neutron/neutron/tests/functional
LIU Yulong 64a0916d2b [Security] fix allowed-address-pair 0.0.0.0/0 issue
When add allowed-address-pair 0.0.0.0/0 to one port, it will
unexpectedly open all others' protocol under same security
group. IPv6 has the same problem.

The root cause is the openflow rules calculation of the
security group, it will unexpectedly allow all IP(4&6)
traffic to get through.

For openvswitch openflow firewall, this patch adds a source
mac address match for the allowed-address-pair which has
prefix lenght 0, that means all ethernet packets from this
mac will be accepted. It exactly will meet the request of
accepting any IP address from the configured VM.

Test result shows that the remote security group and
allowed address pair works:
1. Port has 0.0.0.0/0 allowed-address-pair clould send any
   IP (src) packet out.
2. Port has x.x.x.x/y allowed-address-pair could be accepted
   for those VMs under same security group.
3. Ports under same network can reach each other (remote
   security group).
4. Protocol port number could be accessed only when there
   has related rule.

Closes-bug: #1867119
Change-Id: I2e3aa7c400d7bb17cc117b65faaa160b41013dde
(cherry picked from commit 00298fe6e8)
2020-07-31 11:23:18 +00:00
..
agent [Security] fix allowed-address-pair 0.0.0.0/0 issue 2020-07-31 11:23:18 +00:00
api consume neutron-lib resources attr map 2018-03-09 13:37:28 -07:00
cmd Removing deprecated function 'IPWrapper.get_namespaces()' 2018-04-03 19:52:52 +00:00
common Untangle WaitTimeout class from eventlet.TimeoutError 2017-03-15 04:27:00 +00:00
db Add new test decorator skip_if_timeout 2019-02-20 10:54:38 +01:00
pecan_wsgi fix a typo: s/paramater/parameter 2018-06-04 07:35:10 +00:00
plugins use neutron_lib's portbindings api-def 2017-03-31 09:16:22 -06:00
sanity sanity check: Check that ip_nonlocal_bind works with namespaces 2016-11-18 08:36:51 -05:00
scheduler Remove router_ids argument to auto_schedule_routers() 2017-12-04 15:07:29 -05:00
services [DVR] Related routers should be included if are requested 2020-07-10 13:30:47 +00:00
tests make net_helpers functions work on OpenSUSE 2017-09-20 09:59:44 -07:00
__init__.py tests: removed 'retargetable' framework 2017-05-02 16:45:49 +00:00
base.py Increase timeouts for OVSDB in functional tests 2019-09-13 10:57:24 +00:00
constants.py TrunkManager for the OVS agent 2016-08-24 02:52:17 -04:00
requirements.txt Don't return null-byte separated string from ExternalProcess.cmdline() 2017-03-08 07:50:51 +00:00
test_server.py Fix W503 pep8 warnings 2018-04-17 14:22:58 +00:00
test_service.py Use SIGUSR1 to notify l3 agent of changing prefix file 2015-11-13 17:53:47 +03:00