From 92db1d4a2c49b1f675b6a9552a8cc5a417973b64 Mon Sep 17 00:00:00 2001 From: leegy Date: Sun, 29 Oct 2017 05:35:55 +0000 Subject: [PATCH] Fix meter-label-rule creation The existing method is to meter outgoing traffic from the entire VM to a specific "remote_ip_addr"(in case of outbound), but the method I suggested can meter outgoing traffic from a particular subnet to external network. From a metering point of view, it does not matter which address/CIDR is the destination for outbound. But, it is important to know where(subnet or VM) the packet leaves from. That way you can see how much VMs are using the external network. For outbound metering, dst is 0.0.0.0/0 and src is network of VMs and for inbound metering, src is 0.0.0.0/0 and dst is network of VMs. When creating a meter-label-rule, it is correct to specify src address for "remote_ip_prefix" option for outbound and specify dst address for inbound. If you are confused by the term "remote_ip_prefix", you need to clarify this option. Change-Id: Ia3f3e26410a73d7b44abae637703fda41c4bc09a Closes-Bug: #1716913 --- .../drivers/iptables/iptables_driver.py | 4 +- .../metering/drivers/test_iptables.py | 38 +++++++++---------- 2 files changed, 21 insertions(+), 21 deletions(-) diff --git a/neutron/services/metering/drivers/iptables/iptables_driver.py b/neutron/services/metering/drivers/iptables/iptables_driver.py index 48b5eb79b63..e00d515c350 100644 --- a/neutron/services/metering/drivers/iptables/iptables_driver.py +++ b/neutron/services/metering/drivers/iptables/iptables_driver.py @@ -209,9 +209,9 @@ class IptablesMeteringDriver(abstract_driver.MeteringAbstractDriver): def _prepare_rule(self, ext_dev, rule, label_chain): remote_ip = rule['remote_ip_prefix'] if rule['direction'] == 'egress': - dir_opt = '-d %s -o %s' % (remote_ip, ext_dev) + dir_opt = '-s %s -o %s' % (remote_ip, ext_dev) else: - dir_opt = '-s %s -i %s' % (remote_ip, ext_dev) + dir_opt = '-d %s -i %s' % (remote_ip, ext_dev) if rule['excluded']: ipt_rule = '%s -j RETURN' % dir_opt diff --git a/neutron/tests/unit/services/metering/drivers/test_iptables.py b/neutron/tests/unit/services/metering/drivers/test_iptables.py index b04cdf89f37..aaaf16780d3 100644 --- a/neutron/tests/unit/services/metering/drivers/test_iptables.py +++ b/neutron/tests/unit/services/metering/drivers/test_iptables.py @@ -260,7 +260,7 @@ class IptablesDriverTestCase(base.BaseTestCase): '', wrap=False), mock.call.add_rule('neutron-meter-r-c5df2fe5-c60', - '-s 10.0.0.0/24 -i qg-6d411f48-ec' + '-d 10.0.0.0/24 -i qg-6d411f48-ec' ' -j neutron-meter-l-c5df2fe5-c60', wrap=False, top=False), mock.call.add_chain('neutron-meter-l-eeef45da-c60', @@ -274,7 +274,7 @@ class IptablesDriverTestCase(base.BaseTestCase): '', wrap=False), mock.call.add_rule('neutron-meter-r-eeef45da-c60', - '-d 20.0.0.0/24 -o qg-7d411f48-ec' + '-s 20.0.0.0/24 -o qg-7d411f48-ec' ' -j neutron-meter-l-eeef45da-c60', wrap=False, top=False)] @@ -331,7 +331,7 @@ class IptablesDriverTestCase(base.BaseTestCase): '', wrap=False), mock.call.add_rule('neutron-meter-r-c5df2fe5-c60', - '-s 10.0.0.0/24 -i qg-6d411f48-ec' + '-d 10.0.0.0/24 -i qg-6d411f48-ec' ' -j neutron-meter-l-c5df2fe5-c60', wrap=False, top=False), mock.call.add_chain('neutron-meter-l-eeef45da-c60', @@ -345,7 +345,7 @@ class IptablesDriverTestCase(base.BaseTestCase): '', wrap=False), mock.call.add_rule('neutron-meter-r-eeef45da-c60', - '-s 20.0.0.0/24 -i qg-7d411f48-ec' + '-d 20.0.0.0/24 -i qg-7d411f48-ec' ' -j RETURN', wrap=False, top=True)] @@ -383,17 +383,17 @@ class IptablesDriverTestCase(base.BaseTestCase): '', wrap=False), mock.call.add_rule('neutron-meter-r-c5df2fe5-c60', - '-s 10.0.0.0/24 -i qg-6d411f48-ec' + '-d 10.0.0.0/24 -i qg-6d411f48-ec' ' -j neutron-meter-l-c5df2fe5-c60', wrap=False, top=False), mock.call.empty_chain('neutron-meter-r-c5df2fe5-c60', wrap=False), mock.call.add_rule('neutron-meter-r-c5df2fe5-c60', - '-d 10.0.0.0/24 -o qg-6d411f48-ec' + '-s 10.0.0.0/24 -o qg-6d411f48-ec' ' -j RETURN', wrap=False, top=True), mock.call.add_rule('neutron-meter-r-c5df2fe5-c60', - '-s 20.0.0.0/24 -i qg-6d411f48-ec -j ' + '-d 20.0.0.0/24 -i qg-6d411f48-ec -j ' 'neutron-meter-l-c5df2fe5-c60', wrap=False, top=False)] @@ -426,17 +426,17 @@ class IptablesDriverTestCase(base.BaseTestCase): '', wrap=False), mock.call.add_rule('neutron-meter-r-c5df2fe5-c60', - '-s 10.0.0.0/24 -i qg-6d411f48-ec' + '-d 10.0.0.0/24 -i qg-6d411f48-ec' ' -j neutron-meter-l-c5df2fe5-c60', wrap=False, top=False), mock.call.add_rule('neutron-meter-r-c5df2fe5-c60', - '-s 20.0.0.0/24 -i qg-6d411f48-ec' + '-d 20.0.0.0/24 -i qg-6d411f48-ec' ' -j neutron-meter-l-c5df2fe5-c60', wrap=False, top=False), mock.call.empty_chain('neutron-meter-r-c5df2fe5-c60', wrap=False), mock.call.add_rule('neutron-meter-r-c5df2fe5-c60', - '-s 10.0.0.0/24 -i qg-6d411f48-ec' + '-d 10.0.0.0/24 -i qg-6d411f48-ec' ' -j neutron-meter-l-c5df2fe5-c60', wrap=False, top=False)] @@ -449,11 +449,11 @@ class IptablesDriverTestCase(base.BaseTestCase): self.metering.add_metering_label_rule(None, new_routers_rules) calls = [ mock.call.add_rule('neutron-meter-r-c5df2fe5-c60', - '-s 30.0.0.0/24 -i qg-6d411f48-ec' + '-d 30.0.0.0/24 -i qg-6d411f48-ec' ' -j neutron-meter-l-c5df2fe5-c60', wrap=False, top=False), mock.call.add_rule('neutron-meter-r-eeef45da-c60', - '-d 40.0.0.0/24 -o qg-7d411f48-ec' + '-s 40.0.0.0/24 -o qg-7d411f48-ec' ' -j neutron-meter-l-eeef45da-c60', wrap=False, top=False), ] @@ -480,7 +480,7 @@ class IptablesDriverTestCase(base.BaseTestCase): '', wrap=False), mock.call.add_rule('neutron-meter-r-e27fe2df-376', - '-s 50.0.0.0/24 ' + '-d 50.0.0.0/24 ' '-i qg-6d411f48-ec ' '-j neutron-meter-l-e27fe2df-376', top=False, @@ -539,11 +539,11 @@ class IptablesDriverTestCase(base.BaseTestCase): self.metering.remove_metering_label_rule(None, new_routers_rules) calls = [ mock.call.remove_rule('neutron-meter-r-c5df2fe5-c60', - '-s 30.0.0.0/24 -i qg-6d411f48-ec' + '-d 30.0.0.0/24 -i qg-6d411f48-ec' ' -j neutron-meter-l-c5df2fe5-c60', wrap=False, top=False), mock.call.remove_rule('neutron-meter-r-eeef45da-c60', - '-d 40.0.0.0/24 -o qg-7d411f48-ec' + '-s 40.0.0.0/24 -o qg-7d411f48-ec' ' -j neutron-meter-l-eeef45da-c60', wrap=False, top=False) ] @@ -566,7 +566,7 @@ class IptablesDriverTestCase(base.BaseTestCase): '', wrap=False), mock.call.add_rule('neutron-meter-r-c5df2fe5-c60', - '-s 10.0.0.0/24 -i qg-6d411f48-ec' + '-d 10.0.0.0/24 -i qg-6d411f48-ec' ' -j neutron-meter-l-c5df2fe5-c60', wrap=False, top=False), mock.call.remove_chain('neutron-meter-l-c5df2fe5-c60', @@ -613,7 +613,7 @@ class IptablesDriverTestCase(base.BaseTestCase): '', wrap=False), mock.call.add_rule('neutron-meter-r-c5df2fe5-c60', - '-s 10.0.0.0/24 -i qg-6d411f48-ec' + '-d 10.0.0.0/24 -i qg-6d411f48-ec' ' -j neutron-meter-l-c5df2fe5-c60', wrap=False, top=False), mock.call.add_chain('neutron-meter-l-eeef45da-c60', @@ -627,7 +627,7 @@ class IptablesDriverTestCase(base.BaseTestCase): '', wrap=False), mock.call.add_rule('neutron-meter-r-eeef45da-c60', - '-s 20.0.0.0/24 -i qg-7d411f48-ec' + '-d 20.0.0.0/24 -i qg-7d411f48-ec' ' -j RETURN', wrap=False, top=True), mock.call.remove_chain('neutron-meter-l-c5df2fe5-c60', @@ -645,7 +645,7 @@ class IptablesDriverTestCase(base.BaseTestCase): '', wrap=False), mock.call.add_rule('neutron-meter-r-c5df2fe5-c60', - '-s 10.0.0.0/24 -i qg-587b63c1-22' + '-d 10.0.0.0/24 -i qg-587b63c1-22' ' -j neutron-meter-l-c5df2fe5-c60', wrap=False, top=False)]