neutron/neutron/agent/linux/openvswitch_firewall
Rodolfo Alonso Hernandez abeda5aece [OVS][FW] Remote SG IDs left behind when a SG is removed
When any port in the OVS agent is using a security groups (SG) and
this SG is removed, is marked to be deleted. This deletion process
is done in [1].

The SG deletion process consists on removing any reference of this SG
from the firewall and the SG port map. The firewall removes this SG in
[2].

The information of a SG is stored in:
* ConjIPFlowManager.conj_id_map = ConjIdMap(). This class stores the
  conjunction IDS (conj_ids) in a dictionary using the following keys:

    ConjIdMap.id_map[(sg_id, remote_sg_id, direction, ethertype,
      conj_ids)] = conj_id_XXX

* ConjIPFlowManager.conj_ids is a nested dictionary, built in the
  following way:

    self.conj_ids[vlan_tag][(direction, ethertype)][remote_sg_id] = \
      set([conj_id_1, conj_id_2, ...])

This patch stores all conjuntion IDs generated and assigned to the
tuple (sg_id, remote_sg_id, direction, ethertype). When a SG is
removed, the deletion method will look for this SG in the new storage
variable created, ConjIdMap.id_map_group, and will mark all the
conjuntion IDs related to be removed. That will cleanup those rules
left in the OVS matching:
  action=conjunction(conj_id, 1/2)

[1]118930f03d/neutron/agent/linux/openvswitch_firewall/firewall.py (L731)
[2]118930f03d/neutron/agent/linux/openvswitch_firewall/firewall.py (L399)

Conflicts:
      neutron/tests/unit/agent/linux/openvswitch_firewall/test_firewall.py

Change-Id: I63e446a30cf10e7bcd34a6f0d6ba1711301efcbe
Related-Bug: #1881157
(cherry picked from commit 0eebd002cc)
(cherry picked from commit ed22f7a2ff)
(cherry picked from commit 6615f248e2)
2020-08-21 09:56:18 +00:00
..
__init__.py Open vSwitch conntrack based firewall driver 2016-02-16 16:47:21 +00:00
constants.py [log] ovs fw logging implementation 2018-01-09 09:26:40 +07:00
exceptions.py ovsfw: Don't create rules if updated port doesn't exist 2018-01-05 16:28:18 +00:00
firewall.py [OVS][FW] Remote SG IDs left behind when a SG is removed 2020-08-21 09:56:18 +00:00
iptables.py fullstack: Migration from iptables_hybrid to openvswitch 2018-04-26 16:44:24 +00:00
rules.py [Security] fix allowed-address-pair 0.0.0.0/0 issue 2020-07-31 11:23:18 +00:00