Reviewed: https://review.opendev.org/755766 Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=f57b59a1791d5d5bf2b7a7d292fc36cfa1cec9c9 Submitter: Zuul Branch: master
commit f57b59a1791d5d5bf2b7a7d292fc36cfa1cec9c9 Author: Slawek Kaplonski <[email protected]> Date: Fri Oct 2 13:26:27 2020 +0200 [Doc] Add section about diffs between ovs and iptables fw drivers And add note about different handling of packets marked as INVALID by both those drivers. Change-Id: I3d436289073e95312e5f5077acabd136266b9e8a Closes-Bug: #1896587 ** Changed in: neutron Status: In Progress => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to neutron. https://bugs.launchpad.net/bugs/1896587 Title: iptables firewall driver don't drops invalid packets which match some SG rule Status in neutron: Fix Released Bug description: In case if there is e.g. SG rule which allows SCTP traffic defined by user, iptables firewall driver will match such traffic always, even if it's marked as INVALID by conntrack. It is like that due to order of rules in iptables: Chain neutron-openvswi-i0133d93d-e (1 references) pkts bytes target prot opt in out source destination 61 5493 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */ 2 728 RETURN udp -- * * 0.0.0.0/0 10.0.0.55 udp spt:67 dpt:68 0 0 RETURN udp -- * * 0.0.0.0/0 255.255.255.255 udp spt:67 dpt:68 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 match-set NIPv408140248-6eff-4e0d-aadf- src 0 0 RETURN sctp -- * * 0.0.0.0/0 0.0.0.0/0 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */ 0 0 neutron-openvswi-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0 /* Send unmatched traffic to the fallback chain. */ In case of openvswitch firewall driver it works properly, so INVALID packets are dropped even if they could match some SG rules. To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1896587/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : [email protected] Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp
