Browse Source

DVR: properly track SNAT traffic

When running DVR, it's possible for traffic to get confused and sent
through SNAT thanks to the way conntrack tracks "new" connections.  This
patch sets "nf_connctrack_tcp_loose" inside the SNAT namespace to more
intelligently handle SNAT traffic (and ignore what should be FIP
traffic) - basically, don't track a connection where we didn't
see the initial SYN.

https://www.kernel.org/doc/Documentation/networking/nf_conntrack-sysctl.txt

Change-Id: Ia5b8bd3794d22808ee1718d429f0bbdbe61e94ec
Closes-Bug: 1620824
changes/97/366297/8
David Wahlstrom 6 years ago committed by Brian Haley
parent
commit
299d08ed3f
  1. 4
      neutron/agent/l3/dvr_snat_ns.py
  2. 49
      neutron/tests/unit/agent/l3/test_dvr_snat_ns.py

4
neutron/agent/l3/dvr_snat_ns.py

@ -33,6 +33,10 @@ class SnatNamespace(namespaces.Namespace):
# This might be an HA router namespaces and it should not have
# ip_nonlocal_bind enabled
ip_lib.set_ip_nonlocal_bind_for_namespace(self.name)
# Set nf_conntrack_tcp_loose to 0 to ensure mid-stream
# TCP conversations aren't taken over by SNAT
cmd = ['net.netfilter.nf_conntrack_tcp_loose=0']
ip_lib.sysctl(cmd, namespace=self.name)
@classmethod
def get_snat_ns_name(cls, router_id):

49
neutron/tests/unit/agent/l3/test_dvr_snat_ns.py

@ -0,0 +1,49 @@
# Copyright (c) 2016 OpenStack Foundation
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
import mock
from oslo_config import cfg
from oslo_utils import uuidutils
from neutron.agent.common import utils
from neutron.agent.l3 import dvr_snat_ns
from neutron.tests import base
_uuid = uuidutils.generate_uuid
class TestDvrSnatNs(base.BaseTestCase):
def setUp(self):
super(TestDvrSnatNs, self).setUp()
self.conf = mock.Mock()
self.conf.state_path = cfg.CONF.state_path
self.driver = mock.Mock()
self.driver.DEV_NAME_LEN = 14
self.router_id = _uuid()
self.snat_ns = dvr_snat_ns.SnatNamespace(self.router_id,
self.conf,
self.driver,
use_ipv6=False)
@mock.patch.object(utils, 'execute')
def test_create(self, execute):
self.snat_ns.create()
netns_cmd = ['ip', 'netns', 'exec', self.snat_ns.name]
loose_cmd = ['sysctl', '-w', 'net.netfilter.nf_conntrack_tcp_loose=0']
expected = [mock.call(netns_cmd + loose_cmd,
check_exit_code=True, extra_ok_codes=None,
log_fail_as_error=True, run_as_root=True)]
execute.assert_has_calls(expected)
Loading…
Cancel
Save