neutron/neutron
Rodolfo Alonso Hernandez 6615f248e2 [OVS][FW] Remote SG IDs left behind when a SG is removed
When any port in the OVS agent is using a security groups (SG) and
this SG is removed, is marked to be deleted. This deletion process
is done in [1].

The SG deletion process consists on removing any reference of this SG
from the firewall and the SG port map. The firewall removes this SG in
[2].

The information of a SG is stored in:
* ConjIPFlowManager.conj_id_map = ConjIdMap(). This class stores the
  conjunction IDS (conj_ids) in a dictionary using the following keys:

    ConjIdMap.id_map[(sg_id, remote_sg_id, direction, ethertype,
      conj_ids)] = conj_id_XXX

* ConjIPFlowManager.conj_ids is a nested dictionary, built in the
  following way:

    self.conj_ids[vlan_tag][(direction, ethertype)][remote_sg_id] = \
      set([conj_id_1, conj_id_2, ...])

This patch stores all conjuntion IDs generated and assigned to the
tuple (sg_id, remote_sg_id, direction, ethertype). When a SG is
removed, the deletion method will look for this SG in the new storage
variable created, ConjIdMap.id_map_group, and will mark all the
conjuntion IDs related to be removed. That will cleanup those rules
left in the OVS matching:
  action=conjunction(conj_id, 1/2)

[1]118930f03d/neutron/agent/linux/openvswitch_firewall/firewall.py (L731)
[2]118930f03d/neutron/agent/linux/openvswitch_firewall/firewall.py (L399)

Conflicts:
      neutron/tests/unit/agent/linux/openvswitch_firewall/test_firewall.py

Change-Id: I63e446a30cf10e7bcd34a6f0d6ba1711301efcbe
Related-Bug: #1881157
(cherry picked from commit 0eebd002cc)
(cherry picked from commit ed22f7a2ff)
2020-07-31 16:05:11 +00:00
..
agent [OVS][FW] Remote SG IDs left behind when a SG is removed 2020-07-31 16:05:11 +00:00
api Adding LOG statements to debug 1838449 2020-05-08 09:37:37 +02:00
cmd Use pyroute2 for SRIOV VF commands 2020-06-03 11:05:20 +00:00
common Auto-delete dhcp ports on segment delete 2020-07-13 12:43:04 +02:00
conf Add config option ``http_retries`` 2020-07-09 10:11:43 +00:00
core_extensions Switch to new engine facade for QoS 2019-05-28 08:11:35 +00:00
db [OVN] Allow IP allocation with different segments for OVN service ports 2020-07-27 11:53:37 +00:00
debug Remove deprecated 'external_network_bridge' option 2019-03-09 22:07:38 +00:00
extensions Conntrack Helper - Plugin 2019-08-29 10:41:04 +02:00
hacking Remove Neutron LBaaS 2019-09-20 07:46:06 +00:00
ipam Allow first address in an IPv6 subnet as valid unicast 2019-05-21 16:31:18 +00:00
locale Imported Translations from Zanata 2019-11-22 07:43:34 +00:00
notifiers Add config option ``http_retries`` 2020-07-09 10:11:43 +00:00
objects [OVN] Allow IP allocation with different segments for OVN service ports 2020-07-27 11:53:37 +00:00
pecan_wsgi Set DB retry for quota_enforcement pecan_wsgi hook 2019-11-24 09:55:14 +00:00
plugins Ensure drop flows on br-int at agent startup for DVR too 2020-07-22 07:31:13 +00:00
privileged Use pyroute2 for SRIOV VF commands 2020-06-03 11:05:20 +00:00
quota Set DB retry for quota_enforcement pecan_wsgi hook 2019-11-24 09:55:14 +00:00
scheduler Start enforcing E125 flake8 directive 2019-07-19 23:39:41 -04:00
server Re-use existing ProcessLauncher from wsgi in RPC workers 2020-02-19 07:58:41 +00:00
services Optionally use admin powers when deleting DNS records 2020-07-13 11:31:50 +00:00
tests [OVS][FW] Remote SG IDs left behind when a SG is removed 2020-07-31 16:05:11 +00:00
__init__.py Fix incorrect usage of '# flake8: noqa' 2018-10-29 15:27:50 -04:00
_i18n.py Make code follow log translation guideline 2017-08-14 02:01:48 +00:00
auth.py Use oslo.context class method to construct context object 2017-03-23 09:02:46 +00:00
manager.py Define dhcp_agents_per_network with min=1 2019-05-15 14:08:21 -04:00
neutron_plugin_base_v2.py Do not load default service plugins if core plugin is not DB based 2017-11-09 20:34:52 +00:00
opts.py Conntrack Helper - Plugin 2019-08-29 10:41:04 +02:00
policy.py List SG rules which belongs to tenant's SG 2019-12-04 20:44:05 +00:00
service.py Re-use existing ProcessLauncher from wsgi in RPC workers 2020-02-19 07:58:41 +00:00
version.py
worker.py Change process name of neutron-server to match worker role 2019-03-01 14:18:09 -05:00
wsgi.py Re-use existing ProcessLauncher from wsgi in RPC workers 2020-02-19 07:58:41 +00:00