openvswitch update_port uses segmentation_id instead of local vlan_id

Bug #1044556 reported by Robert Kukura
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
neutron
Fix Released
High
Gary Kotton

Bug Description

When the openvswitch plugin processes an update_port() API call, is in RPC mode, and admin_state_up has changed, it invokes the port_update RPC on the agent, passing the network's segmentation_id as the vlan_id parameter. If admin_state_up is True, then OVSRpcCallbacks.port_update() in the agent will set the tag of the VIF's port on br-int to the vlan_id that was passed via the RPC. This made sense in the old VLAN mode, but is incorrect for tunnels and for the way VLAN and flat networks are now implemented. The VLAN tag used on the integration bridge must always be the local VLAN ID, obtained from LocalVLANMapping.vlan in OVSQuantumAgent.local_vlan_map. There is no need to send the segmentation_id in the RPC request, and the REVISIT comments in OVSQuantumPluginV2.update_port() and OVSRpcCallbacks.port_update() should be removed.

As the code exists right now, any user who changes their port admin_state_up to False and then to True again will get disconnected from their own network, and possibly get connected to some other network belonging to some other tenant, with serious security implications.

Gary Kotton (garyk)
Changed in quantum:
assignee: nobody → Gary Kotton (garyk)
milestone: none → folsom-rc1
importance: Undecided → High
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to quantum (master)

Fix proposed to branch: master
Review: https://review.openstack.org/12290

Changed in quantum:
status: New → In Progress
Changed in quantum:
assignee: Gary Kotton (garyk) → Aaron Rosen (arosen)
Changed in quantum:
assignee: Aaron Rosen (arosen) → Gary Kotton (garyk)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to quantum (master)

Reviewed: https://review.openstack.org/12290
Committed: http://github.com/openstack/quantum/commit/79ec9b2295a0496584653779ddfb6f64f39bb854
Submitter: Jenkins
Branch: master

commit 79ec9b2295a0496584653779ddfb6f64f39bb854
Author: Gary Kotton <email address hidden>
Date: Sat Sep 1 01:53:59 2012 -0400

    Ensure that port update set correct tag in OVS

    Fixes bug 1044556.

    This patch also ensures that the local vlan mapping is updated correctly.
    This was problematic in the event that the OVS agent would start and a port
    was in administrative state down.

    Change-Id: I4e5145547e73a58fee3f08a129fda6bc0ec42b72

Changed in quantum:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in quantum:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in quantum:
milestone: folsom-rc1 → 2012.2
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.