https://jira.opendaylight.org This file is an XML representation of an issue en-us 8.20.10 820010 22-06-2022 https://jira.opendaylight.org/browse/NETVIRT-694 netvirt <p>Steps:</p> <ul> <li>Created SG1 with ICMP all ingress and egress rules.</li> <li>Created 2 VMs with SG1 and verified ping communication between the VMs.</li> <li>Removed ICMP all ingress and egress rules from SG1. Verifed ping communication is not working as expected.</li> <li>Once again added the same ICMP all ingress and egress rule to SG1.</li> </ul> <p>Observation: </p> <ul> <li>The communication between the VM is not working.</li> </ul> <p>Expected behavior:</p> <ul> <li>Ping has to succeed.</li> </ul> <p>Observed the above behavior two out of three times.</p> <p>Operating System: All<br/> Platform: All</p> NETVIRT-694

Communication is not working properly when ICMP rules are changed dynamically

Bug Resolved Done Arthi Bhattacharjee Arthi Bhattacharjee Fri, 26 May 2017 12:37:30 +0000 Tue, 21 Nov 2017 14:20:28 +0000 Wed, 28 Jun 2017 13:19:11 +0000 Carbon General 0 9 <p>Attachment dump-flows.txt has been added with description: Dump-flows</p> <p>Attachment karaf_logs.zip has been added with description: Karaf logs</p> <p>Additional issue found:</p> <p>Steps:</p> <ul> <li>Created SG1 with ICMP all ingress and egress rules.</li> <li>Created 2 VMs with SG1 and verified ping communication between the VMs.</li> <li>Removed ICMP all ingress and egress rules from SG1.</li> <li>Verified Ping communication between VMS</li> </ul> <p>Observation: </p> <ul> <li>The communication between the VM is still working and flows are sustained.</li> </ul> <p>Expected behavior:</p> <ul> <li>Ping has to fail.</li> </ul> <p>Note:<br/> While adding/removing rules from SG1, flows are not added/removed appropriately.</p> <p>Following is the observation for the bug:<br/> Flows are not installed when the last rule that is removed from the Security Group and after deleting the all rules, first rule that is added to the same security group.</p> <p>Patch ref:: <a href="https://git.opendaylight.org/gerrit/#/c/56279" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/56279</a><br/> Class: AclEventListener.java</p> <p> if (!AclServiceUtils.isOfAclInterest(aclAfter) || !AclServiceUtils.isOfAclInterest(aclBefore)) {<br/> LOG.trace("before {} and/or after {} does not have SecurityRuleAttr augmentation",<br/> aclBefore.getAclName(), aclAfter.getAclName());<br/> return;<br/> }<br/> When the event is received, the above condition checks whether before and after ACL are not empty. <br/> If either of those are empty, deletion and addition of rules are not processed.</p> <p>Scenario#1: While deleting last rule from the Security Group.<br/> -&gt; AclServiceUtils.isOfAclInterest(aclAfter) is false. Thus, the condition satisfied and returns from the method.<br/> -&gt; Because aclAfter is empty.</p> <p>Scenario#2: While adding the first rule to the same Security Group after deleting the previous rules <br/> -&gt; AclServiceUtils.isOfAclInterest(aclAfter) will be true but, AclServiceUtils.isOfAclInterest(aclBefore) will be false. Thus, the condition satisfied and returns from the method.<br/> -&gt; Because aclBefore is empty.</p> <p>Patch fix: <a href="https://git.opendaylight.org/gerrit/#/c/59213/" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/59213/</a></p> Development External issue ID 8553 External issue URL Rank 0|i01tdr: