[NETVIRT-1052] Default SG flow entries are overridden when ANY protocol SG is added to the server

Fri, 6 Apr 2018 21:48:02 +0000

Setup:

3 control node

2 compute node

3 controller in cluster

DIstro: Nitrogen formal release

Steps to reproduce the issue:

Create a network
Create a VM for the server. By default, default SG is applied to the VM and relevant flow entries are present in the dump-flows. (ip rule and ipv6 rule)
Create a security group
Add ANY protocol rule (ingress and egress) to the security group
Apply the above security group to the VM

Observation:

There must be 2 ip rule flows but once SG is applied to the VM, ip rule is getting overridden.

DUMP-FLOWS

Default SG flows

cookie=0x6900001, duration=14.905s, table=243, n_packets=0, n_bytes=0, priority=62015,ct_state=+inv+trk,reg6=0x19d000/0xfffff00 actions=drop
cookie=0x6900000, duration=70.491s, table=243, n_packets=0, n_bytes=0, priority=1000,ct_state=+new+trk,ipv6,reg6=0x19cf00/0xfffff00,metadata=0xfa0/0xfffffe actions=ct(commit,zone=5002),resubmit(,220)
cookie=0x6900000, duration=70.491s, table=243, n_packets=0, n_bytes=0, priority=1007,ct_state=+new+trk,ip,reg6=0x19cf00/0xfffff00,metadata=0xfa0/0xfffffe actions=ct(commit,zone=5002),resubmit(,220)
cookie=0x6900001, duration=73.136s, table=243, n_packets=0, n_bytes=0, priority=50,ct_state=+new+trk,reg6=0x19cf00/0xfffff00 actions=drop
cookie=0x6900001, duration=14.923s, table=243, n_packets=0, n_bytes=0, priority=50,ct_state=+new+trk,reg6=0x19d000/0xfffff00 actions=drop
cookie=0x6900000, duration=160431.291s, table=243, n_packets=6, n_bytes=2028, priority=0 actions=drop

After adding ANY_SG flows:

cookie=0x6900001, duration=227.642s, table=243, n_packets=0, n_bytes=0, priority=62015,ct_state=+inv+trk,reg6=0x19d000/0xfffff00 actions=drop
cookie=0x6900000, duration=9.853s, table=243, n_packets=0, n_bytes=0, priority=1012,ct_state=+new+trk,ip,reg6=0x19cf00/0xfffff00 actions=ct(commit,zone=5002),resubmit(,220)
cookie=0x6900001, duration=285.873s, table=243, n_packets=0, n_bytes=0, priority=50,ct_state=+new+trk,reg6=0x19cf00/0xfffff00 actions=drop
cookie=0x6900001, duration=227.660s, table=243, n_packets=0, n_bytes=0, priority=50,ct_state=+new+trk,reg6=0x19d000/0xfffff00 actions=drop
cookie=0x6900000, duration=160644.028s, table=243, n_packets=6, n_bytes=2028, priority=0 actions=drop

OpenDaylight JIRA

[NETVIRT-1052] Default SG flow entries are overridden when ANY protocol SG is added to the server