From 185116fd9df9b8d15b8de97c0ae89cb7be55639a Mon Sep 17 00:00:00 2001
From: David Wahlstrom <david.wahlstrom@dreamhost.com>
Date: Tue, 6 Sep 2016 12:11:41 -0700
Subject: [PATCH] DVR: properly track SNAT traffic

When running DVR, it's possible for traffic to get confused and sent
through SNAT thanks to the way conntrack tracks "new" connections.  This
patch sets "nf_connctrack_tcp_loose" inside the SNAT namespace to more
intelligently handle SNAT traffic (and ignore what should be FIP
traffic) - basically, don't track a connection where we didn't
see the initial SYN.

https://www.kernel.org/doc/Documentation/networking/nf_conntrack-sysctl.txt

Change-Id: Ia5b8bd3794d22808ee1718d429f0bbdbe61e94ec
Closes-Bug: 1620824
(cherry picked from commit 299d08ed3f3f170a129fb2096df73fd5af7e647d)
---
 neutron/agent/l3/dvr_snat_ns.py               |  4 ++
 .../tests/unit/agent/l3/test_dvr_snat_ns.py   | 49 +++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 neutron/tests/unit/agent/l3/test_dvr_snat_ns.py

diff --git a/neutron/agent/l3/dvr_snat_ns.py b/neutron/agent/l3/dvr_snat_ns.py
index f22e717b0c0..d1566205e28 100644
--- a/neutron/agent/l3/dvr_snat_ns.py
+++ b/neutron/agent/l3/dvr_snat_ns.py
@@ -33,6 +33,10 @@ class SnatNamespace(namespaces.Namespace):
         # This might be an HA router namespaces and it should not have
         # ip_nonlocal_bind enabled
         ip_lib.set_ip_nonlocal_bind_for_namespace(self.name)
+        # Set nf_conntrack_tcp_loose to 0 to ensure mid-stream
+        # TCP conversations aren't taken over by SNAT
+        cmd = ['net.netfilter.nf_conntrack_tcp_loose=0']
+        ip_lib.sysctl(cmd, namespace=self.name)
 
     @classmethod
     def get_snat_ns_name(cls, router_id):
diff --git a/neutron/tests/unit/agent/l3/test_dvr_snat_ns.py b/neutron/tests/unit/agent/l3/test_dvr_snat_ns.py
new file mode 100644
index 00000000000..2185d5344b8
--- /dev/null
+++ b/neutron/tests/unit/agent/l3/test_dvr_snat_ns.py
@@ -0,0 +1,49 @@
+# Copyright (c) 2016 OpenStack Foundation
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import mock
+from oslo_config import cfg
+from oslo_utils import uuidutils
+
+from neutron.agent.common import utils
+from neutron.agent.l3 import dvr_snat_ns
+from neutron.tests import base
+
+_uuid = uuidutils.generate_uuid
+
+
+class TestDvrSnatNs(base.BaseTestCase):
+    def setUp(self):
+        super(TestDvrSnatNs, self).setUp()
+        self.conf = mock.Mock()
+        self.conf.state_path = cfg.CONF.state_path
+        self.driver = mock.Mock()
+        self.driver.DEV_NAME_LEN = 14
+        self.router_id = _uuid()
+        self.snat_ns = dvr_snat_ns.SnatNamespace(self.router_id,
+                                                 self.conf,
+                                                 self.driver,
+                                                 use_ipv6=False)
+
+    @mock.patch.object(utils, 'execute')
+    def test_create(self, execute):
+        self.snat_ns.create()
+
+        netns_cmd = ['ip', 'netns', 'exec', self.snat_ns.name]
+        loose_cmd = ['sysctl', '-w', 'net.netfilter.nf_conntrack_tcp_loose=0']
+        expected = [mock.call(netns_cmd + loose_cmd,
+                              check_exit_code=True, extra_ok_codes=None,
+                              log_fail_as_error=True, run_as_root=True)]
+
+        execute.assert_has_calls(expected)