Slawek Kaplonski 580e57b2ad [OVS FW] Allow egress ICMPv6 only for know addresses ... Before that patch it was possible to send ICMPv6 packets like e.g. neutron_lib.constants.ICMPV6_TYPE_MLD_QUERY, neutron_lib.constants.ICMPV6_TYPE_RS, neutron_lib.constants.ICMPV6_TYPE_NS, neutron_lib.constants.ICMPV6_TYPE_NA And that could cause some security issues as instance could advertise that it owns IPv6 address which really don't belong to it. Now rules in table=71 which allows that traffic are "per mac/ipaddress" and are allowed only for fixed ips allocated to port and port's allowed_address_pairs. Closes-Bug: #1902917 Change-Id: I4749fdc6a6cabd253b971bf4010ff76f5593c59c (cherry picked from commit 4b5bcff64c)		2021-02-27 20:10:39 +00:00
..
__init__.py	Open vSwitch conntrack based firewall driver	2016-02-16 16:47:21 +00:00
constants.py	remove neutron.common.constants	2019-04-04 14:10:26 -06:00
exceptions.py	ovsfw: Don't create rules if updated port doesn't exist	2018-01-05 16:28:18 +00:00
firewall.py	[OVS FW] Allow egress ICMPv6 only for know addresses	2021-02-27 20:10:39 +00:00
iptables.py	remove neutron.common.constants	2019-04-04 14:10:26 -06:00
rules.py	[Security] fix allowed-address-pair 0.0.0.0/0 issue	2020-03-21 17:54:34 +08:00