[Build 12]:Ubuntu:SG: inconsistent traffic flow behavior with only ingress and only egress rule on diff VMs
Affects | Status | Importance | Assigned to | Milestone | ||
---|---|---|---|---|---|---|
Juniper Openstack | Status tracked in Trunk | |||||
R1.1 |
Won't Fix
|
High
|
Naveen N | |||
Trunk |
New
|
Medium
|
Naveen N |
Bug Description
test steps:
1. create 2 security groups "onlyEgress"(allow all egress) and "onlyIngress"(allow all ingress).
2. have 2 VNs, each having 1 VM. (say vm1-vn1 and vm1-vn2)
3. attach SG onlyEgress to vm1-vn2 and SG onlyIngress to vm1-vn1.
4. ping from vm1-vn1 to vm1-vn2 and vice versa.
expected result:
traffic vm1-vn2 ------> vm1-vn1 should be allowed
traffic vm1-vn1 ------> vm1-vn2 should be denied
but sometime traffic is ALLOWED from both sides and sometime both way traffic is DENIED.
Naveen has debugged the issue and as per his comments its because of same icmp id alloted in traffic from both side.
setup info:
env.roledefs = {
'all': [host1,
'cfgm': [host1,
'openstack'
'control': [host2,host1],
'compute': [host3,host4],
'collector': [host2,host1],
'webui': [host1],
'database': [host1,host2],
'build': [host_build],
}
env.hostnames = {
'all': ['nodeh1', 'nodeg18', 'nodeh8', 'nodec11', 'nodec12']
}
tags: |
added: security-groups sg-rules vnsw-agent removed: groups rules security sg |
Changed in juniperopenstack: | |
importance: | Undecided → High |
Changed in juniperopenstack: | |
milestone: | none → r1.06-fcs |
Changed in juniperopenstack: | |
milestone: | r1.06-fcs → r1.10-fcs |
Changed in juniperopenstack: | |
assignee: | nobody → N.Naveen (nnaveen-cse) |
assignee: | N.Naveen (nnaveen-cse) → Naveen N (naveenn) |
information type: | Private Security → Public |
tags: | added: note release |
tags: |
added: releasenote removed: note release |
tags: | removed: releasenote |
1> Vrouter uses ICMP id as part of flow key.
2> If ping is initiated between two VMs from both sides, and if they use same ICMP id, then there will be flow key
collision, instead of creating two forward and two reverse flow, vrouter ends up creating only
one forward and one reverse flow.
In the problematic scenario
* VM1 to VM2 traffic was allowed
* VM2 to VM1 traffic was denied.
Ping started from VM2 to VM1 using ICMP id X, traffic was denied as per SG rule
PIng was started from VM1 to VM2 using same ICMP id X, vrouter evaluated SG rule and
set the action as forward. And traffic started passing from both direction.