DVR: properly track SNAT traffic
When running DVR, it's possible for traffic to get confused and sent through SNAT thanks to the way conntrack tracks "new" connections. This patch sets "nf_connctrack_tcp_loose" inside the SNAT namespace to more intelligently handle SNAT traffic (and ignore what should be FIP traffic) - basically, don't track a connection where we didn't see the initial SYN. https://www.kernel.org/doc/Documentation/networking/nf_conntrack-sysctl.txt Change-Id: Ia5b8bd3794d22808ee1718d429f0bbdbe61e94ec Closes-Bug: 1620824
This commit is contained in:
parent
83ecf60999
commit
299d08ed3f
|
@ -33,6 +33,10 @@ class SnatNamespace(namespaces.Namespace):
|
||||||
# This might be an HA router namespaces and it should not have
|
# This might be an HA router namespaces and it should not have
|
||||||
# ip_nonlocal_bind enabled
|
# ip_nonlocal_bind enabled
|
||||||
ip_lib.set_ip_nonlocal_bind_for_namespace(self.name)
|
ip_lib.set_ip_nonlocal_bind_for_namespace(self.name)
|
||||||
|
# Set nf_conntrack_tcp_loose to 0 to ensure mid-stream
|
||||||
|
# TCP conversations aren't taken over by SNAT
|
||||||
|
cmd = ['net.netfilter.nf_conntrack_tcp_loose=0']
|
||||||
|
ip_lib.sysctl(cmd, namespace=self.name)
|
||||||
|
|
||||||
@classmethod
|
@classmethod
|
||||||
def get_snat_ns_name(cls, router_id):
|
def get_snat_ns_name(cls, router_id):
|
||||||
|
|
|
@ -0,0 +1,49 @@
|
||||||
|
# Copyright (c) 2016 OpenStack Foundation
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||||
|
# not use this file except in compliance with the License. You may obtain
|
||||||
|
# a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||||
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||||
|
# License for the specific language governing permissions and limitations
|
||||||
|
# under the License.
|
||||||
|
|
||||||
|
import mock
|
||||||
|
from oslo_config import cfg
|
||||||
|
from oslo_utils import uuidutils
|
||||||
|
|
||||||
|
from neutron.agent.common import utils
|
||||||
|
from neutron.agent.l3 import dvr_snat_ns
|
||||||
|
from neutron.tests import base
|
||||||
|
|
||||||
|
_uuid = uuidutils.generate_uuid
|
||||||
|
|
||||||
|
|
||||||
|
class TestDvrSnatNs(base.BaseTestCase):
|
||||||
|
def setUp(self):
|
||||||
|
super(TestDvrSnatNs, self).setUp()
|
||||||
|
self.conf = mock.Mock()
|
||||||
|
self.conf.state_path = cfg.CONF.state_path
|
||||||
|
self.driver = mock.Mock()
|
||||||
|
self.driver.DEV_NAME_LEN = 14
|
||||||
|
self.router_id = _uuid()
|
||||||
|
self.snat_ns = dvr_snat_ns.SnatNamespace(self.router_id,
|
||||||
|
self.conf,
|
||||||
|
self.driver,
|
||||||
|
use_ipv6=False)
|
||||||
|
|
||||||
|
@mock.patch.object(utils, 'execute')
|
||||||
|
def test_create(self, execute):
|
||||||
|
self.snat_ns.create()
|
||||||
|
|
||||||
|
netns_cmd = ['ip', 'netns', 'exec', self.snat_ns.name]
|
||||||
|
loose_cmd = ['sysctl', '-w', 'net.netfilter.nf_conntrack_tcp_loose=0']
|
||||||
|
expected = [mock.call(netns_cmd + loose_cmd,
|
||||||
|
check_exit_code=True, extra_ok_codes=None,
|
||||||
|
log_fail_as_error=True, run_as_root=True)]
|
||||||
|
|
||||||
|
execute.assert_has_calls(expected)
|
Loading…
Reference in New Issue