[Bug 1877797] Re: Neutron remote security group does not work in UCA Rocky and Stein - fixed upstream

[James Page]

This bug was fixed in the package neutron - 2:15.0.2-0ubuntu1.1~cloud0
---------------

 neutron (2:15.0.2-0ubuntu1.1~cloud0) bionic-train; urgency=medium
 .
   * New update for the Ubuntu Cloud Archive.
 .
 neutron (2:15.0.2-0ubuntu1.1) eoan; urgency=medium
 .
   * d/p/lp1877797.patch: Cherry pick fix to resolve issues with
     remote security groups when used with the OVS firewall driver
     (LP: #1877797).


** Changed in: cloud-archive/train
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to neutron in Ubuntu.
https://bugs.launchpad.net/bugs/1877797

Title:
  Neutron remote security group does not work in UCA Rocky and Stein -
  fixed upstream

Status in Ubuntu Cloud Archive:
  Fix Released
Status in Ubuntu Cloud Archive rocky series:
  Fix Committed
Status in Ubuntu Cloud Archive stein series:
  Fix Released
Status in Ubuntu Cloud Archive train series:
  Fix Released
Status in Ubuntu Cloud Archive ussuri series:
  Fix Released
Status in neutron package in Ubuntu:
  Fix Released
Status in neutron source package in Eoan:
  Fix Released
Status in neutron source package in Focal:
  Fix Released
Status in neutron source package in Groovy:
  Fix Released

Bug description:
  [Impact]
  OpenStack deployments using the OVS firewall driver are broken when remote security groups are used due to a regression caused by bug 1854131.

  [Test Case]
  Deploy OpenStack (using charms)
  Follow reproduction steps as detailed in bug 1862703
  # create bastion-sec-grp to allow ssh from anywhere
  openstack security group create bastion-sec-grp
  openstack security group rule create --ethertype=IPv4 --protocol tcp --remote-ip 0.0.0.0/0 --ingress --dst-port=22 bastion-sec-grp

  # create application-sec-grp
  openstack security group create application-sec-grp

  # Allow ssh to egress from the bastion group to the application group
  openstack security group rule create --ethertype=IPv4 --protocol tcp --remote-group application-sec-grp --egress --dst-port=22 bastion-sec-grp

  # Allow ssh to ingress to the application group from the bastion group
  openstack security group rule create --ethertype=IPv4 --protocol tcp --remote-group bastion-sec-grp --ingress --dst-port=22 application-sec-grp

  # create servers and associate with security groups
  openstack server create --wait --image rhel7 --flavor small --security-group bastion-sec-grp bastion-server
  openstack server create --wait --image rhel7 --flavor small --security-group application-sec-grp application-server

  After boot, bastion-server and application-server are landed on
  different HVs and we can ssh to bastion-server but cannot ssh to
  application-server from there. Neutron debug log from application-
  server's HV shows:

  2020-02-05 22:57:05,825 DEBUG
  [neutron.agent.linux.openvswitch_firewall.firewall]
  /opt/openstack/venv/neutron/lib/python2.7/site-
  packages/neutron/agent/linux/openvswitch_firewall/firewall.py:_build_addr_conj_id_map:297
  No member for SG <BASTION_SEC_GRP_ID>

  [Regression Potential]
  Low - the fix is upstream across multiple releases and resolves a previous regression in functionality.

  [Original Bug Report]
  Remote security groups are broken in the UCA Rocky and Stein versions of Neutron.

  The broken patch was introduced in LP #1854131 and fixed in LP
  #1862703.

  The relevant fixed has landed in Neutron 13.0.7 for Rocky¹.

  The relevant fixed landed in Neutron 14.1.0-37 for Stein²,
  alternatively the specific fix is available here:

  https://github.com/openstack/neutron/commit/4193c6ca0e0165a2bcc7a11eee775df15019e755

  The Queens version of Neutron currently in UCA (12.1.0) doesn't appear
  to have the bad patch from #1854131 in it.

  We ran into this while upgrading a customer cloud and it caused
  several hours of VM connectivity downtime while we diagnosed it.
  Please upgrade Neutron in the Ubuntu Cloud Archive to have this fix
  available for at least Rocky and Stein.

  I realise Rocky is no longer supported, but given that the supported
  upgrade path from Queens is via Rocky, I think it needs fixed there
  too.

  ¹ https://docs.openstack.org/releasenotes/neutron/rocky.html
  ² https://docs.openstack.org/releasenotes/neutron/stein.html

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1877797/+subscriptions