openstack/neutron
Code Issues Proposed changes

Merge "When converting sg rules to iptables, do not emit dport if not supported" into stable/queens

Browse Source
This commit is contained in:
Zuul 2019-03-12 18:43:17 +00:00 committed by Gerrit Code Review
commit 4aaab7100f
2 changed files with 29 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
neutron/agent/linux/iptables_firewall.py
View File

@ -46,6 +46,15 @@ IPSET_DIRECTION = {firewall.INGRESS_DIRECTION: 'src',
comment_rule = iptables_manager.comment_rule
libc = ctypes.CDLL(util.find_library('libc.so.6'))
# iptables protocols that support --dport and --sport
IPTABLES_PORT_PROTOCOLS = [
constants.PROTO_NAME_DCCP,
constants.PROTO_NAME_SCTP,
constants.PROTO_NAME_TCP,
constants.PROTO_NAME_UDP,
constants.PROTO_NAME_UDPLITE
]
def get_hybrid_port_name(port_name):
return (constants.TAP_DEVICE_PREFIX + port_name)[:n_const.LINUX_DEV_LEN]
@ -729,7 +738,8 @@ class IptablesFirewallDriver(firewall.FirewallDriver):
# icmp code can be 0 so we cannot use "if port_range_max" here
if port_range_max is not None:
args[-1] += '/%s' % port_range_max
elif port_range_min == port_range_max:
elif protocol in IPTABLES_PORT_PROTOCOLS:
if port_range_min == port_range_max:
args += ['--%s' % direction, '%s' % (port_range_min,)]
else:
args += ['-m', 'multiport', '--%ss' % direction,

14
neutron/tests/unit/agent/linux/test_iptables_firewall.py
View File

@ -276,6 +276,20 @@ class IptablesFirewallTestCase(BaseIptablesFirewallTestCase):
egress = None
self._test_prepare_port_filter(rule, ingress, egress)
def test_filter_bad_vrrp_with_dport(self):
rule = {'ethertype': 'IPv4',
'direction': 'ingress',
'protocol': 'vrrp',
'port_range_min': 10,
'port_range_max': 10}
# Dest port isn't support with VRRP, so don't send it
# down to iptables.
ingress = mock.call.add_rule('ifake_dev',
'-p vrrp -j RETURN',
top=False, comment=None)
egress = None
self._test_prepare_port_filter(rule, ingress, egress)
def test_filter_ipv4_ingress_tcp_port_by_num(self):
rule = {'ethertype': 'IPv4',
'direction': 'ingress',