b8be1a05fa
By default, if any multicast traffic sent to 224.0.0.X is allowed in the OVS firewall (that means there is a specific egress rule), this traffic is sent, in table 73 (ACCEPT_OR_INGRESS_TABLE), to a rule with action NORMAL. As commented in the related bug, https://tools.ietf.org/html/rfc4541, chapter 2.1.2, section (2): "Packets with a destination IP (DIP) address in the 224.0.0.X range which are not IGMP must be forwarded on all ports." That means those packets will be forwarded to all ports regardless of any ingress rule. This patch process this traffic separately, sending those packets to table 102 (MCAST_RULES_INGRESS_TABLE). In this table the ingress rules that have a defined protocol, will have an Open Flow rule to output the traffic directly to those ports associated to this rule. For example, in the problem reported in the related bug, the VRRP protocol (112), will be sent only to those ports that have this ingress rule. Change-Id: Ie271de144f78e364d938731ec9f5297e1a9d73f9 Closes-Bug: #1889631
85 lines
3.2 KiB
Python
85 lines
3.2 KiB
Python
# Copyright (c) 2012 OpenStack Foundation.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
|
# implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
from neutron_lib import constants
|
|
|
|
# NOTE(boden): This module is common constants for neutron only.
|
|
# Any constants used outside of neutron should go into neutron-lib.
|
|
|
|
|
|
# Security group protocols that support ports
|
|
SG_PORT_PROTO_NUMS = [
|
|
constants.PROTO_NUM_DCCP,
|
|
constants.PROTO_NUM_SCTP,
|
|
constants.PROTO_NUM_TCP,
|
|
constants.PROTO_NUM_UDP,
|
|
constants.PROTO_NUM_UDPLITE
|
|
]
|
|
|
|
SG_PORT_PROTO_NAMES = [
|
|
constants.PROTO_NAME_DCCP,
|
|
constants.PROTO_NAME_SCTP,
|
|
constants.PROTO_NAME_TCP,
|
|
constants.PROTO_NAME_UDP,
|
|
constants.PROTO_NAME_UDPLITE
|
|
]
|
|
|
|
# iptables protocols that only support --dport and --sport using -m multiport
|
|
IPTABLES_MULTIPORT_ONLY_PROTOCOLS = [
|
|
constants.PROTO_NAME_UDPLITE
|
|
]
|
|
|
|
# Legacy IPv6 ICMP protocol list
|
|
IPV6_ICMP_LEGACY_PROTO_LIST = [constants.PROTO_NAME_ICMP,
|
|
constants.PROTO_NAME_IPV6_ICMP_LEGACY]
|
|
|
|
# Number of resources for neutron agent side functions to deal
|
|
# with large sets.
|
|
# Setting this value does not count on special conditions, it is just a human
|
|
# countable or scalable number. [1] gives us the method to test the scale
|
|
# issue. And we have tested the value of 1000, 500, 200, 100. But for 100,
|
|
# ovs-agent will have a lower timeout probability. And according to the
|
|
# testing result, step size 100 can indeed cost about 10% much more time
|
|
# than 500/1000. But such extra time looks inevitably needed to be sacrificed
|
|
# for the restart success rate.
|
|
# [1] http://paste.openstack.org/show/745685/
|
|
AGENT_RES_PROCESSING_STEP = 100
|
|
|
|
# Number of resources for neutron to divide the large RPC
|
|
# call data sets.
|
|
RPC_RES_PROCESSING_STEP = 20
|
|
|
|
# IPtables version to support --random-fully option.
|
|
# Do not move this constant to neutron-lib, since it is temporary
|
|
IPTABLES_RANDOM_FULLY_VERSION = '1.6.2'
|
|
|
|
# Segmentation ID pool; DB select limit to improve the performace.
|
|
IDPOOL_SELECT_SIZE = 100
|
|
|
|
# Ports with the following 'device_owner' values will not prevent
|
|
# network deletion. If delete_network() finds that all ports on a
|
|
# network have these owners, it will explicitly delete each port
|
|
# and allow network deletion to continue. Similarly, if delete_subnet()
|
|
# finds out that all existing IP Allocations are associated with ports
|
|
# with these owners, it will allow subnet deletion to proceed with the
|
|
# IP allocations being cleaned up by cascade.
|
|
AUTO_DELETE_PORT_OWNERS = [constants.DEVICE_OWNER_DHCP,
|
|
constants.DEVICE_OWNER_DISTRIBUTED]
|
|
|
|
# NOTE(ralonsoh): move to n-lib
|
|
# https://www.iana.org/assignments/multicast-addresses/
|
|
# multicast-addresses.xhtml#multicast-addresses-1
|
|
LOCAL_NETWORK_CONTROL_BLOCK = '224.0.0.0/24'
|