This repository was archived by the owner on Nov 13, 2023. It is now read-only.
Syncing upstream stable/juno#4
Open
leenheer wants to merge 81 commits into
Open
Conversation
Bump version to next stable release on juno branch, and set defaultbranch in .gitreview for convenience. Change-Id: Ib6bd6b400ae15d5ae1bcb99b11221d58b9acae70
This commit uses EUI64 for SLAAC and stateless IPv6 address when subnet id in fixed_ip is specified. After this patch, all the ports created on a subnet which has ipv6_address_mod=slaac or ipv6_address_mod=dhcpv6-stateless will use EUI64 as the address. This patch also checks if fixed IP address is specified for a IPv6 subnet with address mode slaac or dhcpv6-stateless during creating or updating a port. If yes, raise InvalidInput error to stop the port creation or update. Remove unit test test_generated_duplicate_ip_ipv6 because fixed_ip should not be specified for a slaac subnet. Change-Id: Ie481cfb2f4313baf44bf1a838ebda374a5c74c6a Closes-Bug: 1330826 (cherry picked from commit 3ba0661)
With l2pop enabled, race exists in delete_port_postcommit when both create/update_port and delete_port deal with different ports on the same host, where such ports are either the first (or) last on same network for that host. This race happens outside the DB locking zones in the respective methods of ML2 plugin. To fix this, we have moved determination of fdb_entries back to delete_port_postcommit and removed delete_port_precommit altogether from l2pop mechanism driver. In order to accomodate dvr interfaces, we are storing and re-using the mechanism-driver context which hold dvr-port-binding information while invoking delete_port_postcommit. We loop through dvr interface bindings invoking delete_port_postcommit similar to delete_port_precommit. Closes-Bug: #1372438 Change-Id: If0502f57382441fdb4510c81a89794f57a38e696 (cherry picked from commit 3cd2163)
This patch removes the step of clearing the consistency hash from the DB before a topology sync. This will ensure that inconsistency will be detected if the topology sync fails. This logic was originally there to make sure the hash header was not present on the topology sync call to the backend. However, the hash header is ignored by the backend in a sync call so it wasn't necessary. Closes-Bug: #1379510 Change-Id: I2d58fa2aea3b692834d64192d06ace727c7df8a0 (cherry picked from commit 24e4110)
Remove the vm network delete call to the VSM on final port call and ensure that vm network is deleted from the database when the port count becomes 0. Change-Id: I6c08a099adfce2fdba8eefec6aadeb68a780ac37 Closes-Bug: 1373547 (cherry picked from commit 4e1c4cb)
Within ovs agent daemon loop, prepare_devices_filter will impose heavy workloads to neutron server in order to retrieve the security groups message to apply firewall rules. If agent is configured to use Noopfirewall driver or security groups are disabled, there is no need for loading the rules from server and refreshing the firewalls. This will reduce the number of db calls and improve performance for neutron server in this case. Change-Id: Id244aab3cac37fc6ed3dc05cbee91cdf9e34d9cc Closes-Bug: #1365806 (cherry picked from commit 524981c)
The _select_ips_for_remote_group method was joining the IP allocation, port, allowed address pair, and security group tables together in a single query. Additionally, it was loading all of the port columns and using none of them. This resulted in a very expensive query with no benefit. This patch eliminates the unnecessary use of the port table by joining the IP allocation table directly to the security groups and allowed address pairs tables. In local testing of the method, this sped it up by an order of magnitude. Closes-Bug: #1373851 Change-Id: I12899413004838d2d22b691f1e2f3b18f7ec2c27 (cherry picked from commit 04df85b)
Only query the DB for relevant columns instead of all of the port columns. Partial-Bug: #1373851 Change-Id: I32cd4a0bc6799ce77cea13188676308e3e641d19 (cherry picked from commit 8d430a7)
Change a query to only retrieve the port_id instead of every column from the row of security group binding info. Partial-Bug: #1373851 Change-Id: I0fba9c9623898ee52590207ebbb728503bb59a5b (cherry picked from commit 6acadab)
This patch makes sure that while updating network profile to add new tenants, it does not delete the older profile bindings and maintains them, while adds only the new tenant ids to the bindings. Change-Id: I862eb1c400e022334a2f6a4078425448bb144843 Closes-bug: #1379609 (cherry picked from commit c97069d)
Switch to TLSv1 for the connections to the backend controllers. The default SSLv3 is no longer considered secure. TLSv1 was chosen over .1 or .2 because the .1 and .2 weren't added until python 2.7.9 so TLSv1 is the only compatible option for py26. Closes-Bug: #1384487 Change-Id: I68bd72fc4d90a102003d9ce48c47a4a6a3dd6e03 (cherry picked from commit 6258895)
This patch prevents the L3 _update_router_db method from starting a transaction before calling the gateway interface removal functions. With these port changes now occuring outside of the L3 DB transaction, a failure to update the router DB information will not rollback the port deletion operation. The 'VPN in use' check had to be moved inside of the DB deletion transaction now that there isn't an enclosing transaction to undo the delete when an 'in use' error is raised. ===Details=== The router update db method starts a transaction and calls the gateway update method with the transaction held open. This becomes a problem when the update results in an interface removal which uses a port table lock. Because the delete_port caller is still holding open a transaction, other sessions are blocked from getting an SQL lock on the same tables when delete_port starts performing RPC notifications, external controller calls, etc. During those external calls, eventlet will yield and another thread may try to get a lock on the port table, causing the infamous mysql/eventlet deadlock. This separation of L2/L3 transactions is similiar to change I3ae7bb269df9b9dcef94f48f13f1bde1e4106a80 in nature. Even though there is a loss in the atomic behavior of the interface removal operation, it was arguably incorrect to begin with. The restoration of port DB records during a rollback after some other failure doesn't undo the backend operations (e.g. REST calls) that happened during the original deletion. So, having a delete rollback without corresponding 'create_port' calls to the backend causes a loss in consistency. Conflicts: neutron/db/l3_db.py Closes-Bug: #1377241 Change-Id: I5fdb6b24bf2fb80ac5e36a742aa7056db72c8c7d (cherry picked from commit f23f2ec)
Previously, the NSX plugin prevented one from creating multiple networks on the same vlan even if they were being created on different physical_networks. This patch corrects this issue and allows this to now occur. Closes-bug: 1367034 Change-Id: I343449648304328dffdd5ba070491e05686ee22d (cherry picked from commit 6d1f864)
…et" into stable/juno
There is a bug in dhcp agent code that when first port is created in an IPv6 subnet, DHCP port is not automatically created. This fix resolves this problem by removing the IP version check in configure_dhcp_for_network method. Change-Id: If3f405d367a7099d9f33d72d11ffcb7a393abe23 Closes-Bug: #1367500 (cherry picked from commit 1b66e11)
…ete" into stable/juno
The ssl.get_server_certificate method uses SSLv3 by default. Support for SSLv3 was dropped on the backend controller in response to the POODLE vulnerability. This patch fixes it to use TLSv1 like the wrap_socket method. Closes-Bug: #1384487 Change-Id: I9cb5f219d327d62168bef2d7dbee22534b2e454e (cherry picked from commit 77e283c)
The security groups RPC handler calls get_port_from_device individually for each device in a list it receives. Each one of these results in a separate SQL query for the security groups and port details. This becomes very inefficient as the number of devices on a single node increases. This patch adds logic to the RPC handler to see if the core plugin has a method to lookup all of the device IDs at once. If so, it uses that method, otherwise it continues as normal. The ML2 plugin is modified to include the batch function, which uses one SQL query regardless of the number of devices. Closes-Bug: #1374556 Change-Id: I15d19c22e8c44577db190309b6636a3251a9c66a (cherry picked from commit abc16eb)
Remove time.sleep method reference in class and use time.sleep directly. Change-Id: Ib4c02061b29c0d584d603746a78ab50922f781c3 Closes-Bug: 1375698 (cherry picked from commit 8e36ba8)
While plugging vif, VIFDriver in Nova follows "ovs_hybrid_plug" and "port_filter" in "binding:vif_detail" which is passed from Neutron, but those are always true. This patch make ML2 OVS mech driver set those param depends on enable_security_group flag. It enables users to avoid ovs_hybrid plugging. This patch also fixes the same issue in the following plugins/drivers: * NEC Plugin * BigSwitch Plugin * Ryu Plugin * ML2 Plugin - OFAgent Mech Driver Closes-Bug: #1336624 Change-Id: I2b7fb526a6f1b730ad65289307b24fd28b996e1b (cherry picked from commit e73f8da)
This patch will allow an IPv6 subnet configured with SLAAC (or dhcpv6-stateless) to be attached to a router interface. Closes-Bug: #1382076 Change-Id: If0c48a7287a828eef4a0f0b0859d4f898d2937bd (cherry picked from commit 95accb5)
This commit stops ignoring 400 (Bad Request) HTTP codes returned by ODL in create and update operations. It also modifies sendjson() because it doesn't ignore any HTTP error code now. Change-Id: Id0db2c0c1d8fddfbd16b3ce9476a2358e2ef1e49 Closes-Bug: #1369239 (cherry picked from commit f1507d0)
Update HA Network creation to use an admin context to allow Neutron
to create the tenant-less network required for the HA router when
it does not yet exist and is being created by a non-admin user.
Neutron creates these resources without a tenant so users cannot see
or modify the HA network, ports, etc. Port creation and association
already use elivated admin contexts to allow their function when
an user attempts to create a HA L3 router.
Conflicts:
neutron/tests/unit/db/test_l3_ha_db.py
Change-Id: I36166158a0970b8d08d6702054b11a43fb684281
Closes-Bug: #1388716
(cherry picked from commit cc9bc24)
The openvswitch core plugin has been removed but not its associated "neutron.core_plugins" entry point. This change removes it from setup.cfg. Change-Id: I79f7c334cdeb0f4d0d68743734f69c0ec8523467 Related-Bug: #1323729 Closes-Bug: #1391326 (cherry picked from commit f36c299)
The current version of elevated method sets for the original context the admin role too. This change fix this. Added unittest. Closes-bug: #1386932 Change-Id: Ife881112efa151e53bfa4b7af35643dcf2d1114f (cherry picked from commit 98fae47)
With the current Neutron implementation, a subnet cannot be deleted until all associated IP addresses have been remove from ports (via port update) or the associated ports/VMs have been deleted. In the case of SLAAC-enabled subnets, however, it's not feasible to require removal of SLAAC-generated addresses individually from each associated port before deleting a subnet because of the multicast nature of RA messages. For SLAAC-enabled subnets, the processing of subnet delete requests needs to be changed so that these subnets will be allowed to be deleted, and all ports get disassociated from their corresponding SLAAC IP address, when there are ports existing on the SLAAC subnet. Change-Id: I281f5a1553248e09174dc49d0a42aef4b5c44bee Closes-Bug: 1393435 (cherry picked from commit ce5e957)
A list with the full range of vxlan VNIs (1 to 2**24) was using over 300MB of memory. This patch uses xrange instead of range. Closes-Bug: #1393362 Change-Id: I21ccab758e7911712690fd5e732f64361e809264 (cherry picked from commit 0bf69ad)
PostgreSQL is more sensitive for types than MySQL when it selects something from columns in database. So it fails when it tries to select from string field comparing with integer value. Added unit test to verify conversion of protocol numbers to strings. Closes-bug:#1381379 (cherry picked from commit bc34f26) Conflicts: neutron/tests/unit/test_extension_security_group.py Change-Id: I0a29595403a07c66888871088d5549705a097f68
Commit 1b66e11 introduces a new problem that metadata proxy will not be started when an isolated network contains ipv6 subnet with dhcp enabled and a ipv4 subnet. This fix separates the checks to enable dhcp and enable metadata so metadata proxy can be started if there is ipv4 subnet exists in the network with metadata enabled. Change-Id: If26806083db225e9ab30d75fa6c728ce99a7cafe Closes-Bug: 1392564 (cherry picked from commit 4c128c3)
A CIDR in allowed address pairs would screw up the calculation of remote security group member IP addresses due to a call that assumed each entry was an IP. This patch fixes that an adds a remote security group reference to the address pairs SG test case to exercise this code-path. Closes-Bug: #1382562 Change-Id: I2676f4b56bce7449579d67fb221b3edb7b885103 (cherry picked from commit a1e78b2)
A recent change[1] allowed subnets to be deleted even if they had active IPv6 SLAAC allocations on them. The updated check was inefficient because it would check every port in the subnet even if the subnet was a SLAAC subnet. This patch just shortcuts out that check. 1. I281f5a1553248e09174dc49d0a42aef4b5c44bee Change-Id: I2c35495b3642c644e4758f28ccddcc076139ec3b (cherry picked from commit b3a44c2)
…assoc" into stable/juno
Change-Id: I72045d8a7b5abbd6ad6b9a01f9a5fa653c37b464
Change-Id: I4959b7d76e9a6e33e1ac6eab88675b8218e5a353
Alembic 0.7.1 is adding new diff directives add_fk and remove_fk. The logic in execute_alembic_command() appears to assume all potential commands are present in METHODS. This patch adjusts it so that it checks METHODS first, allowing the tests in neutron.tests.unit.db.test_migration to pass. However, if the design here requires that all potential Alembic commands are handled, then this would not be the fix, though I recommend that the potential list of Alembic directives not be hardcoded. Change-Id: Ib08685be252e1fdb0f10853f8fc9a7e19ac54a94 Closes-Bug: #1397796 (cherry picked from commit 6a9d112)
Fixes the hostname validation to align with the RFC's demands[1]. This was done by replacing the full regex with a function that broke the FQDN into individual components that were easier to reason about with regular expressions. Also added several test cases for domains so if someone wants to convert it back to pure regex there will be better test vectors. 1. RFC 1123 says an all-digit hostname is allowed in section 2.1. It says that this more liberal syntax MUST be supported. Conflicts: neutron/tests/unit/test_attributes.py Closes-Bug: #1396932 Change-Id: I003cf14d95070707e43e40d55da62e11a28dfa4e (cherry picked from commit 35662d0)
Change-Id: Ieded1c4bdc6fd977fcb3131707028616ee184bd9
Change-Id: If016d6f492c2b23d6ce3e77731cd1d9de94a9b18
When DVR is enabled and enable_isolated_metadata=True, the DHCP agent should only inject a metadata host route when there is no port with the gateway IP address configured on the subnet. Add a check for DEVICE_OWNER_DVR_INTERFACE when we look at each port's device_owner field, otherwise it will always add this route to the opts file when DVR is enabled. Change-Id: I3ff3bb85105b8215b36535983016d8c0ff3d8cb7 Closes-bug: #1377307 (cherry picked from commit 2925094)
The following patch: 9569b2f broke the desired functionality of the enable_metadata_network flag, by not allowing the metadata proxy to be spawn for 'metadata networks', which are used for accessing the metadata service when the logical router is not implemented through the l3 agent. This patch enables spawning of the metadata proxy for metadata networks when the appropriate flag is set to True. The patch also adds rather pedant unit test coverage for the should_enable_metadata method which previously had no unit test. Change-Id: I8dca1fce9fbc83e75ba7e4ce948531427bf7e88b Closes-bug: 1394020 (cherry picked from commit c45842a)
Change-Id: I22831dbe79fe30e6932d4df068c7309c025dc8c5
For a SLAAC subnet that is created without specifying the gateway_ip, Neutron currently allocates (If0c48a7287a828eef4a0f0b0859d4f898d2937bd) the gateway_ip at a later stage (i.e., neutron router_interface_add). In order to keep the API consistent between IPv4 and IPv6, it is recommended to allocate the gateway_ip during subnet_create stage itself. Closes-Bug: #1402407 Closes-Bug: #1394112 Partial-Bug: #1377985 Change-Id: I965232930502c21b605fe360bb138bb6ea73d2b0 (cherry picked from commit 66dcb8b)
Change-Id: I0271e5b25934ade786852125b33f13a2b548c3f2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
16 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.