Browse Source

When converting sg rules to iptables, do not emit dport if not supported

Since iptables-restore doesn't support --dport with protocol vrrp,
it errors out setting the security groups on the hypervisor.

Marking this a partial fix, since we need a change to prevent
adding those incompatible rules in the first place, but this
patch will stop the bleeding.

Change-Id: If5e557a8e61c3aa364ba1e2c60be4cbe74c1ec8f
Partial-Bug: #1818385
(cherry picked from commit 8c213e4590)
tags/11.0.7
Doug Wiegley 2 months ago
parent
commit
e53afe831a

+ 15
- 5
neutron/agent/linux/iptables_firewall.py View File

@@ -46,6 +46,15 @@ IPSET_DIRECTION = {firewall.INGRESS_DIRECTION: 'src',
46 46
 comment_rule = iptables_manager.comment_rule
47 47
 libc = ctypes.CDLL(util.find_library('libc.so.6'))
48 48
 
49
+# iptables protocols that support --dport and --sport
50
+IPTABLES_PORT_PROTOCOLS = [
51
+    constants.PROTO_NAME_DCCP,
52
+    constants.PROTO_NAME_SCTP,
53
+    constants.PROTO_NAME_TCP,
54
+    constants.PROTO_NAME_UDP,
55
+    constants.PROTO_NAME_UDPLITE
56
+]
57
+
49 58
 
50 59
 def get_hybrid_port_name(port_name):
51 60
     return (constants.TAP_DEVICE_PREFIX + port_name)[:n_const.LINUX_DEV_LEN]
@@ -735,11 +744,12 @@ class IptablesFirewallDriver(firewall.FirewallDriver):
735 744
             # icmp code can be 0 so we cannot use "if port_range_max" here
736 745
             if port_range_max is not None:
737 746
                 args[-1] += '/%s' % port_range_max
738
-        elif port_range_min == port_range_max:
739
-            args += ['--%s' % direction, '%s' % (port_range_min,)]
740
-        else:
741
-            args += ['-m', 'multiport', '--%ss' % direction,
742
-                     '%s:%s' % (port_range_min, port_range_max)]
747
+        elif protocol in IPTABLES_PORT_PROTOCOLS:
748
+            if port_range_min == port_range_max:
749
+                args += ['--%s' % direction, '%s' % (port_range_min,)]
750
+            else:
751
+                args += ['-m', 'multiport', '--%ss' % direction,
752
+                         '%s:%s' % (port_range_min, port_range_max)]
743 753
         return args
744 754
 
745 755
     def _ip_prefix_arg(self, direction, ip_prefix):

+ 14
- 0
neutron/tests/unit/agent/linux/test_iptables_firewall.py View File

@@ -275,6 +275,20 @@ class IptablesFirewallTestCase(BaseIptablesFirewallTestCase):
275 275
         egress = None
276 276
         self._test_prepare_port_filter(rule, ingress, egress)
277 277
 
278
+    def test_filter_bad_vrrp_with_dport(self):
279
+        rule = {'ethertype': 'IPv4',
280
+                'direction': 'ingress',
281
+                'protocol': 'vrrp',
282
+                'port_range_min': 10,
283
+                'port_range_max': 10}
284
+        # Dest port isn't support with VRRP, so don't send it
285
+        # down to iptables.
286
+        ingress = mock.call.add_rule('ifake_dev',
287
+                                     '-p vrrp -j RETURN',
288
+                                     comment=None)
289
+        egress = None
290
+        self._test_prepare_port_filter(rule, ingress, egress)
291
+
278 292
     def test_filter_ipv4_ingress_tcp_port_by_num(self):
279 293
         rule = {'ethertype': 'IPv4',
280 294
                 'direction': 'ingress',

Loading…
Cancel
Save