neutron

Router update fails for ports with allowed_address_pairs containg IP range in CIDR notation

Bug #1934912 reported by Jan Horstmann on 2021-07-07

This bug affects 3 people

	Status	Importance	Assigned to
Ubuntu Cloud Archive	Fix Released	Undecided	Unassigned
Ussuri	Fix Released	Undecided	Unassigned
Victoria	Fix Released	Undecided	Unassigned
Wallaby	Fix Released	Undecided	Unassigned
Xena	Fix Released	Undecided	Unassigned
neutron	Fix Released	Medium	Unassigned
neutron (Ubuntu)	Fix Released	Medium	Unassigned
Focal	Fix Released	Medium	Unassigned
Hirsute	Fix Released	Medium	Unassigned
Impish	Fix Released	Medium	Unassigned

Bug Description

With https://review.opendev.org/c/openstack/neutron/+/792791 neutron build from branch `stable/train` fails to update routers with ports containing an `allowed_address_pair` containing an IP address range in CIDR notation, i.e.:
```
openstack port show 135515bf-6cdf-45d7-affa-c775d2a43ce1 -f value -c allowed_address_pairs
[{'mac_address': 'fa:16:3e:1e:c4:f1', 'ip_address': '192.168.0.0/16'}]
```

I could not find definitive information on wether this is an allowed value for allowed_address_pairs, but at least the openstack/magnum project makes use of this.

Once the above is set neutron-l3-agent logs errors shown in http://paste.openstack.org/show/807237/ and connection to all resources behind the router stop.

Steps to reproduce:
Set up openstack environment with neutron build from git branch stable/train with OVS, DVR and router HA in a multinode deployment on ubuntu bionic.

Create a test environment:
openstack network create test
openstack subnet create --network test --subnet-range 10.0.0.0/24 test
openstack router create --ha --distributed test
openstack router set --external-gateway <provider network> test
openstack router add subnet test test
openstack server create --image <test image> --flavor m1.small --security-group <default> --network test test
openstack security group create icmp
openstack security group rule create --protocol icmp --ingress icmp
openstack server add security group test icmp
openstack floating ip create <provider network>
openstack server add floating ip test <floating ip>
ping <floating ip>
openstack port set --allowed-address ip-address=192.168.0.0/16 <instance port>
ping <floating ip>

Observe loss of ping after setting allowed_address_pairs.
Revert https://review.opendev.org/c/openstack/neutron/+/792791 and redeploy neutron
ping <floating ip>
Observe reestablishment of the connection.

Please let me know if you need any other information

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

SRU:

[Impact]
VM with floating ip are unreachable from external

[Test Case]
Create a test environment on bionic ussuri
openstack network create test
openstack subnet create --network test --subnet-range 10.0.0.0/24 test
openstack router create --ha --distributed test
openstack router set --external-gateway <provider network> test
openstack router add subnet test test
openstack server create --image <test image> --flavor m1.small --security-group <default> --network test test
openstack security group create icmp
openstack security group rule create --protocol icmp --ingress icmp
openstack server add security group test icmp
openstack floating ip create <provider network>
openstack server add floating ip test <floating ip>
ping <floating ip>
openstack port set --allowed-address ip-address=192.168.0.0/16 <instance port>
openstack router set --disable <router>
openstack router set --enable <router>
ping <floating ip>

# ping should be successful after router is enabled.

[Regression Potential]
The only possibilities for allowed_address_pair are either IP or a CIDR. There is no chance of garbage values since it is verified during port update with allowed_address_pair. The edge case of IP with CIDR notation like /32 are already covered in common_utils.is_cidr_host() function call. All the upstream CI builds until stable/ussuri are successful.

See original description

Tags:

Revision history for this message

Slawek Kaplonski (slaweq) wrote on 2021-07-08:

I think I know what is wrong there. If there is CIDR given as allowed address pair, we should probably add all IPs from such cidr to the arp table. There is no way to add CIDR as arp entry in the Linuxx AFAIK.

Changed in neutron:
status:	New → Confirmed
importance:	Undecided → Medium

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-07-08: Fix proposed to neutron (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/800059

Changed in neutron:
status:	Confirmed → In Progress

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-09-15: Fix merged to neutron (master)

Reviewed: https://review.opendev.org/c/openstack/neutron/+/800059
Committed: https://opendev.org/openstack/neutron/commit/19375b3e78ad6b635793b716e5ecabd53dc73a76
Submitter: "Zuul (22348)"
Branch: master

commit 19375b3e78ad6b635793b716e5ecabd53dc73a76
Author: Slawek Kaplonski <email address hidden>
Date: Thu Jul 8 15:53:39 2021 +0200

[DVR] Set arp entries only for single IPs given as allowed addr pair

    In allowed address pairs of the port there can be given not single IP
    address but whole CIDR. In such case ARP entries for IPs from such
    cidr will not be added in the DVR router namespace.

Closes-Bug: #1934912
Change-Id: I7bdefea943379125f93b116bb899446b874d9505

Changed in neutron:
status:	In Progress → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-09-15: Fix included in openstack/neutron 19.0.0.0rc1

This issue was fixed in the openstack/neutron 19.0.0.0rc1 release candidate.

Revision history for this message

Sven Kieske (s-kieske) wrote on 2021-09-16:

please consider backporting this change as this is cleary a regression, this worked before
https://review.opendev.org/c/openstack/neutron/+/792791 introduced the new behaviour.

Thanks

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-09-29: Fix proposed to neutron (stable/wallaby)

Fix proposed to branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/neutron/+/811497

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-09-29: Fix proposed to neutron (stable/victoria)

Fix proposed to branch: stable/victoria
Review: https://review.opendev.org/c/openstack/neutron/+/811498

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-09-29: Fix proposed to neutron (stable/ussuri)

Fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/c/openstack/neutron/+/811499

Revision history for this message

Hemanth Nakkina (hemanth-n) wrote on 2021-09-30:

Debdiff for impish Edit (6.8 KiB, text/plain)

description:	updated
tags:	added: sts sts-sru-needed

Revision history for this message

Hemanth Nakkina (hemanth-n) wrote on 2021-09-30:

#10

Debdiff for hirsute Edit (6.6 KiB, text/plain)

Revision history for this message

Hemanth Nakkina (hemanth-n) wrote on 2021-09-30:

#11

Debdiff for focal Edit (6.6 KiB, text/plain)

Revision history for this message

Hemanth Nakkina (hemanth-n) wrote on 2021-09-30:

#12

Debdiff for UCA xena Edit (6.8 KiB, text/plain)

Revision history for this message

Hemanth Nakkina (hemanth-n) wrote on 2021-09-30:

#13

Debdiff for UCA wallaby Edit (6.6 KiB, text/plain)

Revision history for this message

Hemanth Nakkina (hemanth-n) wrote on 2021-09-30:

#14

Debdiff for UCA victoria Edit (6.5 KiB, text/plain)

Revision history for this message

Hemanth Nakkina (hemanth-n) wrote on 2021-09-30:

#15

Debdiff for UCA ussuri Edit (6.6 KiB, text/plain)

Revision history for this message

Hemanth Nakkina (hemanth-n) wrote on 2021-09-30:

#16

SRU team,
Debdiff's for Impish/Hirsute/Focal and UCA X/W/V/U are uploaded

Revision history for this message

Ubuntu Foundations Team Bug Bot (crichton) wrote on 2021-09-30:

#17

The attachment "Debdiff for impish" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

tags:

added: patch

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-09-30: Fix proposed to neutron (stable/train)

#18

Fix proposed to branch: stable/train
Review: https://review.opendev.org/c/openstack/neutron/+/811974

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-09-30: Fix merged to neutron (stable/wallaby)

#19

Reviewed: https://review.opendev.org/c/openstack/neutron/+/811497
Committed: https://opendev.org/openstack/neutron/commit/5418912b705393b165c455507bc7b09cb9141f58
Submitter: "Zuul (22348)"
Branch: stable/wallaby

commit 5418912b705393b165c455507bc7b09cb9141f58
Author: Slawek Kaplonski <email address hidden>
Date: Thu Jul 8 15:53:39 2021 +0200

[DVR] Set arp entries only for single IPs given as allowed addr pair

    In allowed address pairs of the port there can be given not single IP
    address but whole CIDR. In such case ARP entries for IPs from such
    cidr will not be added in the DVR router namespace.

    Closes-Bug: #1934912
    Change-Id: I7bdefea943379125f93b116bb899446b874d9505
    (cherry picked from commit 19375b3e78ad6b635793b716e5ecabd53dc73a76)

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-09-30: Fix merged to neutron (stable/victoria)

#20

Reviewed: https://review.opendev.org/c/openstack/neutron/+/811498
Committed: https://opendev.org/openstack/neutron/commit/4300619ad1a79170dc8f218cd15cb5146498f66a
Submitter: "Zuul (22348)"
Branch: stable/victoria

commit 4300619ad1a79170dc8f218cd15cb5146498f66a
Author: Slawek Kaplonski <email address hidden>
Date: Thu Jul 8 15:53:39 2021 +0200

[DVR] Set arp entries only for single IPs given as allowed addr pair

    In allowed address pairs of the port there can be given not single IP
    address but whole CIDR. In such case ARP entries for IPs from such
    cidr will not be added in the DVR router namespace.

    Closes-Bug: #1934912
    Change-Id: I7bdefea943379125f93b116bb899446b874d9505
    (cherry picked from commit 19375b3e78ad6b635793b716e5ecabd53dc73a76)

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-09-30: Fix merged to neutron (stable/ussuri)

#21

Reviewed: https://review.opendev.org/c/openstack/neutron/+/811499
Committed: https://opendev.org/openstack/neutron/commit/d0cf4638f595c38a67974a45d5ef76dcf34e8918
Submitter: "Zuul (22348)"
Branch: stable/ussuri

commit d0cf4638f595c38a67974a45d5ef76dcf34e8918
Author: Slawek Kaplonski <email address hidden>
Date: Thu Jul 8 15:53:39 2021 +0200

[DVR] Set arp entries only for single IPs given as allowed addr pair

    In allowed address pairs of the port there can be given not single IP
    address but whole CIDR. In such case ARP entries for IPs from such
    cidr will not be added in the DVR router namespace.

    Closes-Bug: #1934912
    Change-Id: I7bdefea943379125f93b116bb899446b874d9505
    (cherry picked from commit 19375b3e78ad6b635793b716e5ecabd53dc73a76)

Mathew Hodson (mhodson) on 2021-09-30

Changed in neutron (Ubuntu Focal):
importance:	Undecided → Medium
Changed in neutron (Ubuntu Hirsute):
importance:	Undecided → Medium
Changed in neutron (Ubuntu Impish):
importance:	Undecided → Medium

Revision history for this message

Steve Langasek (vorlon) wrote on 2021-10-08: Please test proposed package

#22

Hello Jan, or anyone else affected,

Accepted neutron into hirsute-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/neutron/2:18.1.1-0ubuntu2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-hirsute to verification-done-hirsute. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-hirsute. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in neutron (Ubuntu Hirsute):
status:	New → Fix Committed
tags:	added: verification-needed verification-needed-hirsute

Revision history for this message

Chris MacNaughton (chris.macnaughton) wrote on 2021-10-11:

#23

Hello Jan, or anyone else affected,

Accepted neutron into victoria-proposed. The package will build now and be available in the Ubuntu Cloud Archive in a few hours, and then in the -proposed repository.

Please help us by testing this new package. To enable the -proposed repository:

sudo add-apt-repository cloud-archive:victoria-proposed
sudo apt-get update

Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-victoria-needed to verification-victoria-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-victoria-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

tags:

added: verification-victoria-needed

Revision history for this message

Chris MacNaughton (chris.macnaughton) wrote on 2021-10-11:

#24

Hello Jan, or anyone else affected,

Accepted neutron into wallaby-proposed. The package will build now and be available in the Ubuntu Cloud Archive in a few hours, and then in the -proposed repository.

Please help us by testing this new package. To enable the -proposed repository:

sudo add-apt-repository cloud-archive:wallaby-proposed
sudo apt-get update

Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-wallaby-needed to verification-wallaby-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-wallaby-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

tags:

added: verification-wallaby-needed

Revision history for this message

Brian Murray (brian-murray) wrote on 2021-10-11:

#25

Hello Jan, or anyone else affected,

Accepted neutron into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/neutron/2:16.4.1-0ubuntu2 in a few hours, and then in the -proposed repository.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in neutron (Ubuntu Focal):
status:	New → Fix Committed
tags:	added: verification-needed-focal

Revision history for this message

Chris MacNaughton (chris.macnaughton) wrote on 2021-10-12:

#26

Hello Jan, or anyone else affected,

Accepted neutron into ussuri-proposed. The package will build now and be available in the Ubuntu Cloud Archive in a few hours, and then in the -proposed repository.

Please help us by testing this new package. To enable the -proposed repository:

sudo add-apt-repository cloud-archive:ussuri-proposed
sudo apt-get update

Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-ussuri-needed to verification-ussuri-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-ussuri-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

tags:

added: verification-ussuri-needed

Revision history for this message

Hemanth Nakkina (hemanth-n) wrote on 2021-10-14:

#27

Verified the test case successfully for Hirsute/Focal and UCA Wallaby/Victoria/Ussuri. (see attached lp1934912_verification)

Revision history for this message

Hemanth Nakkina (hemanth-n) wrote on 2021-10-14:

#28

lp1934912_verification Edit (23.6 KiB, text/plain)

tags:

added: verification-done verification-done-focal verification-done-hirsute verification-ussuri-done verification-victoria-done verification-wallaby-done
removed: verification-needed verification-needed-focal verification-needed-hirsute verification-ussuri-needed verification-victoria-needed verification-wallaby-needed

Corey Bryant (corey.bryant) on 2021-10-18

Changed in neutron (Ubuntu Impish):
status:	New → Fix Released
Changed in neutron (Ubuntu):
status:	New → Fix Released

Revision history for this message

Brian Murray (brian-murray) wrote on 2021-10-19: Update Released

#29

The verification of the Stable Release Update for neutron has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2021-10-19:

#30

This bug was fixed in the package neutron - 2:16.4.1-0ubuntu2

---------------
neutron (2:16.4.1-0ubuntu2) focal; urgency=medium

* d/p/lp1934912-set-arp-entries-only-for-single-ip.patch: Cherry-pick
upstream patch (LP: #1934912)

neutron (2:16.4.1-0ubuntu1) focal; urgency=medium

  [ Corey Bryant ]
  * d/p/revert-rely-on-worker-count-for-hashring-caching.patch: Dropped.
    Fixed upstream by https://review.opendev.org/c/openstack/neutron/+/800679
    in the 16.4.1 stable release.

  [ Chris MacNaughton ]
  * New stable point release for OpenStack Ussuri (LP: #1943712).
  * d/p/provide-integer-argument-to-arping.patch: Removed after
    inclusion in upstream release.

-- Chris MacNaughton <email address hidden> Fri, 01 Oct 2021 06:56:50 +0000

Changed in neutron (Ubuntu Focal):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2021-10-19:

#31

This bug was fixed in the package neutron - 2:18.1.1-0ubuntu2

---------------
neutron (2:18.1.1-0ubuntu2) hirsute; urgency=medium

* d/p/lp1934912-set-arp-entries-only-for-single-ip.patch: Cherry-pick
upstream patch (LP: #1934912)

neutron (2:18.1.1-0ubuntu1) hirsute; urgency=medium

  [ Corey Bryant ]
  * d/control: Drop neutron-fwaas dependency as it is no longer maintained
    (LP: #1934129).
  * d/p/revert-rely-on-worker-count-for-hashring-caching.patch: Dropped.
    Fixed upstream by https://review.opendev.org/c/openstack/neutron/+/800679
    in the 18.1.1 stable release.

  [ Chris MacNaughton ]
  * New stable point release for OpenStack Wallaby (LP: #1943709).
  * d/p/series: Remove reference to removed patch.

-- Chris MacNaughton <email address hidden> Fri, 01 Oct 2021 06:42:37 +0000

Changed in neutron (Ubuntu Hirsute):
status:	Fix Committed → Fix Released

Revision history for this message

Chris MacNaughton (chris.macnaughton) wrote on 2021-10-21:

#32

The verification of the Stable Release Update for neutron has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message

Chris MacNaughton (chris.macnaughton) wrote on 2021-10-21:

#33

This bug was fixed in the package neutron - 2:18.1.1-0ubuntu2~cloud0
---------------

neutron (2:18.1.1-0ubuntu2~cloud0) focal-wallaby; urgency=medium
.
   * New upstream release for the Ubuntu Cloud Archive.
.
neutron (2:18.1.1-0ubuntu2) hirsute; urgency=medium
.
   * d/p/lp1934912-set-arp-entries-only-for-single-ip.patch: Cherry-pick
     upstream patch (LP: #1934912)
.
neutron (2:18.1.1-0ubuntu1) hirsute; urgency=medium
.
   [ Corey Bryant ]
   * d/control: Drop neutron-fwaas dependency as it is no longer maintained
     (LP: #1934129).
   * d/p/revert-rely-on-worker-count-for-hashring-caching.patch: Dropped.
     Fixed upstream by https://review.opendev.org/c/openstack/neutron/+/800679
     in the 18.1.1 stable release.
.
   [ Chris MacNaughton ]
   * New stable point release for OpenStack Wallaby (LP: #1943709).
   * d/p/series: Remove reference to removed patch.

Revision history for this message

Chris MacNaughton (chris.macnaughton) wrote on 2021-10-21:

#34

Revision history for this message

Chris MacNaughton (chris.macnaughton) wrote on 2021-10-21:

#35

This bug was fixed in the package neutron - 2:17.2.1-0ubuntu1~cloud2
---------------

neutron (2:17.2.1-0ubuntu1~cloud2) ifocal-victoria; urgency=medium
.
   * No change rebuild
.
neutron (2:17.2.1-0ubuntu1~cloud1) focal-victoria; urgency=medium
.
   * d/p/lp1934912-set-arp-entries-only-for-single-ip.patch: Cherry-pick
     upstream patch (LP: #1934912)
.
neutron (2:17.2.1-0ubuntu1~cloud0) focal-victoria; urgency=medium
.
   [ Corey Bryant ]
   * d/control: Drop neutron-fwaas dependency as it is no longer maintained
     (LP: #1934129).
.
   [ Chris MacNaughton ]
   * New stable point release for OpenStack Victoria (LP: #1943711).

Revision history for this message

Chris MacNaughton (chris.macnaughton) wrote on 2021-10-21:

#36

Revision history for this message

Chris MacNaughton (chris.macnaughton) wrote on 2021-10-21:

#37

This bug was fixed in the package neutron - 2:16.4.1-0ubuntu2~cloud0
---------------

neutron (2:16.4.1-0ubuntu2~cloud0) bionic-ussuri; urgency=medium
.
   * New upstream release for the Ubuntu Cloud Archive.
.
neutron (2:16.4.1-0ubuntu2) focal; urgency=medium
.
   * d/p/lp1934912-set-arp-entries-only-for-single-ip.patch: Cherry-pick
     upstream patch (LP: #1934912)
.
neutron (2:16.4.1-0ubuntu1) focal; urgency=medium
.
   [ Corey Bryant ]
   * d/p/revert-rely-on-worker-count-for-hashring-caching.patch: Dropped.
     Fixed upstream by https://review.opendev.org/c/openstack/neutron/+/800679
     in the 16.4.1 stable release.
.
   [ Chris MacNaughton ]
   * New stable point release for OpenStack Ussuri (LP: #1943712).
   * d/p/provide-integer-argument-to-arping.patch: Removed after
     inclusion in upstream release.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-11-12: Fix included in openstack/neutron 16.4.2

#38

This issue was fixed in the openstack/neutron 16.4.2 release.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-11-16: Fix merged to neutron (stable/train)

#39

Reviewed: https://review.opendev.org/c/openstack/neutron/+/811974
Committed: https://opendev.org/openstack/neutron/commit/889ba1060c507814109db1432c26f448a15e88bf
Submitter: "Zuul (22348)"
Branch: stable/train

commit 889ba1060c507814109db1432c26f448a15e88bf
Author: Slawek Kaplonski <email address hidden>
Date: Thu Jul 8 15:53:39 2021 +0200

[DVR] Set arp entries only for single IPs given as allowed addr pair

    In allowed address pairs of the port there can be given not single IP
    address but whole CIDR. In such case ARP entries for IPs from such
    cidr will not be added in the DVR router namespace.

Conflicts:
neutron/agent/l3/dvr_local_router.py

    Closes-Bug: #1934912
    Change-Id: I7bdefea943379125f93b116bb899446b874d9505
    (cherry picked from commit 19375b3e78ad6b635793b716e5ecabd53dc73a76)
    (cherry picked from commit d0cf4638f595c38a67974a45d5ef76dcf34e8918)