None MERGED [OVN] Fix inconsistent IGMP configuration 2021-02-18 17:07:25 UTC
Red Hat Product Errata RHBA-2021:0817 0 None None None 2021-03-17 15:36:05 UTC

Description Roman Safronov 2020-11-16 09:40:06 UTC
Description of problem:
IGMP snooping behavior is inconsistent. It is working only if there are subscribed clients and until idle timeout expires. In other cases multicast works as broadcast, i.e. there is flooding to all ports. 
Note: igmp querier is not configured by default.

With the following logical switch configuration igmp snooping works consistently.
other_config        : {mcast_flood_unregistered="false", mcast_snoop="true"}

so workaround is to disable mcast_flood_unregistered for the logical switch:
ovn-nbctl set Logical_Switch <switch ID>  other_config:mcast_flood_unregistered="false"

Version-Release number of selected component (if applicable):
RHOS-16.1-RHEL-8-20201110.n.1

How reproducible:
100%

Steps to Reproduce:
1. Deploy OSP16.1 with NeutronEnableIgmpSnooping set to True
2. Create a network, subnet, security group allowing ssh, icmp, igmp and port for multicast udp traffic (e.g. 5001) 
3. Create 2 VMs connected to the network: sender and unregistered (this one will not subscribe to multicast). If you want to test steps 6-8 create also 2 receiver VMs.
4. On the unregistered VM run tcpdump e.g. tcpdump -i any -vvneA -s0 -l host 225.0.0.1
5. On sender run multicast server script: python3 multicast -s -g 225.0.0.1 -p 5001 -m qweqwe -c 10
Traffic reaches unregistered VM - not as expected.

Also

6. On receivers run multicast client script (see attached file), e.g. python3 multicast -r -g 225.0.0.1 -p 5001
7. On sender run multicast server script (i.e. repeat step 5)
Make sure multicast stream reached both receivers and did not reach the unregistered - as expected
8. Wait at least for 300 seconds until clients subscription expires and repeat step 5
Traffic reaches unregistered VM - not as expected.

Actual results:
Traffic reaches the unregistered VM - BUG

Expected results:
Traffic does not reach unregistered VM even when there are no subscribed clients

Additional info:
[heat-admin@controller-0 ~]$ nb list Logical_Switch
_uuid               : 620f6ceb-23d4-4cd8-b356-6ce614e46f18
acls                : []
dns_records         : []
external_ids        : {"neutron:mtu"="1500", "neutron:network_name"=nova, "neutron:revision_number"="4"}
forwarding_groups   : []
load_balancer       : []
name                : neutron-2cd400a5-7ae4-430c-97d2-67a800d3821c
other_config        : {mcast_flood_unregistered="true", mcast_snoop="true"}
ports               : [3d7b766f-1cd7-4024-8c69-f281c3baff4a, 50dc46c1-5f6b-4381-bf50-239d4c0d58eb, 73a32d4f-7abc-4c11-9fd3-d0c78b4840e4, 8d818d45-ddbe-49bd-8235-abf6c3365635, 9d333c4b-7972-4a31-bf50-628f6c835778, c7cae370-6fb4-4a47-a5b7-5358926402f1]
qos_rules           : []


[heat-admin@controller-0 ~]$ ovn-sbctl list ip_multicast
_uuid               : 3ce47104-3805-4aee-81fa-268b05bbe7d3
datapath            : 01eabea6-a967-41ec-ad6f-32c2a037c063
enabled             : true
eth_src             : ""
idle_timeout        : 300
ip4_src             : ""
ip6_src             : ""
querier             : true
query_interval      : 150
query_max_resp      : 1
seq_no              : 0
table_size          : 2048

Comment 2 Roman Safronov 2020-11-16 12:41:07 UTC
Created attachment 1729748 [details]
multicast script I used for tests

Taken from https://github.com/redhat-openstack/nfv-tempest-plugin/blob/master/nfv_tempest_plugin/tests/scenario/tests_scripts/multicast_traffic.py, but I also added a fix to support python3 as well

Comment 12 Roman Safronov 2021-01-21 16:44:37 UTC
Verified on puddle RHOS-16.1-RHEL-8-20210120.n.1 with python3-networking-ovn-7.3.1-1.20201114024050.el8ost.noarch

Verified that there is no flooding of multicast traffic to all ports of logical switch when there are no subscribed clients.
Verified also that igmp snooping works properly when there are subscribed clients.

Comment 20 errata-xmlrpc 2021-03-17 15:35:42 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenStack Platform 16.1.4 director bug fix advisory), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:0817

Comment 21 Red Hat Bugzilla 2023-09-15 00:51:15 UTC
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days


Note You need to log in before you can comment on or make changes to this bug.