There are 4 open security issues in bullseye.
commit 01959348182cd5fd93e4834cf3d79cf022a83cf0
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 15 13:43:21 2026 +0100
Rebuild the ovn-bgp quilt patches as upstream diffs
The six session-made quilt patches were built by copying whole files
from the upstream clone, which leaked the post-29.0.0 drift into the
enslave patch (the privsep_safe_utils import: a mass ImportError at
unit test discovery, Jenkins red) and silently reverted the learned
route seeding, flows liveness and eager seeding work in the agent
extension and its tests.
Rebuild the six patches as the whole upstream commit diffs
(697ebfd197, 633cceb5ca, cce274557a, 7f137c481f, c4e9ee19b1,
84706ae902): the agent extension and its unit tests are three-way
merged so none of the quilt-only work is reverted, the ip_lib import
migration (upstream post-29.0.0) is not carried, the ovsdb_nb_commands
import hunk is dropped from preserve-statics (already brought in by
ensure-main), and the full sync insertion is re-anchored after the
ensure-main one. Every adaptation is documented in the patch headers.
The seed patch gets its Origin header (Eduardo Olivares' abandoned
review 995938, the upstream static MAC binding workaround).
Verified: the full queue applies on the pristine 29.0.0 orig with zero
fuzz and offsets; stestr --dynamic on unstable passes
test_async_process (31 tests, the module that failed discovery in
Jenkins) and the whole agent.ovn.extensions + services.bgp +
objects.test_router set (720 tests, 0 failed).
commit 9c2e8ee0a8b0b98f7388a38383cb55b4c8785fd9
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 15 12:32:36 2026 +0100
Enslave BGP bridges to the chassis router VRF
The routes of the chassis routers are exchanged with the kernel VRF
table that ovn-controller maintains: the peering LRPs carry the
dynamic-routing-maintain-vrf option, which makes ovn-controller create
the ovnvrf<id> device. The routing suite deployed on the host runs its
fabric sessions inside that VRF, which requires the BGP bridges to be
enslaved to the VRF device.
Add two privsep entry points to enslave a link to a master device and
to look up the master of a link, and use them from the BGP agent
extension to enslave each BGP bridge to the chassis router VRF when the
bridge is created. The VRF device is created asynchronously by
ovn-controller once the dynamic-routing-maintain-vrf option lands on
the peering LRPs, so this is retried from the bridge port created event
until it succeeds.
commit 478e2f659f02c09300c93c722109be8a6b22c123
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 15 00:43:49 2026 +0100
Documented the geneve external network BGP flow
How such networks are reconciled (the main router carrying the subnet
gateway IPs, the chassis routers routing through the peering), the
floating IP request/reply paths (the NAT advertisement chassis
tracking, the learned-route MAC binding seeding) and the fabric
requirement of disabled reverse path filtering:
- ovn-bgp-2-host_document-geneve-external-bgp-flow.patch
commit e2425825808e12503059733ec6a512d2c75f8e70
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 15 00:38:58 2026 +0100
Seeded the learned routes' static MAC bindings eagerly
The LearnedRouteStaticMacBindingEvent only dispatches for rows
appearing after the agent's post-fork SB idl registration, so the rows
of the initial dump never fired it; the seeding now also runs in the
agent's flows reconciliation loop through a shared helper (idempotent):
- ovn-bgp-2-host_eager-seed-learned-route-mac-bindings.patch
commit eb0f8a1c88ac1b3dff00a3c4361649015aadb269
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 15 00:23:33 2026 +0100
Routed the chassis routers to the geneve external networks
A static route per external subnet on every chassis router, pointing
at the main router's link local address on the chassis/main peering
(the request path of every floating IP), installed by the chassis,
external-network-switch and subnet gateway reconciliations and removed
on external network deletion:
- ovn-bgp-2-host_route-chassis-routers-to-geneve-externals.patch
Preserved the policies and static routes on router reconciliation:
ReconcileRouterCommand wrote back empty policies and static_routes
columns on existing routers, wiping the chassis routers' routes and
the leaked subnet routes at each full synchronization:
- ovn-bgp-2-host_preserve-router-statics-on-reconcile.patch
commit cedc146edfd985bd6248745d28ba25607c0a31a8
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 15 00:00:00 2026 +0100
Wired geneve external networks in the BGP service plugin
The event matchers, the neutron switch reconciliation and the full
sync only gated on flat provider networks, leaving geneve external
networks without a main router connection (no reachable gateway for
the attached routers' SNAT/default egress); the main router now
connects to geneve external network switches directly, carrying the
subnet gateway IPs, detected through the broadcast-arps-to-all-routers
other_config marker:
- ovn-bgp-2-host_wire-geneve-external-networks.patch
commit b40d780734aa28552623f802c88983d94bf81ef6
Author: Thomas Goirand <zigo@debian.org>
Date: Sat Nov 14 23:47:45 2026 +0100
Ensured the main router default route points at a valid egress
The bootstrap fake LRP static 0.0.0.0/0 shadowed the fabric-learned
default route and blackholed matching transit traffic; replaced it
with EnsureMainRouterDefaultRouteCommand (also cleaning up the legacy
fake LRP and route on reconciled deployments), called from the full
sync and the chassis reconciliation/deletion paths:
- ovn-bgp-2-host_ensure-main-router-default-route-via-chassis.patch
commit 7f1ce27d0e4dfcca3670a250b71320b04005dc28
Author: Thomas Goirand <zigo@debian.org>
Date: Sat Nov 14 15:07:53 2026 +0100
Unwrap the idl ofport atom in the BGP patch port lookup
Interface.ofport is an optional column: the idl wraps the value into
a single-element list, and the patch_port_ofport lookup returned it
verbatim, so every generated BGP flow carried "output:[75]" /
"in_port=[75]" instead of a port number. ovs-ofctl then rejected the
whole atomic bundle with "output to unknown port" on every
reconciliation pass, on a bridge that was otherwise perfectly able to
accept the very same flows applied manually with a scalar port.
Return the unwrapped scalar instead; the functional tests exercise
the real idl list form and the unit tests mock the property.
commit 1d293c97a17e6c863268645d8fe72ae56ddaca52
Author: Thomas Goirand <zigo@debian.org>
Date: Sat Nov 14 02:47:14 2026 +0100
Fix silent BGP bundle failures and Learned_Route refs
Two more live findings from the lab compute running the rebuilt
agent:
The ovs-ofctl bundle apply failed silently ("output to unknown port"
while the patch ports were being recreated right after the agent
start): OVSBridge.run_ofctl() logs and returns None instead of
raising (the upstream TODO acknowledges it is brittle), so
configure_flows() recorded the apply as successful and the
requirements idempotency check then skipped every retry, leaving the
bridge with the old manual flows pointing at dead ofports. The apply
now raises on the None return so the applied state is cleared and
the next reconciliation pass retries.
Learned_Route.logical_port is a strong reference to a Port_Binding
row: the idl resolves it into a row object, and the seeding event
passed that row where a port name string was expected, crashing the
match with "Row instance has no attribute 'startswith'" and never
seeding any Static_MAC_Binding. Resolve the referenced row's
logical_port name first and skip routes whose reference cannot be
resolved; the unit tests use reference-style rows now.
commit a834cca4fca836ff0010923a42c12136d90cdbd0
Author: Thomas Goirand <zigo@debian.org>
Date: Sat Nov 14 02:03:25 2026 +0100
Look the BGP patch port up by name, not by peer
With the flows liveness fix the requirements are actually evaluated
once the IDLs are up, and the chassis bridge patch_port_ofport
selection crashed on the agent: Interface.peer is not registered in
the agent's OVS IDL (observed live: name, ofport and type are present
while peer is absent despite register_all), raising AttributeError on
every reconciliation tick.
The patch port is identified by its name instead: ovn-controller
names the localnet patch port of the per-chassis BGP logical switch
patch-<LSP name>-to-br-int, and the LSP name is derived from the
chassis name and the bridge name exactly as the agent creates it
(bgp-lsp-bgp-ls-<chassis>-<bridge>-localnet, verified against the lab
chassis). Drop the now unused idlutils import and renumber the
liveness patch hunks accordingly.
commit 0fb2de3bc3b23c9e1acfaf0edec3de70446310de
Author: Thomas Goirand <zigo@debian.org>
Date: Sat Nov 14 01:06:56 2026 +0100
Gate the BGP agent SB/NB readiness on the post-fork events
The liveness patch resolved the SB/NB/OVS API handles from the
ovsdbapp Backend class attribute (_ovsdb_connection + is_running).
Neutron ships its own Backend subclass for the OVN schemas which
deliberately scopes the ovsdbapp connection per instance (a plain
ovsdb_connection = None class attribute shadowing the ovsdbapp
property in the MRO), so the class attribute stays None forever for
the SB/NB API classes: the readiness check reported "not connected"
on every reconciliation tick even with the IDLs up (observed live on
the lab compute: the agent idle with the SB/NB sockets established).
Gate the SB/NB readiness on the OVNAgentExtensionAPI post-fork
events instead (set exactly when the agent assigns the loaded IDL
objects), fetch the API objects through the agent_api accessors
behind the gate, and take the OVS handle from the agent too. Rework
the unit tests accordingly (stub the post-fork events and the OVS
external_ids read).
commit 5ca4d4a36714cade577096dcdeaf4d96319789d6
Author: Thomas Goirand <zigo@debian.org>
Date: Sat Nov 14 00:18:53 2026 +0100
* Seeded the SB Static_MAC_Binding of the BGP leak route nexthop (the
tenant router's external gateway port is bound to no chassis so
nobody answers ARP for it on the BGP interconnect logical switch,
the leaked subnet was only reachable through a hand-inserted
MAC_Binding row):
- ovn-bgp-2-host_seed-leak-nexthop-mac-binding.patch
commit 09f95a747241ffbd438a7506d2c1c89b57c5808d
Author: Thomas Goirand <zigo@debian.org>
Date: Sat Nov 14 00:07:34 2026 +0100
* Fixed the BGP agent flows liveness: the event threads no longer block
on the SB/NB IDL readiness (they froze silently and never applied any
BGP flow when the OVN SB server was slow or unreachable at agent
start, and a failed flow bundle was never retried), configure_flows
is idempotent per requirements generation, and a dedicated
reconciliation thread re-applies the flows when requirements become
met:
- ovn-bgp-2-host_fix-bgp-agent-flows-liveness.patch
commit a6c72598ee628851d48f61666b4874e22b649624
Author: Thomas Goirand <zigo@debian.org>
Date: Fri Nov 13 21:28:01 2026 +0100
Fixed the BGP agent bridge-mapping parsing keying mappings by bridge
name, which collapsed "external:br-ex" and the agent's own
"br-ex:br-ex" self-mapping into one entry, made the agent re-write
ovn-bridge-mappings on every event, dropping the external mapping so
ovn-controller destroyed the provider and interconnect localnet patch
ports, blackholing fabric-to-tenant traffic:
- ovn-bgp-2-host_fix-bgp-agent-bridge-mapping-parsing.patch
commit 30c0619cff7e58c6753dd41cb86118bb94946c81
Author: Thomas Goirand <zigo@debian.org>
Date: Wed Nov 11 14:57:01 2026 +0100
Prefix our quilt patches with ovn-bgp-2-host_
Rename the four patches written for the BGP-2-the-host campaign so
their filenames carry the campaign prefix (underscore before the
topic), and update debian/patches/series and the changelog bullet
references accordingly. No patch content is changed.
commit 10dc78b00e570069f55f776f70929ae5ecc702d2
Author: Thomas Goirand <zigo@debian.org>
Date: Wed Nov 11 14:43:15 2026 +0100
Refreshed segment-notifier patch to remove hunk offsets
fix-test-segment-notifier-batch-wait.patch applied with two 20-line
hunk offsets; dpkg-source tolerates offsets but the quilt hygiene rule
requires a queue that applies without any warnings. Refresh only moves
the hunks: the applied content is identical.
commit f74c819ef3c7b554a46b2f2743317ffa9c93c393
Author: Thomas Goirand <zigo@debian.org>
Date: Wed Nov 11 14:43:08 2026 +0100
Added patch limiting BGP learned-route LRP exposure
ovn-controller attaches learned routes to every logical router port of
the dynamic-routing routers except those carrying the
dynamic-routing-no-learning option. Upstream only stamps that option on
the chassis-router-side LRP of the chassis/main peering, leaving the
main router's interconnect LRP and the chassis routers' provider
network LRPs learning. Learned routes landing there render the provider
subnet as ECMP with an unreachable next-hop, flapping the floating IP
return path with roughly 50% packet loss.
Stamp both LRP families with dynamic-routing-no-learning so learned
routes only ever attach to the main router's chassis peering LRPs,
which carry the neutron-bgp-lrp-to-chassis-router external ID and are
the ports the static MAC binding seeding fix operates on. Both are
re-asserted at every reconciler full sync, so existing deployments
converge on agent restart without recreating ports.
commit f8e04983a2c373afb73ccb107bb3c57156e61e8b
Author: Thomas Goirand <zigo@debian.org>
Date: Tue Nov 10 21:06:51 2026 +0100
Added VIF re-attach extension patch for OVN agent
New quilt patch: a "vif-reattach" OVN agent extension, always on,
which re-converges the OVS plugging state of VM ports from the
Port_Binding and OVS lifecycle events. When the OVS Interface row of
a bound VM port goes missing (an OVS database restore, a wiped
bridge, as seen during the OpenVSwitch 4.0 upgrade incident),
ovn-controller waits forever for the interface and the VM stays
unreachable; the extension re-attaches the tap immediately on the OVS
Interface deletion and integration bridge re-creation events,
restores lost external_ids (iface-id, attached-macs, attached-ips)
on port updates, and cleans up leftover rows on unbind/delete.
Guards keep it out of other components' way: only VM Port_Bindings,
no vif-plug-type ports (SR-IOV representors), no interference with
live migrations (additional_chassis), interface type system-only for
cleanup, iface-id match for every mutation, and creation only when
the kernel device still exists (freshly bound ports stay with
os-vif). No periodic reconciliation, purely event-driven; converges
on the initial SB dump so the agent self-heals at startup.
Includes the stevedore entry point, 32 unit tests and 4 functional
tests on the OVN agent fixture.
commit 0dfa941589eed34aa2bd3c38789f535d250a6113
Author: Thomas Goirand <zigo@debian.org>
Date: Tue Nov 10 20:22:29 2026 +0100
Added patch seeding static MAC bindings for BGP
New quilt patch: the BGP agent extension now watches the SB
Learned_Route table (added to the agent's sb_idl table filter, with
Static_MAC_Binding and Datapath_Binding) and seeds a
Static_MAC_Binding row with override_dynamic_mac=true for every
learned route attached to a BGP main router peering LRP, resolving
the learned nexthop (the fabric peer's link-local address, imported
verbatim by ovn-controller) to the chassis router's peering LRP MAC,
derived deterministically from the peer LRP name. Without this, the
MAC binding lookup resolves dynamically to the fabric peer's own MAC,
which the peering link never delivers to, blackholing all traffic
coming from the BGP fabric on the BGP main router. Learned routes on
other routers' peerings are ignored.
Lab-verified on the OVN BGP dynamic-routing setup: this is the
"MAC_Binding flip + static pinning" recipe, made automatic.
commit 0814d59d49bb3518770b4906747c5c29c07fda77
Author: Thomas Goirand <zigo@debian.org>
Date: Tue Nov 10 20:07:38 2026 +0100
Added patch fixing BGP bridge patch port selection
The BGP chassis bridge's patch_port_ofport() returned the first patch
port found on the provider bridge, steering wire-side frames into the
wrong logical switch when the bridge carries multiple patch ports
(BGP localnet, provider network, interconnect localnet). The patch
port is now selected by the iface-id of its peer interface on the
integration bridge, which carries the localnet LSP name of the
per-chassis BGP logical switch.
Added patch fixing the BGP chassis bridge patch port selection when
the provider bridge carries multiple patch ports:
- fix-bgp-agent-wrong-patch-port.patch
Among the 15 debian patches available in version 2:29.0.0-9 of the package, we noticed the following issues:
Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.
Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/n/neutron.png){kind=link}