libvirt error when create VM with 2 NICs under DevStack

I found the problem in another bug report. See https://bugs.launchpad.net/neutron/+bug/1186557

Actually since this is a nova problem and not neutron issue, I'll elaborate on the problem here.

The problem is in nova/virt/libvirt/firewall.py (Grizzly):

allow_dhcp = False
for (network, mapping) in network_info:
    if mapping['dhcp_server']:
        allow_dhcp = True
        break

Looping through each network, if any of them happens to have dhcp_server, then it is setting them for ALL. Hence you get nova-base for all your vif filters, instead of nova-base for some and nova-nodhcp for others.

Master has the same problem. base_filter is set only once, then it loops through each vif applying the same base_filter, instead of a per-vif base_filter.

base_filter = self.get_base_filter_list(instance, allow_dhcp)

for vif in network_info:
     self._define_filter(self._get_instance_filter_xml(instance,
                                                              base_filter,
                                                              vif))

I revised the function as follows on my grizzly install, which resolved the issue for me:

    def setup_basic_filtering(self, instance, network_info):
        """Set up basic filtering (MAC, IP, and ARP spoofing protection)."""
        LOG.info(_('Called setup_basic_filtering in nwfilter'),
                 instance=instance)

        if self.handle_security_groups:
            # No point in setting up a filter set that we'll be overriding
            # anyway.
            return

        LOG.info(_('Ensuring static filters'), instance=instance)
        self._ensure_static_filters()

        nodhcp_base_filter = self.get_base_filter_list(instance, False)
        dhcp_base_filter = self.get_base_filter_list(instance, True)

        for (network, mapping) in network_info:
            if mapping['dhcp_server']:
                self._define_filter(self._get_instance_filter_xml(instance,
                                                              dhcp_base_filter,
                                                              network,
                                                              mapping))
            else:
                self._define_filter(self._get_instance_filter_xml(instance,
                                                              nodhcp_base_filter,
                                                              network,
                                                              mapping))

Craig,

Can you propose a patch to nova? I don't see any patch context in your last comment, but it seems sane enough to me. Let me know if you are not able to proposed the patch and we'll work something else out.

Hi Carig,

Thanks for pointing the issue.
I also wrote patch for master [1], because the network info model has been changed [2]. It works for me.
I hope this fix merged into mainline and backported to havana.

[1]
diff --git a/nova/virt/libvirt/firewall.py b/nova/virt/libvirt/firewall.py
index 1cbba78..58756db 100644
--- a/nova/virt/libvirt/firewall.py
+++ b/nova/virt/libvirt/firewall.py
@@ -117,20 +117,18 @@ class NWFilterFirewall(base_firewall.FirewallDriver):
         LOG.info(_('Ensuring static filters'), instance=instance)
         self._ensure_static_filters()

- allow_dhcp = False
+ nodhcp_base_filter = self.get_base_filter_list(instance, False)
+ dhcp_base_filter = self.get_base_filter_list(instance, True)
+
         for vif in network_info:
- if not vif['network'] or not vif['network']['subnets']:
- continue
+ _base_filter = nodhcp_base_filter
             for subnet in vif['network']['subnets']:
                 if subnet.get_meta('dhcp_server'):
- allow_dhcp = True
+ _base_filter = dhcp_base_filter
                     break

- base_filter = self.get_base_filter_list(instance, allow_dhcp)
-
- for vif in network_info:
             self._define_filter(self._get_instance_filter_xml(instance,
- base_filter,
+ _base_filter,
                                                               vif))

     def _get_instance_filter_parameters(self, vif):

[2] https://review.openstack.org/#/c/38589/

Ryota Mibu: We use Gerrit for submitting patches for code review. Can you please submit this through OpenStack's Gerrit? You can find more information here: https://wiki.openstack.org/wiki/GerritJenkinsGit

OK. I will submit my patch (with UTs that haven't been wrriten).

Fix proposed to branch: master
Review: https://review.openstack.org/78999

Reviewed: https://review.openstack.org/78999
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=d2874463010b129e62a568357cfa1df3ab4805e6
Submitter: Jenkins
Branch: master

commit d2874463010b129e62a568357cfa1df3ab4805e6
Author: Ryota MIBU <email address hidden>
Date: Fri Mar 7 17:08:11 2014 +0900

    libvirt: Make nwfilter driver use right filterref

    This fixes Bug #1220856 which occurs with Libvirt NWFilterFirewall
    Driver. While creating a VM with multiple NICs including one connects
    to DHCP serving network and another to DHCP non-serving network,
    NWFilterFirewall Driver will use the same base filter that allows DHCP
    for all NICs. This leads a libvirt launch error due to lack of
    'dhcp_server' parameter which is needed to define allow-DHCP filters.

    This patch makes NWFilterFirewall Driver use right base filter for
    each NIC depends on 'dhcp_server' config.

    Closes-bug: #1220856
    Change-Id: I7f9a7c281f152985478b2ec295f0644ba475fd76

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/102441

Reviewed: https://review.openstack.org/102441
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=f59886479f1014c225989e24c425106412b3f0f0
Submitter: Jenkins
Branch: stable/icehouse

commit f59886479f1014c225989e24c425106412b3f0f0
Author: Ryota MIBU <email address hidden>
Date: Fri Mar 7 17:08:11 2014 +0900

    libvirt: Make nwfilter driver use right filterref

    This fixes Bug #1220856 which occurs with Libvirt NWFilterFirewall
    Driver. While creating a VM with multiple NICs including one connects
    to DHCP serving network and another to DHCP non-serving network,
    NWFilterFirewall Driver will use the same base filter that allows DHCP
    for all NICs. This leads a libvirt launch error due to lack of
    'dhcp_server' parameter which is needed to define allow-DHCP filters.

    This patch makes NWFilterFirewall Driver use right base filter for
    each NIC depends on 'dhcp_server' config.

    Closes-bug: #1220856
    Change-Id: I7f9a7c281f152985478b2ec295f0644ba475fd76
    (cherry picked from commit d2874463010b129e62a568357cfa1df3ab4805e6)