openstack
/
neutron
Code Issues Proposed changes

Merge "Enable ARP spoofing prevention by default"

This commit is contained in:
Jenkins 2015-04-15 00:36:38 +00:00 committed by Gerrit Code Review
parent 72c09c24c2 012840e2f5
commit bc688115ad
3 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini
View File

@ -106,7 +106,7 @@
# (e.g. bare metal or VMs attached to agents without this flag set to True).
# Requires a version of OVS that can match ARP headers.
#
# prevent_arp_spoofing = False
# prevent_arp_spoofing = True
# (BoolOpt) Set or un-set the don't fragment (DF) bit on outgoing IP packet
# carrying GRE/VXLAN tunnel. The default value is True.

2
neutron/plugins/openvswitch/common/config.py
View File

@ -74,7 +74,7 @@ agent_opts = [
"Allows the switch (when supporting an overlay) "
"to respond to an ARP request locally without "
"performing a costly ARP broadcast into the overlay.")),
cfg.BoolOpt('prevent_arp_spoofing', default=False,
cfg.BoolOpt('prevent_arp_spoofing', default=True,
help=_("Enable suppression of ARP responses that don't match "
"an IP address that belongs to the port from which "
"they originate. Note: This prevents the VMs attached "

1
neutron/tests/unit/plugins/openvswitch/agent/test_ovs_neutron_agent.py
View File

@ -106,6 +106,7 @@ class TestOvsNeutronAgent(base.BaseTestCase):
'neutron.agent.firewall.NoopFirewallDriver',
group='SECURITYGROUP')
cfg.CONF.set_default('quitting_rpc_timeout', 10, 'AGENT')
cfg.CONF.set_default('prevent_arp_spoofing', False, 'AGENT')
kwargs = ovs_neutron_agent.create_agent_config_map(cfg.CONF)
class MockFixedIntervalLoopingCall(object):