[Bug 1813007] Re: [SRU] Unable to install new flows on compute nodes when having broken security group rules

Timo Aaltonen tjaalton at ubuntu.com
Fri Mar 29 10:21:49 UTC 2019


Hello Diko, or anyone else affected,

Accepted neutron into cosmic-proposed. The package will build now and be
available at
https://launchpad.net/ubuntu/+source/neutron/2:13.0.2-0ubuntu3 in a few
hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-cosmic to verification-done-cosmic. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-cosmic. In either case, without details of
your testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: neutron (Ubuntu Cosmic)
       Status: In Progress => Fix Committed

** Tags added: verification-needed verification-needed-cosmic

** Changed in: neutron (Ubuntu Bionic)
       Status: In Progress => Fix Committed

** Tags added: verification-needed-bionic

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to neutron in Ubuntu.
https://bugs.launchpad.net/bugs/1813007

Title:
  [SRU] Unable to install new flows on compute nodes when having broken
  security group rules

Status in Ubuntu Cloud Archive:
  In Progress
Status in Ubuntu Cloud Archive pike series:
  Fix Committed
Status in Ubuntu Cloud Archive queens series:
  In Progress
Status in Ubuntu Cloud Archive rocky series:
  In Progress
Status in Ubuntu Cloud Archive stein series:
  In Progress
Status in neutron:
  Fix Released
Status in OpenStack Security Advisory:
  Incomplete
Status in neutron package in Ubuntu:
  In Progress
Status in neutron source package in Bionic:
  Fix Committed
Status in neutron source package in Cosmic:
  Fix Committed
Status in neutron source package in Disco:
  In Progress

Bug description:
  It appears that we have found that neutron-openvswitch-agent appears to have a bug where two security group rules that have two different port ranges that overlap tied to the same parent security group will cause neutron to not be able to configure networks on the compute nodes where those security groups are present.
  Those are the broken security rules: https://pastebin.canonical.com/p/wSy8RSXt85/
  Here is the log when we discovered the issue: https://pastebin.canonical.com/p/wvFKjNWydr/

  
  Ubuntu SRU Details
  ------------------
  [Impact]
  Neutron openvswitch agent crashes due to creation of two security groups that both use the same remote security group, where the first group doesn't define a port range and the second one does (one is a subset of the other; specifying no port range is the same as a full port range).

  [Test case]
  See comment #18 below.

  [Regression Potential]
  The fix is fairly minimal and has landed upstream in master branch. It has therefore passed all unit and function tests that get run in the upstream gate and has been reviewed by upstream neutron core reviewers. This all helps to minimize the regression potential.

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1813007/+subscriptions



More information about the Ubuntu-openstack-bugs mailing list