** Changed in: neutron
Status: Fix Committed => Fix Released
** Changed in: neutron
Milestone: None => liberty-3
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1477553
Title:
Efficiently mark packets related to metadata agent
Status in neutron:
Fix Released
Bug description:
Actually when metadata is enabled on L3 agent, the following is
generated by L3 agent (only rules related to metadata are displayed in
the following) :
sudo ip netns exec qrouter-cad6171a-aa76-4e24-bf6d-dbbfb276c47a iptables -S
-t mangle
...
-A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80
-j MARK --set-xmark 0x1/0xffffffff
...
sudo ip netns exec qrouter-cad6171a-aa76-4e24-bf6d-dbbfb276c47a iptables -S
-t nat
...
-A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -i qr-+ -p tcp -m tcp
--dport 80 -j REDIRECT --to-ports 9697
...
sudo ip netns exec qrouter-cad6171a-aa76-4e24-bf6d-dbbfb276c47a iptables -S
-t filter
...
-A neutron-l3-agent-INPUT -m mark --mark 0x1 -j ACCEPT
-A neutron-l3-agent-INPUT -p tcp -m tcp --dport 9697 -j DROP
...
The mark 0x1 set in MANGLE table could be more restrictive to avoid
marking packets from external interfaces.
To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1477553/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : [email protected]
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
