neutron/neutron/agent
Rodolfo Alonso Hernandez aaf87aeb55 [OVS][FW] Remote SG IDs left behind when a SG is removed
When any port in the OVS agent is using a security groups (SG) and
this SG is removed, is marked to be deleted. This deletion process
is done in [1].

The SG deletion process consists on removing any reference of this SG
from the firewall and the SG port map. The firewall removes this SG in
[2].

The information of a SG is stored in:
* ConjIPFlowManager.conj_id_map = ConjIdMap(). This class stores the
  conjunction IDS (conj_ids) in a dictionary using the following keys:

    ConjIdMap.id_map[(sg_id, remote_sg_id, direction, ethertype,
      conj_ids)] = conj_id_XXX

* ConjIPFlowManager.conj_ids is a nested dictionary, built in the
  following way:

    self.conj_ids[vlan_tag][(direction, ethertype)][remote_sg_id] = \
      set([conj_id_1, conj_id_2, ...])

This patch stores all conjuntion IDs generated and assigned to the
tuple (sg_id, remote_sg_id, direction, ethertype). When a SG is
removed, the deletion method will look for this SG in the new storage
variable created, ConjIdMap.id_map_group, and will mark all the
conjuntion IDs related to be removed. That will cleanup those rules
left in the OVS matching:
  action=conjunction(conj_id, 1/2)

[1]118930f03d/neutron/agent/linux/openvswitch_firewall/firewall.py (L731)
[2]118930f03d/neutron/agent/linux/openvswitch_firewall/firewall.py (L399)

Conflicts:
      neutron/tests/unit/agent/linux/openvswitch_firewall/test_firewall.py

Change-Id: I63e446a30cf10e7bcd34a6f0d6ba1711301efcbe
Related-Bug: #1881157
(cherry picked from commit 0eebd002cc)
(cherry picked from commit ed22f7a2ff)
(cherry picked from commit 6615f248e2)
2020-08-21 09:55:56 +00:00
..
common Merge "Add "igmp_snooping_enable" config option for OVS agent" into stable/stein 2020-07-15 16:12:37 +00:00
dhcp Prioritize port create and update ready messages 2020-04-06 16:49:22 -04:00
l2 Fix pep8 E128 warnings in non-test code 2019-03-12 21:22:33 +00:00
l3 [stable only] Configure logging in keepalived_state_change 2020-07-14 17:40:07 +00:00
linux [OVS][FW] Remote SG IDs left behind when a SG is removed 2020-08-21 09:55:56 +00:00
metadata Remove extra header fields in proxied metadata requests 2020-03-03 20:11:30 +00:00
ovsdb Add debug information in BridgeCreateEvent 2018-12-06 10:08:51 +00:00
windows remove neutron.common.exceptions 2019-02-01 14:35:00 -07:00
__init__.py Empty files should not contain copyright or license 2014-10-20 00:50:32 +00:00
_topics.py Add binding_deactivate method to Linux bridge agent 2018-07-14 16:46:01 -05:00
agent_extensions_manager.py Make code follow log translation guideline 2017-08-14 02:01:48 +00:00
dhcp_agent.py Enable mutable config in Neutron 2018-03-21 20:35:19 +00:00
firewall.py use EGRESS_DIRECTION and INGRESS_DIRECTION from neutron-lib 2018-02-23 10:36:36 -07:00
l3_agent.py Enable mutable config in Neutron 2018-03-21 20:35:19 +00:00
metadata_agent.py Remove deprecated cache_url 2017-11-10 00:47:19 -05:00
resource_cache.py Ignore first local port update notification 2019-07-10 18:15:07 +00:00
rpc.py Ignore first local port update notification 2019-07-10 18:15:07 +00:00
securitygroups_rpc.py Add accepted egress direct flow 2020-02-28 20:58:21 +08:00