This update fixes a bug that prevented TCP health monitors in UDP pools from performing as expected.
Previously, the states of the pool members and the health monitors were not correctly reported. This was caused by SELinux rules that broke the use of TCP health monitors on specific port numbers in UDP pools.
Now the health monitors perform correctly.
DescriptionGregory Thiemonge
2023-06-09 06:08:24 UTC
Description of problem:
With OSP17, users can add TCP/HTTP health-monitors to UDP pools, but some ports are denied by SELinux
Version-Release number of selected component (if applicable):
17.1
How reproducible:
100%
Steps to Reproduce:
1. Deploy OSP+Octavia
2. Create a LB+UDP Listener+UDP Pool+1 member (port 1234 or monitor_port 1234)+TCP or HTTP HM
3.
Actual results:
No TCP/HTTP packets are sent by keepalived (and there are SELinux denials in the logs)
HM doesn't work
Expected results:
HM packets should not be blocked
Additional info:
Reproducer:
openstack loadbalancer create --vip-subnet external_subnet --name lb1
openstack loadbalancer listener create --protocol UDP --protocol-port 1234 --name listener1 lb1
openstack loadbalancer pool create --protocol UDP --listener listener1 --lb-algorithm ROUND_ROBIN --name pool1
openstack loadbalancer member create --address 10.0.0.72 --protocol-port 1234 --name member1 pool1
openstack loadbalancer healthmonitor create --name hm1 --type HTTP --delay 5 --timeout 4 --max-retries 3 pool1
Log into the amphora, check the audit log:
# tail -f /var/log/audit/audit.log
type=AVC msg=audit(1686240221.266:838): avc: denied { name_connect } for pid=15945 comm="keepalived" dest=1234 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:monopd_port_t:s0 tclass=tcp_socket permissive=0
type=SYSCALL msg=audit(1686240221.266:838): arch=c000003e syscall=42 success=no exit=-13 a0=8 a1=555c80b97600 a2=80 a3=7ffcdc746b50 items=0 ppid=15944 pid=15945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="keepalived" exe="/usr/sbin/keepalived" subj=system_u:system_r:keepalived_t:s0 key=(null)ARCH=x86_64 SYSCALL=connect AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
Check tcpdump output:
# ip netns exec amphora-haproxy tcpdump -nn -i eth1
[..] no TCP packets
Try another port number:
openstack loadbalancer member set --monitor-port 1235 pool1 member1
Check the logs and tcpdump output:
# tail -f /var/log/audit/audit.log
[..] no denied for name_connect
# ip netns exec amphora-haproxy tcpdump -nn -i eth1
[..]
12:06:22.175945 IP 10.0.0.233.18583 > 10.0.0.72.1235: Flags [S], seq 1796162379, win 29200, options [mss 1460,sackOK,TS val 3659440612 ecr 0,nop,wscale 11], length 0
[..]
It seems that keepalived allows only TCP connections to a specific list of port numbers:
There's a related BZ for RHEL7 https://bugzilla.redhat.com/show_bug.cgi?id=1443473
Related KCS https://access.redhat.com/solutions/2119681
It can be mitigated with a SELinux boolean:
# semanage boolean -l | grep keepal
keepalived_connect_any (off , off) Allow keepalived to connect any
From the keepalived_selinux manpage:
| If you want to determine whether keepalived can connect to all TCP ports, you must turn on the keepalived_connect_any boolean. Disabled by default.
| setsebool -P keepalived_connect_any 1
Comment 6Gregory Thiemonge
2023-06-14 08:42:49 UTC
Fix proposed to octavia master
Comment 8Gregory Thiemonge
2023-07-03 08:28:51 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (Red Hat OpenStack Platform 17.1.2 bug fix and enhancement advisory), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2024:0209
Comment 29Red Hat Bugzilla
2024-05-16 04:25:09 UTC
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days
Description of problem: With OSP17, users can add TCP/HTTP health-monitors to UDP pools, but some ports are denied by SELinux Version-Release number of selected component (if applicable): 17.1 How reproducible: 100% Steps to Reproduce: 1. Deploy OSP+Octavia 2. Create a LB+UDP Listener+UDP Pool+1 member (port 1234 or monitor_port 1234)+TCP or HTTP HM 3. Actual results: No TCP/HTTP packets are sent by keepalived (and there are SELinux denials in the logs) HM doesn't work Expected results: HM packets should not be blocked Additional info: Reproducer: openstack loadbalancer create --vip-subnet external_subnet --name lb1 openstack loadbalancer listener create --protocol UDP --protocol-port 1234 --name listener1 lb1 openstack loadbalancer pool create --protocol UDP --listener listener1 --lb-algorithm ROUND_ROBIN --name pool1 openstack loadbalancer member create --address 10.0.0.72 --protocol-port 1234 --name member1 pool1 openstack loadbalancer healthmonitor create --name hm1 --type HTTP --delay 5 --timeout 4 --max-retries 3 pool1 Log into the amphora, check the audit log: # tail -f /var/log/audit/audit.log type=AVC msg=audit(1686240221.266:838): avc: denied { name_connect } for pid=15945 comm="keepalived" dest=1234 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:monopd_port_t:s0 tclass=tcp_socket permissive=0 type=SYSCALL msg=audit(1686240221.266:838): arch=c000003e syscall=42 success=no exit=-13 a0=8 a1=555c80b97600 a2=80 a3=7ffcdc746b50 items=0 ppid=15944 pid=15945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="keepalived" exe="/usr/sbin/keepalived" subj=system_u:system_r:keepalived_t:s0 key=(null)ARCH=x86_64 SYSCALL=connect AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" Check tcpdump output: # ip netns exec amphora-haproxy tcpdump -nn -i eth1 [..] no TCP packets Try another port number: openstack loadbalancer member set --monitor-port 1235 pool1 member1 Check the logs and tcpdump output: # tail -f /var/log/audit/audit.log [..] no denied for name_connect # ip netns exec amphora-haproxy tcpdump -nn -i eth1 [..] 12:06:22.175945 IP 10.0.0.233.18583 > 10.0.0.72.1235: Flags [S], seq 1796162379, win 29200, options [mss 1460,sackOK,TS val 3659440612 ecr 0,nop,wscale 11], length 0 [..] It seems that keepalived allows only TCP connections to a specific list of port numbers: There's a related BZ for RHEL7 https://bugzilla.redhat.com/show_bug.cgi?id=1443473 Related KCS https://access.redhat.com/solutions/2119681 It can be mitigated with a SELinux boolean: # semanage boolean -l | grep keepal keepalived_connect_any (off , off) Allow keepalived to connect any From the keepalived_selinux manpage: | If you want to determine whether keepalived can connect to all TCP ports, you must turn on the keepalived_connect_any boolean. Disabled by default. | setsebool -P keepalived_connect_any 1