From da81ae88929c389f0ba8660c4c8dfb79eec7c0fd Mon Sep 17 00:00:00 2001 From: Oleg Bondarev Date: Thu, 3 Sep 2015 15:13:25 +0300 Subject: [PATCH] OVS agent: flush firewall rules for all deleted ports at once In some cases, under high load OVS agent has to delete a big amount of ports during rpc_loop. remove_devices_filter() does iptables-save/restore for IPv4 and IPv6 which is 4 system calls. It is very expensive and inefficient to call it for each port individually. Closes-Bug: #1491922 Change-Id: I4cfb2dfcef5088436c7aaae22c8f66e1ea052311 --- .../ml2/drivers/openvswitch/agent/ovs_neutron_agent.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/neutron/plugins/ml2/drivers/openvswitch/agent/ovs_neutron_agent.py b/neutron/plugins/ml2/drivers/openvswitch/agent/ovs_neutron_agent.py index dc707e85a4d..a4cf4110918 100644 --- a/neutron/plugins/ml2/drivers/openvswitch/agent/ovs_neutron_agent.py +++ b/neutron/plugins/ml2/drivers/openvswitch/agent/ovs_neutron_agent.py @@ -432,21 +432,24 @@ class OVSNeutronAgent(sg_rpc.SecurityGroupAgentRpcCallbackMixin, # they are already gone if 'removed' in port_info: self.deleted_ports -= port_info['removed'] + deleted_ports = list(self.deleted_ports) while self.deleted_ports: port_id = self.deleted_ports.pop() - # Flush firewall rules and move to dead VLAN so deleted ports no - # longer have access to the network - self.sg_agent.remove_devices_filter([port_id]) port = self.int_br.get_vif_port_by_id(port_id) self._clean_network_ports(port_id) self.ext_manager.delete_port(self.context, {"vif_port": port, "port_id": port_id}) + # move to dead VLAN so deleted ports no + # longer have access to the network if port: # don't log errors since there is a chance someone will be # removing the port from the bridge at the same time self.port_dead(port, log_errors=False) self.port_unbound(port_id) + # Flush firewall rules after ports are put on dead VLAN to be + # more secure + self.sg_agent.remove_devices_filter(deleted_ports) def tunnel_update(self, context, **kwargs): LOG.debug("tunnel_update received")