openstack
/
neutron
Code Issues Proposed changes

Merge "Always fill UDP checksums in DHCPv6 replies" into stable/pike

This commit is contained in:
Zuul 2019-02-12 05:31:27 +00:00 committed by Gerrit Code Review
parent e0c824b7f8 399f1c1b65
commit a940bfc737
3 changed files with 20 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
neutron/agent/linux/dhcp.py
View File

@ -1534,9 +1534,12 @@ class DeviceManager(object):
def fill_dhcp_udp_checksums(self, namespace):
"""Ensure DHCP reply packets always have correct UDP checksums."""
iptables_mgr = iptables_manager.IptablesManager(use_ipv6=False,
iptables_mgr = iptables_manager.IptablesManager(use_ipv6=True,
namespace=namespace)
ipv4_rule = ('-p udp -m udp --dport %d -j CHECKSUM --checksum-fill'
% constants.DHCP_RESPONSE_PORT)
ipv6_rule = ('-p udp -m udp --dport %d -j CHECKSUM --checksum-fill'
% n_const.DHCPV6_CLIENT_PORT)
iptables_mgr.ipv4['mangle'].add_rule('POSTROUTING', ipv4_rule)
iptables_mgr.ipv6['mangle'].add_rule('POSTROUTING', ipv6_rule)
iptables_mgr.apply()

3
neutron/common/constants.py
View File

@ -199,6 +199,9 @@ IP_ALLOWED_VERSIONS = [lib_constants.IP_VERSION_4, lib_constants.IP_VERSION_6]
PORT_RANGE_MIN = 1
PORT_RANGE_MAX = 65535
# TODO(bence romsics): move this to neutron_lib.constants
DHCPV6_CLIENT_PORT = 546
# Configuration values for accept_ra sysctl, copied from linux kernel
# networking (netdev) tree, file Documentation/networking/ip-sysctl.txt
#

17
neutron/tests/unit/agent/dhcp/test_agent.py
View File

@ -1570,8 +1570,10 @@ class TestDeviceManager(base.BaseTestCase):
iptables_cls = iptables_cls_p.start()
self.iptables_inst = mock.Mock()
iptables_cls.return_value = self.iptables_inst
self.mangle_inst = mock.Mock()
self.iptables_inst.ipv4 = {'mangle': self.mangle_inst}
self.mangle_inst_v4 = mock.Mock()
self.iptables_inst.ipv4 = {'mangle': self.mangle_inst_v4}
self.mangle_inst_v6 = mock.Mock()
self.iptables_inst.ipv6 = {'mangle': self.mangle_inst_v6}
self.mock_ip_wrapper_p = mock.patch("neutron.agent.linux.ip_lib."
"IPWrapper")
@ -1631,12 +1633,19 @@ class TestDeviceManager(base.BaseTestCase):
cfg.CONF.set_override('enable_metadata_network', True)
self._test_setup_helper(False)
def test_setup_calls_fill_dhcp_udp_checksums(self):
def test_setup_calls_fill_dhcp_udp_checksums_v4(self):
self._test_setup_helper(False)
rule = ('-p udp -m udp --dport %d -j CHECKSUM --checksum-fill'
% const.DHCP_RESPONSE_PORT)
expected = [mock.call.add_rule('POSTROUTING', rule)]
self.mangle_inst.assert_has_calls(expected)
self.mangle_inst_v4.assert_has_calls(expected)
def test_setup_calls_fill_dhcp_udp_checksums_v6(self):
self._test_setup_helper(False)
rule = ('-p udp -m udp --dport %d -j CHECKSUM --checksum-fill'
% n_const.DHCPV6_CLIENT_PORT)
expected = [mock.call.add_rule('POSTROUTING', rule)]
self.mangle_inst_v6.assert_has_calls(expected)
def test_setup_dhcp_port_doesnt_orphan_devices(self):
with mock.patch.object(dhcp.ip_lib, 'IPDevice') as mock_IPDevice: