Change in vdsm[ovirt-3.5]: Set sysctl to allow iSCSI multipath with multiple NICs in th...

Tuesday, 27 January 2015

Hello Yaniv Bronhaim, Federico Simoncelli, Amador Pahim,

I'd like you to do a code review.  Please visit

    http://gerrit.ovirt.org/37311

to review the following change.

Change subject: Set sysctl to allow iSCSI multipath with multiple NICs in the same subnet
......................................................................

Set sysctl to allow iSCSI multipath with multiple NICs in the same subnet

When two or more interfaces are in the same subnet, the default OS
behaviour won't allow the independent traffic between local NICs and
iSCSI targets.

These sysctl tweaks are needed to have iSCSI multipath working in
such topology:

  eth1 (192.168.25.200) --|
                          |-- iSCSI Target (192.168.25.10)
  eth2 (192.168.25.201) --|

For the ARP flux problem, where the machine may respond to ARP requests
from both Ethernet interfaces, we are setting "arp_ignore=1" and
"arp_announce=2"

To allow multiple iSCSI connections in a multiple NIC per subnet
configuration, reverse path filtering must be loosened with
"rp_filter=2" for the interfaces.

Change-Id: Ibf93d49317c76aece764e53e58e0ff28868f16b0
Bug-Url: https://bugzilla.redhat.com/1178838
Signed-off-by: Amador Pahim <apahim(a)redhat.com&gt;
Reviewed-on: http://gerrit.ovirt.org/31529
Reviewed-by: Federico Simoncelli <fsimonce(a)redhat.com&gt;
Reviewed-by: Yaniv Bronhaim <ybronhei(a)redhat.com&gt;
---
M vdsm/storage/iscsi.py
M vdsm/vdsm-sysctl.conf
2 files changed, 60 insertions(+), 1 deletion(-)


  git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/11/37311/1

diff --git a/vdsm/storage/iscsi.py b/vdsm/storage/iscsi.py
index 2975776..37c9d98 100644
--- a/vdsm/storage/iscsi.py
+++ b/vdsm/storage/iscsi.py
@@ -32,6 +32,7 @@
 
 import misc
 from vdsm.config import config
+from vdsm.netinfo import getRouteDeviceTo
 import devicemapper
 from threading import RLock
 
@@ -161,6 +162,9 @@
                     iscsiadm.node_update(iface.name, portalStr, target.iqn,
                                          key, value, hideValue=True)
 
+            setRpFilterIfNeeded(iface.netIfaceName, target.portal.hostname,
+                                True)
+
             iscsiadm.node_login(iface.name, portalStr, target.iqn)
 
             iscsiadm.node_update(iface.name, portalStr, target.iqn,
@@ -183,6 +187,7 @@
             pass
 
         iscsiadm.node_delete(iface.name, portalStr, target.iqn)
+        setRpFilterIfNeeded(iface.netIfaceName, target.portal.hostname, False)
 
 
 def addIscsiPortal(iface, portal, credentials=None):
@@ -499,9 +504,53 @@
 def disconnectiScsiSession(sessionID):
     # FIXME : Should throw exception on error
     sessionID = int(sessionID)
+    sessionInfo = getSessionInfo(sessionID)
     try:
         iscsiadm.session_logout(sessionID)
     except iscsiadm.IscsiError as e:
         return e[0]
 
+    netIfaceName = sessionInfo.iface.netIfaceName
+    hostname = sessionInfo.target.portal.hostname
+    setRpFilterIfNeeded(netIfaceName, hostname, False)
+
     return 0
+
+
+def _sessionsUsingNetiface(netIfaceName):
+    """ Return sessions using netIfaceName """
+    for session in iterateIscsiSessions():
+        if session.iface.netIfaceName == netIfaceName:
+            yield session
+
+
+def setRpFilterIfNeeded(netIfaceName, hostname, loose_mode):
+    """
+    Set rp_filter to loose or strict mode if there's no session using the
+    netIfaceName device and it's not the device used by the OS to reach the
+    'hostname'.
+    loose mode is needed to allow multiple iSCSI connections in a multiple NIC
+    per subnet configuration. strict mode is needed to avoid the security
+    breach where an untrusted VM can DoS the host by sending it packets with
+    spoofed random sources.
+
+    Arguments:
+        netIfaceName: the device used by the iSCSI session
+        target: iSCSI target object cointaining the portal hostname
+        loose_mode: boolean
+    """
+    if netIfaceName is None:
+        log.info("iSCSI iface.net_ifacename not provided. Skipping.")
+        return
+
+    sessions = _sessionsUsingNetiface(netIfaceName)
+
+    if not any(sessions) and netIfaceName != getRouteDeviceTo(hostname):
+        if loose_mode:
+            log.info("Setting loose mode rp_filter for device %r." %
+                     netIfaceName)
+            supervdsm.getProxy().set_rp_filter_loose(netIfaceName)
+        else:
+            log.info("Setting strict mode rp_filter for device %r." %
+                     netIfaceName)
+            supervdsm.getProxy().set_rp_filter_strict(netIfaceName)
diff --git a/vdsm/vdsm-sysctl.conf b/vdsm/vdsm-sysctl.conf
index ecd1386..3ad09b8 100644
--- a/vdsm/vdsm-sysctl.conf
+++ b/vdsm/vdsm-sysctl.conf
@@ -1,3 +1,13 @@
-#Set dirty page parameters
+# Set dirty page parameters
 vm.dirty_ratio = 5
 vm.dirty_background_ratio = 2
+
+# Using iSCSI multipath with multiple interfaces in the same subnet, the
+# default OS behaviour won't allow the independent traffic between local NICs
+# and iSCSI targets (BZ#1112861). The kernel parameters bellow are needed to
+# accomodate this case:
+# For the ARP flux problem, where the machine may respond to ARP requests
+# from all Ethernet interfaces, we are setting "arp_ignore=1" and
+# "arp_announce=2"
+net.ipv4.conf.default.arp_ignore = 1
+net.ipv4.conf.default.arp_announce = 2


-- 
To view, visit http://gerrit.ovirt.org/37311
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: Ibf93d49317c76aece764e53e58e0ff28868f16b0
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: ovirt-3.5
Gerrit-Owner: Maor Lipchuk <mlipchuk(a)redhat.com&gt;
Gerrit-Reviewer: Amador Pahim <apahim(a)redhat.com&gt;
Gerrit-Reviewer: Federico Simoncelli <fsimonce(a)redhat.com&gt;
Gerrit-Reviewer: Yaniv Bronhaim <ybronhei(a)redhat.com&gt;

    

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011