Reviewed: https://review.opendev.org/c/openstack/neutron/+/945013 Committed: https://opendev.org/openstack/neutron/commit/507e7a9ee3860718c50b36066bf025a4d107e77f Submitter: "Zuul (22348)" Branch: unmaintained/yoga
commit 507e7a9ee3860718c50b36066bf025a4d107e77f Author: Robert Breker <[email protected]> Date: Sun Mar 17 14:43:50 2024 +0000 Enhance IptablesFirewallDriver with remote address groups This change enhances the IptablesFirewallDriver with support for remote address groups. Previously, this feature was only available in the OVSFirewallDriver. This commit harmonizes the capabilities across both firewall drivers, and by inheritance also to OVSHybridIptablesFirewallDriver. Background - The Neutron API allows operators to configure remote address groups [1], however the OVSHybridIptablesFirewallDriver and IptablesFirewallDriver do not implement these remote group restrictions. When configuring security group rules with remote address groups, connections get enabled based on other rule parameters, ignoring the configured remote address group restrictions. This behaviour undocumented, and may lead to more-open-than-configured network access. Closes-Bug: #2058138 Change-Id: I76b3cb46ee603fa5e829537af41316bb42a6f30f (cherry picked from commit 5e1188ef38da3f196aadf82a3842fa982c9a0c83) ** Changed in: cloud-archive/yoga Status: New => Fix Committed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2058138 Title: Neutron OVSHybridIptablesFirewallDriver and IptablesFirewallDriver don't enforce Remote address groups To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/2058138/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
