neutron/neutron/agent/linux
Rodolfo Alonso Hernandez 6615f248e2 [OVS][FW] Remote SG IDs left behind when a SG is removed
When any port in the OVS agent is using a security groups (SG) and
this SG is removed, is marked to be deleted. This deletion process
is done in [1].

The SG deletion process consists on removing any reference of this SG
from the firewall and the SG port map. The firewall removes this SG in
[2].

The information of a SG is stored in:
* ConjIPFlowManager.conj_id_map = ConjIdMap(). This class stores the
  conjunction IDS (conj_ids) in a dictionary using the following keys:

    ConjIdMap.id_map[(sg_id, remote_sg_id, direction, ethertype,
      conj_ids)] = conj_id_XXX

* ConjIPFlowManager.conj_ids is a nested dictionary, built in the
  following way:

    self.conj_ids[vlan_tag][(direction, ethertype)][remote_sg_id] = \
      set([conj_id_1, conj_id_2, ...])

This patch stores all conjuntion IDs generated and assigned to the
tuple (sg_id, remote_sg_id, direction, ethertype). When a SG is
removed, the deletion method will look for this SG in the new storage
variable created, ConjIdMap.id_map_group, and will mark all the
conjuntion IDs related to be removed. That will cleanup those rules
left in the OVS matching:
  action=conjunction(conj_id, 1/2)

[1]118930f03d/neutron/agent/linux/openvswitch_firewall/firewall.py (L731)
[2]118930f03d/neutron/agent/linux/openvswitch_firewall/firewall.py (L399)

Conflicts:
      neutron/tests/unit/agent/linux/openvswitch_firewall/test_firewall.py

Change-Id: I63e446a30cf10e7bcd34a6f0d6ba1711301efcbe
Related-Bug: #1881157
(cherry picked from commit 0eebd002cc)
(cherry picked from commit ed22f7a2ff)
2020-07-31 16:05:11 +00:00
..
openvswitch_firewall [OVS][FW] Remote SG IDs left behind when a SG is removed 2020-07-31 16:05:11 +00:00
__init__.py Empty files should not contain copyright or license 2014-10-20 00:50:32 +00:00
bridge_lib.py Add namespace support for "bridge" commands 2019-04-29 07:52:18 +00:00
daemon.py Set neutron-keepalived-state-change proctitle 2019-05-23 15:22:35 +08:00
dhcp.py Fixes dnsmasq host file parsing with "addr6_list" 2020-06-22 15:18:37 +00:00
dibbler.py use PROVISIONAL_IPV6_PD_PREFIX from neutron-lib 2017-11-14 12:26:43 -07:00
ethtool.py Workaround for TCP checksum issue with ovs-dpdk and veth pair 2020-06-29 12:56:39 -05:00
external_process.py Check dnsmasq process is active when spawned 2019-10-30 12:23:56 +00:00
interface.py Merge "Workaround for TCP checksum issue with ovs-dpdk and veth pair" into stable/train 2020-07-01 03:10:18 +00:00
ip_conntrack.py Merge "Use '-p ip' instead of '-p 0' with conntrack" 2019-04-12 13:02:24 +00:00
ip_lib.py Use pyroute2 for SRIOV VF commands 2020-06-03 11:05:20 +00:00
ipset_manager.py Parametrize ipset locking with network namespace 2019-04-24 20:05:28 +00:00
iptables_comments.py Iptables firewall driver adds forward rules for trusted ports 2018-03-06 10:13:44 +01:00
iptables_firewall.py Canonicalize IPv6 ICMP protocol name in security groups 2019-05-24 20:05:48 -05:00
iptables_manager.py Merge "Do not initialize the iptables nat table in the dhcp-agent" 2019-04-26 06:42:34 +00:00
keepalived.py [L3 HA] Add "no_track" option to VIPs in keepalived config 2020-04-23 07:14:25 +00:00
l3_tc_lib.py Use Pyroute2 "add_tc_qdisc" function in l3_tc_lib 2019-07-05 08:13:07 +00:00
pd.py remove neutron.common.constants 2019-04-04 14:10:26 -06:00
pd_driver.py use PROVISIONAL_IPV6_PD_PREFIX from neutron-lib 2017-11-14 12:26:43 -07:00
ra.py Add radvd_user config option 2019-10-25 08:14:45 +00:00
tc_lib.py Fix the wrong value for QoS rate conversion to bytes/s 2020-06-24 17:22:02 +00:00
utils.py Fix race condition when getting cmdline 2019-09-18 21:32:33 -04:00
xenapi_root_helper.py Fix bandit warning 2019-05-10 08:38:34 -04:00