Reviewed: https://review.openstack.org/495657
Committed:
https://git.openstack.org/cgit/openstack/neutron-fwaas/commit/?id=0fac0d515a0cf5696a37dcde4fb2fdff88a8b537
Submitter: Jenkins
Branch: master
commit 0fac0d515a0cf5696a37dcde4fb2fdff88a8b537
Author: Elena Ezhova <eezh...@mirantis.com>
Date: Mon Aug 21 01:08:13 2017 +0400
Fix router update on L3 agent restart
Currently on L3 agent restart FWaaS L3 agent extension
_process_router_update iterates over all router ports and
trigger firewall group update if a port belong to it.
In case when a firewall group contains several ports iptables rules
get re-written each time and in the result only the chains for
the last port in a loop remain.
With this change each firewall group would be updated with a full
list of a router ports that belong to it. Additionaly, refactor of
the _process_router_update method reduced its complexity and made
it more readable.
If a router would appear to have ports associated with several
firewall groups a warning would be emitted.
Added a unit test.
Closes-Bug: #1712075
Change-Id: I251f4f50578cd10da904a56e1622c18f2adf2d18
** Changed in: neutron
Status: In Progress => Fix Released
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1712075
Title:
[FWaaS v2] L3 agent restart breaks firewall iptables configuration for
router ports
Status in neutron:
Fix Released
Bug description:
*Seen on:* Pike and master devstack with FWaaS v2
*Scenario:*
1. Create deny_icmp rule, a policy, a fw group, security group with all
allowed.
2. Create 1 router, 2 subnets, fw group assigned to router ports.
3. Boot a VM in each subnet
4. Check that iptables rules are applied and it is impossible to ping VMs by
floating IP or from qrouter namespace
5. Restart L3 agent
*Expected result:*
After the restart iptables rules are reapplied in the same way and the
traffic is still blocked.
*Actual result:*
In case when a firewall group contains several ports iptables rules get
re-written for each port and in the result only the chains for the last port in
a loop remain.
Example scenario: http://paste.openstack.org/show/618908/
To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1712075/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
