Add metadata checksum fix for AIO-type networks configs

When running in an AIO, we need to implement an iptables rule in any
neutron_agent containers to that ensure instances can communicate with
the neutron metadata service. This is necessary because in an AIO
environment there are no physical interfaces involved in instance ->
metadata requests, and this results in the checksums being incorrect.

This is a necessary patch in order to work towards getting rid of the
run-playbooks.sh script in the integrated repository. With this patch
in place we will be able to set the AIO to activate this code path by
setting 'neutron_metadata_checksum_fix: True' in the AIO's
user_variables.yml, forgoing the needs to implement this in a bash
script.

Change-Id: I008bfdb2960800845703e721b38640b7434d1404

defaults/main.yml

@@ -405,6 +405,13 @@ neutron_service_in_ldap: false
 # neutron_local_ip is used for the VXLAN local tunnel endpoint
 neutron_local_ip: 127.0.0.1
 
+# When running in an AIO, we need to implement an iptables rule in any
+# neutron_agent containers to that ensure instances can communicate with
+# the neutron metadata service. This is necessary because in an AIO
+# environment there are no physical interfaces involved in instance ->
+# metadata requests, and this results in the checksums being incorrect.
+neutron_metadata_checksum_fix: False
+
 # neutron packages that must be installed before anything else
 neutron_requires_pip_packages:
   - virtualenv

files/post-up-metadata-checksum

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Copyright 2016, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# NOTICE:
+# When running in an AIO, we need to drop the following iptables rule in any
+# neutron_agent containers to that ensure instances can communicate with the
+# neutron metadata service. This is necessary because in an AIO environment
+# there are no physical interfaces involved in instance -> metadata requests,
+# and this results in the checksums being incorrect.
+
+# Iptables path, used for ipv4 firewall.
+IPTABLES=$(which iptables)
+if [ ! -z "${IPTABLES}" ]; then
+    if ! ${IPTABLES} -C POSTROUTING -t mangle -p tcp --sport 80 -j CHECKSUM --checksum-fill 2> /dev/null; then
+        ${IPTABLES} -A POSTROUTING -t mangle -p tcp --sport 80 -j CHECKSUM --checksum-fill
+    fi
+fi
+
+# Ip6tables path, used for ipv6 firewall.
+IP6TABLES=$(which ip6tables)
+if [ ! -z "${IP6TABLES}" ]; then
+    if ! ${IP6TABLES} -C POSTROUTING -t mangle -p udp --sport 80 -j CHECKSUM --checksum-fill 2> /dev/null; then
+        ${IP6TABLES} -A POSTROUTING -t mangle -p udp --sport 80 -j CHECKSUM --checksum-fill
+    fi
+fi

tasks/neutron_post_install.yml

@@ -156,3 +156,26 @@
   tags:
     - sudoers
     - neutron-sudoers
+
+- name: Drop metadata iptables checksum fix
+  copy:
+    src: "post-up-metadata-checksum"
+    dest: "/etc/network/if-up.d/post-up-metadata-checksum"
+    owner: "root"
+    group: "root"
+    mode: "0755"
+  when:
+    - neutron_metadata_checksum_fix | bool
+    - inventory_hostname in groups[neutron_services['neutron-linuxbridge-agent']['group']]
+  tags:
+    - neutron-config
+    - neutron-checksum-fix
+
+- name: Run metadata iptables checksum fix
+  command: /etc/network/if-up.d/post-up-metadata-checksum
+  when:
+    - neutron_metadata_checksum_fix | bool
+    - inventory_hostname in groups[neutron_services['neutron-linuxbridge-agent']['group']]
+  tags:
+    - neutron-config
+    - neutron-checksum-fix