DVR: properly track SNAT traffic
When running DVR, it's possible for traffic to get confused and sent
through SNAT thanks to the way conntrack tracks "new" connections. This
patch sets "nf_connctrack_tcp_loose" inside the SNAT namespace to more
intelligently handle SNAT traffic (and ignore what should be FIP
traffic) - basically, don't track a connection where we didn't
see the initial SYN.
https://www.kernel.org/doc/Documentation/networking/nf_conntrack-sysctl.txt
Change-Id: Ia5b8bd3794d22808ee1718d429f0bbdbe61e94ec
Closes-Bug: 1620824
(cherry picked from commit 299d08ed3f
)
This commit is contained in:
parent
7b67e63e97
commit
185116fd9d
|
@ -33,6 +33,10 @@ class SnatNamespace(namespaces.Namespace):
|
|||
# This might be an HA router namespaces and it should not have
|
||||
# ip_nonlocal_bind enabled
|
||||
ip_lib.set_ip_nonlocal_bind_for_namespace(self.name)
|
||||
# Set nf_conntrack_tcp_loose to 0 to ensure mid-stream
|
||||
# TCP conversations aren't taken over by SNAT
|
||||
cmd = ['net.netfilter.nf_conntrack_tcp_loose=0']
|
||||
ip_lib.sysctl(cmd, namespace=self.name)
|
||||
|
||||
@classmethod
|
||||
def get_snat_ns_name(cls, router_id):
|
||||
|
|
|
@ -0,0 +1,49 @@
|
|||
# Copyright (c) 2016 OpenStack Foundation
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
import mock
|
||||
from oslo_config import cfg
|
||||
from oslo_utils import uuidutils
|
||||
|
||||
from neutron.agent.common import utils
|
||||
from neutron.agent.l3 import dvr_snat_ns
|
||||
from neutron.tests import base
|
||||
|
||||
_uuid = uuidutils.generate_uuid
|
||||
|
||||
|
||||
class TestDvrSnatNs(base.BaseTestCase):
|
||||
def setUp(self):
|
||||
super(TestDvrSnatNs, self).setUp()
|
||||
self.conf = mock.Mock()
|
||||
self.conf.state_path = cfg.CONF.state_path
|
||||
self.driver = mock.Mock()
|
||||
self.driver.DEV_NAME_LEN = 14
|
||||
self.router_id = _uuid()
|
||||
self.snat_ns = dvr_snat_ns.SnatNamespace(self.router_id,
|
||||
self.conf,
|
||||
self.driver,
|
||||
use_ipv6=False)
|
||||
|
||||
@mock.patch.object(utils, 'execute')
|
||||
def test_create(self, execute):
|
||||
self.snat_ns.create()
|
||||
|
||||
netns_cmd = ['ip', 'netns', 'exec', self.snat_ns.name]
|
||||
loose_cmd = ['sysctl', '-w', 'net.netfilter.nf_conntrack_tcp_loose=0']
|
||||
expected = [mock.call(netns_cmd + loose_cmd,
|
||||
check_exit_code=True, extra_ok_codes=None,
|
||||
log_fail_as_error=True, run_as_root=True)]
|
||||
|
||||
execute.assert_has_calls(expected)
|
Loading…
Reference in New Issue