Commit Graph

61 Commits (1c2e10f8595d2286bd9bec513bc5a346a84a6f7c)

Author SHA1 Message Date
LIU Yulong eaf3ff5786 Ignore first local port update notification
Ovs-agent will scan and process the ports during the
first rpc_loop, and a local port update notification
will be sent out. This will cause these ports to
be processed again in the ovs-agent next (second)
This patch passes the restart flag (iteration num 0)
to the local port_update call trace. After this patch,
the local port_update notification will be ignored in
the first RPC loop.

Related-Bug: #1813703
Change-Id: Ic5bf718cfd056f805741892a91a8d45f7a6e0db3
4 years ago
Ihar Hrachyshka 4aeec20001 Drop of_interface option
Default value for "of_interface" config option was switched
to "native" in Pike release.
In the same release this option was deprecated to removal.
Now it's time to remove it and force use of "native" driver to
manage openflows.

Change-Id: Ic900209868acfbe3bbb56fabbbf5c4472857e412
Co-Authored-By: Ihar Hrachyshka <>
Co-Authored-By: Slawek Kaplonski <>
4 years ago
LIU Yulong a5244d6d44 More accurate agent restart state transfer
Ovs-agent can be very time-consuming in handling a large number
of ports. At this point, the ovs-agent status report may have
exceeded the set timeout value. Some flows updating operations
will not be triggerred. This results in flows loss during agent
restart, especially for hosts to hosts of vxlan tunnel flow.

This fix will let the ovs-agent explicitly, in the first rpc loop,
indicate that the status is restarted. Then l2pop will be required
to update fdb entries.

Closes-Bug: #1813703
Closes-Bug: #1813714
Closes-Bug: #1813715
Closes-Bug: #1794991
Closes-Bug: #1799178

Change-Id: I8edc2deb509216add1fb21e1893f1c17dda80961
4 years ago
Rodolfo Alonso Hernandez 92f1281b69 Add a more robust method to check OVSDB values in BaseOVSTestCase
Sometimes, when the OVSDB is too loaded (that could happen during the
functional tests), there is a delay between the OVSDB post transaction
end and when the register (new or updated) can be read. Although this is
something that should not happen (considering the OVSDB is transactional),
tests should deal with this inconvenience and provide a robust method to
retrieve a value and at the same time check the value. This new method
should provide a retrieving mechanism to read again the value in case of

In order to solve the gate problem ASAP, another bug is fixed in this
patch: to skip the QoS removal when OVS agent is initialized during
funtional tests

When executing functional tests, several OVS QoS policies specific for
minimum bandwidth rules [1]. Because during the functional tests
execution several threads can create more than one minimum bandwidth
QoS policy (something in a production environment cannot happen), the
OVS QoS driver must skip the execution of [2] to avoid removing other
QoS created in parellel in other tests.

This patch is marking as unstable "test_min_bw_qos_policy_rule_lifecycle"
and "test_bw_limit_qos_port_removed". Those tests will be investigated
once the CI gates are stable.

[1] Those QoS policies are created only to hold minimum bandwidth rules.
    Those policies are marked with:
       external_ids: {'_type'='minimum_bandwidth'}
[2] d6fba30781/neutron/plugins/ml2/drivers/openvswitch/agent/extension_drivers/ (L43)

Closes-Bug: #1818613
Closes-Bug: #1818859
Related-Bug: #1819125

Change-Id: Ia725cc1b36bc3630d2891f86f76b13c16f6cc37c
4 years ago
Brian Haley cf37563c83 Remove deprecated vsctl ovsdb_interface api
This was deprecated in
so remove all the vsctl-related code, leaving just the native
ovsdb api.

Also removed renamed ovs_vsctl_timeout value, which was changed
to ovsdb_timeout in

Change-Id: I50dfcea3deb41df1bd01fd06b76522453a6ba50b
5 years ago
Lucian Petrut 585b6f0af7 Windows OVS: minimize polling
Now, that the ovsdb monitor is also available on Windows, we can
use it on Windows as well, minimizing polling.

We're simply moving the bits to the common polling module.

Change-Id: Ia12ad970085f2cff8c8ac5b7d3d69e7dc9214c40
5 years ago
Miguel Angel Ajo 88f5e11d8b Avoid agents adding ports as trunk by default.
Agent OVS interface code adds ports without a vlan tag,
if neutron-openvswitch-agent fails to set the tag, or takes
too long, the port will be a trunk port, receiving
traffic from the external network or any other port
sending traffic on br-int.

Also, those kinds of ports are triggering a code path
on the ovs-vswitchd revalidator thread which can eventually
hog the CPU of the host (that's a bug under investigation [1])


Co-Authored-By: Slawek Kaplonski <>
Change-Id: I024bbbdf7059835b2f23c264b48478c71633a43c
Closes-Bug: 1767422
5 years ago
Ali Sanhaji 6bf0788da0 Adding DSCP mark and inheritance in OVS and LB tunnels outer header
Adding ability to set DSCP field in OVS tunnels outer header, or
inherit it from the inner header's DSCP value for OVS and linuxbridge.

Change-Id: Ia59753ded73cd23019605668e60cfbc8841e803d
Closes-Bug: #1692951
5 years ago
Zuul b520b16d8a Merge "use plugin constants from neutron-lib" 6 years ago
Boden R 95f1e03446 use plugin constants from neutron-lib
neutron-lib contains a number of the plugin related constants from
neutron.plugins.common.constants. This patch consumes those constants
from neutron-lib and removes them from neutron. In addition the notion
of the dummy plugin service type is moved strictly into the test
package of neutron since it's not a real service plugin.


Change-Id: I767c626f3fe6159ab3abd6a7ae3cb9893b79bf66
6 years ago
Boden R 0822b0aef4 consume common constants from lib
The neutron-lib commit I360545b6ee4291547e0c5c8e668ad03d3efa4725 moved
the externally consumed globals from neutron.common.constants into lib.
With the exception of PROVISIONAL_IPV6_PD_PREFIX all other constants
in neutron.common.constants should only be used in neutron, and will
hopefully remain that way. External consumers needing access to other
common constants should move them into lib first.


Change-Id: Ie4bcffccf626a6e1de84af01f3487feb825f8b65
6 years ago
Ihar Hrachyshka 45be804b40 ovs: log config options when all of them are registered
Otherwise we don't see some of them for the agent, for example,
AGENT.root_helper is missing.

To make sure the logging is as early as possible, and to make sure that
options that may be registered by extensions are also logged, some
refactoring was applied to the code to move the extension manager
loading as early as possible, even before agent's __init__ is called.

Related-Bug: #1718767
Change-Id: I823150cf6406f709d1e4ffa74897d598e80f5329
6 years ago
sindhu devale 51ca683797 Refactoring agent linux&ovsdb config
Refactoring neutron agent linux and ovsdb config opts
to be in neutron/conf/agent so that all the config options
reside in a centralized location. This simplifies the
process of looking up the config opts and provides an easy
way to import.


Change-Id: Ib1e0e63dec2985c417412d1ecc68e2a74ef87182
Partial-Bug: #1563069
6 years ago
Kevin Benton 01a97d926c Remove deprecated prevent_arp_spoofing option
This was deprecated over a year ago in [1] so let's
get rid of it to clean up some code.

1. Ib63ba8ae7050465a0786ea3d50c65f413f4ebe38

Change-Id: I6039fb7e743c5d9a1a313e3c174ada36c9874c70
6 years ago
Sławek Kapłoński 2d0d1a2d76 Add support for ingress bandwidth limit rules in ovs agent
Add support for QoS ingress bandwidth limiting in
openvswitch agent.
It uses default ovs QoS policies on bandwidth limiting

DocImpact: Ingress bandwidth limit in QoS supported by
           Openvswitch agent

Change-Id: I9d94e27db5d574b61061689dc99f12f095625ca0
Partial-Bug: #1560961
6 years ago
Nir Magnezi 0a4596aa20 Adds an option to skip ports on ovs_cleanup
In some cases we would want to refrain from cleaning up specific
openvswitch ports.

In Octavia, the health manager service is using a predefined[1]
openvswitch port which will gets nuked by the ovs_cleanup script in the
boot process.

That port is created by the operating system NIC configuration file
(by using OVS_EXTRA[2]), but due to the order of actions in the boot
process, the ovs_cleanup script gets invoked by systemd only at a later
stage. As a result the port will be deleted each time and the Octavia
health manager service will fail to bind.

This patch takes advantage of the 'external_ids' column that already
exists for ovs ports, in order to filter out ports we would like to
skip. We filter those ports by adding 'skip_cleanup' to the
'external_ids' column.

It is important to note that this will work if we append the following
to the port: -- set Interface o-hm0 external_ids:skip_cleanup=true"

Related-Bug: #1685223


Change-Id: If483d0ee027596999370ab0d21b1743d4ef16acb
6 years ago
John Perkins 7f23ccce23 Agent common config
Refactoring Neutron configuration options for agent common config to be
in neutron/conf/agent/common. This will allow centralization of all
configuration options and provide an easy way to import.

Partial-Bug: #1563069
Change-Id: Iebac0cdd3bcfd0135349128921b7ad7a1a939ab8
Needed-By: Ib676003bbe909b5a9013a3178b12dbe291d936af
6 years ago
Trevor McCasland ae3b344be3 use neutron_lib's get_random_mac
Neutron-lib 1.1.0 is now out and contains the get_random_mac
definition[1]. This patch moves neutron references over to
the neutron-lib version.


[1] ee0f5b2ab27c828cfedb771735d237a968423da2

Change-Id: I28a2a1d85a85461f7a4344b86d18da7f68066c95
6 years ago
Bernard Cafarelli a8b6a597b6 Revert "Setup firewall filters only for required ports"
This reverts commit 75edc1ff28.

Ports with port security disabled require firewall entries in
neutron-openvswi-FORWARD chain to work properly.
Ports created with no security groups will not get skipped with current
With fixed security groups check, these ports' security groups can not
be updated after creation.

Change-Id: I95ddbe38d8ac8a927a860a98f54e41e17fb71d43
Closes-Bug: #1549443
6 years ago
Henry Gessau 8b048cc287 Use project_id instead of tenant_id in objects
Objects must use project_id and not tenant_id. The object framework
ensures that tenant_id is added as an extra field for backward

This patch reverts the workaround implemented in change
I4ec9340094bc51cd8aa6e5112bf8114aa26c2982 and implements a proper fix
by explicitly updating the objects.

Co-Authored-By: Artur Korzeniewski <>
Co-Authored-By: Darek Smigiel <>

Closes-Bug: #1630748

Change-Id: Iab90bcab41655b2e210aea0e7581eb00b94ce5e5
6 years ago
Jenkins 920ddeaf58 Merge "DSCP packet marking support in Linuxbridge agent" 7 years ago
Sławek Kapłoński fd3bf3327c DSCP packet marking support in Linuxbridge agent
Linuxbridge agent uses iptable rules in POSTROUTING chain
in the mangle table to mark outgoing packets with the
DSCP mark value configured by the user in QoS policy.

DocImpact: DSCP Marking rule support is extended to the
           Linuxbridge L2 agent

Closes-Bug: #1644369

Change-Id: I47e44cb2e67ab73bd5ee0aa4cca47cb3d07e43f3
7 years ago
Jenkins 0399cdfa63 Merge "Pass context and resource_type in RPC callback" 7 years ago
Kevin Benton cf6ffb78f6 Pass context and resource_type in RPC callback
Maintaining the context is important for keeping the request ID
and subsequently operator/developer sanity while debugging.
The resource_type is also helpful to have since a function could be
subscribed for multiple resources.

This maintains and deprecates the existing 'subscribe' method for
backwards compatibility with callbacks that don't support receiving
the context and resource type. A new 'register' method is added
for callbacks to use that are compatible with receiving the context.

Change-Id: I06c8302951c99039b532acd9f2a68d5b989fdab5
7 years ago
Aradhana Singh 42031f7547 Refactoring config opts for ml2 plugin openvswitch
Refactoring ml2 plugin openvswitch driver configuration options to be
in neutron/conf/plugins/ml2/drivers. This would allow centralization
of all configuration options and provides an easy way to import.

Change-Id: Ie8c6023b2d012eae7ecdb99d5d413956608f4294
Partial-Bug: #1563069
7 years ago
rossella 08f2af18f9 Handle add/remove subports events loss due to agent failures
Upon restart the agent reconciles the logical with the physical
state by removing/adding physical subports that are used to
be/are current present in the logical view.

This patch adds a functional test to demonstrate that there's
no need to handle the resync in the trunk driver, since the ovs
agent already takes care of it.

Change-Id: I164153c79313f2ae7a1fca0414736d5987656185
Partially-implements: blueprint vlan-aware-vms
Partial-bug: #1623708
7 years ago
Ihar Hrachyshka 31e1aeb66b Forbid importing neutron.tests.* from outside tests subtree
neutron-sanity-check tool was importing neutron.tests.base module, which
may be not present on some systems (f.e. RDO splits neutron/tests/
subtree in a separate python-neutron-tests package). It made the tool
not usable in some setups.

This is not the first time when we by mistake import from
neutron.tests.* and break distributions. It's time to stop it by
proactively forbidding that pattern via a new hacking check.

Some functions were moved from neutron.tests.base to
neutron.common.utils to fulfill the need requirement. They were moved
using debtcollector, no current consumers should be affected.

Closes-Bug: #1621782
Change-Id: I790777ddcbd1b02218b3db54ae3d5c931d72d4fa
7 years ago
Jenkins 17d85e4748 Merge "Introduce bulk push to rpc callback mechanism" 7 years ago
Miguel Angel Ajo 7f617e6a21 Introduce bulk push to rpc callback mechanism
There are usage patterns which would benefit from having
the capability to send a list of resources in bulk instead
of using individual fanout messages.

From now on, the rpc callback subscriber receives a list of
resources (single or multiple), and the pushers must always
push a list.

Backwards compatibility for QoSPolicy consumers in mitaka
is provided by calling push with "resource" parameter for
single item lists during one release cycle. That will be
dropped when Ocata opens.

Partially-implements: blueprint vlan-aware-vms

Change-Id: I1117925360a29ecbd1902fa527b2f24f94ce81ec
7 years ago
Anindita Das 414ceed4f3 Refactoring config options for common config opts
Refactoring neutron common config opts to be in neutron/conf/common so
that all the configuration options reside in a centralized location.
This simplifies the process of looking up the config opts and provides
an easy way to import.

Moved conf/common/ to conf/ as per review comments.

Partial-Bug: #1563069

Change-Id: Ib5fa294906549237630f87b9c848eebe0644088c
7 years ago
Jenkins 122a971656 Merge "Generalize agent extension mechanism" 7 years ago
Nate Johnston 01a6c9c426 Generalize agent extension mechanism
This change generalizes agent extension code so that all agents can take
advantage of a common mechanism.

Co-Authored-By: Margaret Frances <>

Partially-Implements: blueprint l3-agent-extensions

Change-Id: I9380343c09d28eec67077c9e6d77c33a195e516b
7 years ago
Edan David 151d94521f Replace device owners hard coded strings to neutron_lib constants
Change-Id: I821f0def82164ab1303188d3f1bdfd85473470cd
7 years ago
Jakub Libosvar a626172706 Move wait_until_true to neutron.common.utils
We need to be able to re-use wait_until_true in tempest scenario tests.
There is tempest bug
that prevents us to do so.

Also wait_until_true is not linux specific so it makes more sense to
have it in common package.

Change-Id: Ib8b0e51dbd9edaa58391774d428a737836dfdf77
7 years ago
Frode Nordahl 773394a188 OVS: Add support for IPv6 addresses as tunnel endpoints
Remove IPv4 restriction for local_ip configuration statement.

Check for IP version mismatch of local_ip and remote_ip before creating

Create hash of remote IPv6 address for OVS interface/port name with least
posibility for collissions.

Fix existing tests that fail because of the added check for IP version
and subsequently valid IP addresses in _setup_tunnel_port.


Change-Id: I9ec137ef8c688b678a0c61f07e9a01382acbeb13
Closes-Bug: #1525895
7 years ago
Henry Gessau 4148a347b3 Use constants from neutron-lib
With this we enable the deprecation warnings by default.

Related-Blueprint: neutron-lib

Change-Id: I5b9e53751dd164010e5bbeb15f534ac0fe2a5105
7 years ago
Nate Johnston 6b6c0421bb QoS DSCP use mod_flow instead of mod_flows
In the implementation of DSCP QoS rule, the QosOVSAgentDriver uses the
wrong method to modify br-int flows. It uses br_int.mod_flows() whilst
it should use br_int.mod_flow().

This patch fixes this and also adds verification of the updates of DSCP,
as we have for bandwidth here to trigger that code path and avoid

Change-Id: I685ac373701ff8407fd7fbf649e17a2f7dfc0008
Closes-Bug: #1564820
7 years ago
Hynek Mlnarik cacde308ee Cleanup stale OVS flows for physical bridges
Perform deletion of the stale flows in physical bridges consistently with
br-int and br-tun, respecting drop_flows_on_start configuration option.
Added tests for auxiliary bridge and functional tests for the physical
bridge using VLAN/flat external network. Fixes part of the bug 1514056;
together with [1] and [2], the bug should be considered fixed.

The commit also fixes inconsistency between netmask of allocated IP
addresses assigned in _create_test_port_dict and ip_len in _plug_ports


Co-Authored-By: Jian Wen <>
Partial-Bug: 1514056
Change-Id: I9801b76829021c9a0e6358982e1136637634a521
7 years ago
David Shaughnessy a9a1943fde DSCP QoS rule implementation
This patch adds the front end and back end implementation of QoS DSCP.

Associated patches that are dependent on this one:

* python-neutronclient:
* openstack-manuals:
* API Guide:
* Heat:
  * Spec:
  * QoSDscpMarkingRule resource:
* Fullstack tests:

APIImpact - The API now supports marking traffic egressing from a VM's
            dscp field with a valid dscp value.

Co-Authored-By: Nate Johnston <>
Co-Authored-By: Victor Howard <>
Co-Authored-By: Margaret Frances <>
Co-Authored-By: James Reeves <>
Co-Authored-By: John Schwarz <>
Needed-By: I25ad60c1b9a66e568276a772b8c496987d9f8299
Needed-By: I881b8f5bc9024c20275bc56062de72a1c70c8321
Needed-By: I48ead4b459183db795337ab729830a1b3c0022da
Needed-By: Ib92b172dce48276b90ec75ee5880ddd69040d7c8
Needed-By: I4eb21495e84feea46880caf3360759263e1e8f95
Needed-By: I0ab6a1a0d1430c5791fea1d5b54106c6cc93b937
Partial-Bug: #1468353

Change-Id: Ic3baefe176df05f049a2e06529c58fd65fe6b419
7 years ago
rossella 584faf47e2 Don't sync all devices when some fail
With the new RPC calls get_devices_details_and_failed_devices
and update_device_list the agent gets a list of devices
for which some operation failed. The agent can now make use
of this information and instead of syncing all the devices
can sync only those which failed.
With the current change if a device keeps failing, the agent
will try to sync it forever. In a following patch I will limit
the number of retrials.

Partially-Implements: blueprint restructure-l2-agent
Change-Id: I295dc79031a0547f8687c5835c7ba7bbc43df36d
7 years ago
Terry Wilson 71fa182000 Make sure datapath_type is updated on bridges changed
When changing datapath_type in the config, physical and tunnel bridges
do not have their datapath_type updated. Calling create() on already
created bridges should be safe as it passes '--may-exist' when adding
the bridge, which will do nothing if the bridge already exists, but
the second part of the transaction will still update things like

It should be noted that ancillary bridges (like br-ex) are not
modified by this patch as datapath_type was never applied to them to
begin with.

Incidentally, the native and vsctl versions behaved slightly
differently when handling datapath_type: vsctl builds the multi-cmd
transaction with add-br ... -- set ..., so that the second cmd would
actually complete. The native just bailed if may_exist and the bridge
existed. This is fixed as part of this patch.

Change-Id: Ib8bc817c7bc724d80193d0ca7af480a7ea103f77
Closes-Bug: 1532273
8 years ago
ChangBo Guo(gcb) 06174a41e4 Trival: Remove unused logging import
Change-Id: I13298e642f25c9f70dcff9b1e056b418edf0a461
8 years ago
rossella ccdf211b4c Revert "Revert "OVS agent reacts to events instead of polling""
The original change had to be reverted because it caused
tests failing in the gate. The failures were due to the
fact that when a port was not ready, an exception was
thrown to trigger a full resync of the agent. This
behavior was meant to be temporary and was fixed in a
dependent patch that was not merged though. This revert
moves the handling of not ready ports in this patch.
It also refactors the unit tests a bit.

This reverts commit e7270d9505.

Change-Id: I6574cef3c95525ace6a98cf968ee159190681394
8 years ago
Sergey Belous a88fdfc8e1 Refactor OVS-agent init-method
Removed create_agent_config_map method which creates specific
configurations dictionary according to cfg.CONF and call the OVS-agent
with that structure. Passing oslo_config directly to init-method
of OVS-agent is more straightforward and makes it more testable.
Also refactored unit and functional tests of OVS-agent in accordance
with the changes in init-method.

Closes-bug: #1464394
Change-Id: I88742e4d454709e35481f2c505c9d64995497cac
8 years ago
Yi Zhao 0be80d2041 Fix some reST field lists in docstrings
This patch updates some docstrings to comply with the reST field
lists syntax.

Change-Id: I1b4469f3c90915cdfd6462c0517f6924b263fef6
8 years ago
Armando Migliaccio e7270d9505 Revert "OVS agent reacts to events instead of polling"
This might be associated to manifestation of bug #1514935

This reverts commit 1992d52d63.

Closes-Bug: #1514935
Change-Id: If01cc87b6735e1bc039f99c4c6121e7c5ce547d0
8 years ago
rossella 1992d52d63 OVS agent reacts to events instead of polling
OVSDB monitor generates the events that the OVS agent
needs to process (device added or updated). Instead of
polling the agent processes the queue of events.

Change-Id: I168a3cc3aa96a809153a30635ad7bda29e8ee47c
Partially-Implements: blueprint restructure-l2-agent
8 years ago
Gary Kotton 6af52340ff Fix usage of mutable object as default value
Commit 0a300a2277 added a bad parameter.
Please see

Change-Id: I0550c4c86774f8761287c596350f7461fec05fe4
8 years ago
Paul Ward 0a300a2277 Better tolerate deleted OVS ports in OVS agent
This change will not force a resync in the case where a virtual machine is
deleted, and therefore its OVS port deleted, in between the time an RPC
call was made to get the devices and where we make the call to correlate
those devices to vif ports.

Change-Id: Ie55eb69ad7ee177f0cf8ee8fc7fc585fbd0d4a22
Closes-Bug: #1499488
8 years ago
Jenkins 7ab3f53777 Merge "OVSAgentTestFramework: Remove _bind_ports" 8 years ago