SLAAC and stateless DHCP are not working with stateless SG

Bug #2006949 reported by Slawek Kaplonski
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
neutron
In Progress
Medium
Ihar Hrachyshka

Bug Description

Bug originally found by Alex Katz and reported in the bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2149731

Description of problem:
When a stateless security group is attached to the instance it fails to get an IPv6 address using SLAAC or stateless DHCP. An explicit rule is required to allow ICMPv6 traffic.

Checked with the custom security group (only egress traffic is allowed) as well as with the default security group (egress and ingress from the same SG are allowed).

Version-Release number of selected component (if applicable):
RHOS-17.1-RHEL-9-20221115.n.2
Red Hat Enterprise Linux release 9.1 (Plow)

How reproducible:
100%

Steps to Reproduce:
openstack network create net_dual_slaac
openstack subnet create --subnet-range 10.100.1.0/24 --network net_dual_slaac subnet_dual_slaac
openstack subnet create --subnet-range 2001:0:0:1::0/64 --ip-version 6 --ipv6-ra-mode slaac --ipv6-address-mode slaac --network net_dual_slaac subnet_dual_slaac_ipv6
openstack router create router_test_boot
EXT_NET=`openstack network list --external -f value -c Name`
openstack router set --external-gateway $EXT_NET router_test_boot
openstack router add subnet router_test_boot subnet_dual_slaac
openstack security group create --stateless test_sg
openstack server create --image <IMG> --flavor <FLAV> --network net_dual_slaac --security-group test_sg vm_1

Actual results:
only IPv4 address appear on the instance

Expected results:
IPv6 address is expected

Additional info:
can be worked around by adding icmpv6 rule:
# openstack security group rule create --ingress --protocol icmpv6 test_sg

Changed in neutron:
assignee: nobody → Ihar Hrachyshka (ihar-hrachyshka)
tags: added: ovn sg-fw
tags: added: l3-ipam-dhcp
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/877049

Changed in neutron:
status: Confirmed → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to neutron-lib (master)

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron-lib/+/878947

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to neutron-lib (master)

Reviewed: https://review.opendev.org/c/openstack/neutron-lib/+/878947
Committed: https://opendev.org/openstack/neutron-lib/commit/83375805618c1e7feb3e16070eeab6794e261dc0
Submitter: "Zuul (22348)"
Branch: master

commit 83375805618c1e7feb3e16070eeab6794e261dc0
Author: Ihar Hrachyshka <email address hidden>
Date: Wed Mar 29 16:22:36 2023 -0400

    api-ref: describe which protocols are enabled for stateless SG

    This behavior matches what ML2/OVS implementation does and what we
    intend to implement for ML2/OVN. More than that, a decision was made
    during vPTG to make the behavior part of api-ref to facilitate
    cross-backend consistency.

    Related-Bug: #2006949
    Related-Bug: #2009053
    Change-Id: Ic633eedd9f0d320d9ad0c27a72f07b1b016d7ba3

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on neutron (master)

Change abandoned by "Ihar Hrachyshka <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/876658
Reason: This patch is no longer needed because we'll enable basic ipv6 services in core OVN controller code, not in neutron.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Change abandoned by "Ihar Hrachyshka <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/877049
Reason: This patch is not needed because we'll enable the protocols in core OVN controller code, not neutron.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.