Remove checksum checks/fill, they are not needed any longer

We currently run the agents on bare metal so the workaround for
checksums is no longer necessary.

The checksum fill option, was useful a long time ago, but at this point
its just some lovely technical debt that we carry around like an old
dirty security blanket. This change sets us free from the sins of our
past.

This is a combined backport of https://review.openstack.org/593090
and https://review.openstack.org/591882 which were squashed into
https://review.openstack.org/590778.

Change-Id: I9a8cfd33ad43e50584819b84172d7ba84532f695
This commit is contained in:
Mohammed Naser
2018-08-17 11:47:22 -04:00
committed by Jesse Pretorius (odyssey4me)
parent 9a0a07d3d2
commit c3ec490f65
4 changed files with 2 additions and 13 deletions

View File

@@ -1,8 +1,8 @@
## The default networking requires several bridges. These bridges were named to be informative
## however they can be named what ever you like and is adaptable to any network infrastructure
## environment. This file serves as an example of how to setup basic networking and was ONLY
## environment. This file serves as an example of how to setup basic networking and was ONLY
## built for the purpose of being an example and used expressly in the building of an ALL IN
## ONE development environment.
## ONE development environment.
auto br-mgmt
iface br-mgmt inet static
@@ -24,9 +24,6 @@ iface br-vxlan inet static
address 172.29.240.100
netmask 255.255.252.0
offload-sg off
# To ensure ssh checksum is correct
up /sbin/iptables -A POSTROUTING -t mangle -p tcp --dport 22 -j CHECKSUM --checksum-fill
down /sbin/iptables -D POSTROUTING -t mangle -p tcp --dport 22 -j CHECKSUM --checksum-fill
# To provide internet connectivity to instances
up /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
down /sbin/iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

View File

@@ -204,9 +204,6 @@ bridge_vlan_state_change_scripts: |
pre-up ip link set eth12 up
post-down ip link del br-vlan-veth || true
bridge_iptables_rules: |
# To ensure ssh checksum is correct
up /sbin/iptables -A POSTROUTING -t mangle -p tcp -o {{ bootstrap_host_public_interface }} -j CHECKSUM --checksum-fill
down /sbin/iptables -D POSTROUTING -t mangle -p tcp -o {{ bootstrap_host_public_interface }} -j CHECKSUM --checksum-fill
# To provide internet connectivity to instances
up /sbin/iptables -t nat -A POSTROUTING -o {{ bootstrap_host_public_interface }} -j MASQUERADE
down /sbin/iptables -t nat -D POSTROUTING -o {{ bootstrap_host_public_interface }} -j MASQUERADE

View File

@@ -213,7 +213,6 @@
RemainAfterExit: yes
service_type: oneshot
execstarts:
- "-/sbin/iptables -A POSTROUTING -t mangle -p tcp --dport 22 -j CHECKSUM --checksum-fill"
- "-/sbin/iptables -t nat -A POSTROUTING -o {{ bootstrap_host_public_interface }} -j MASQUERADE"
- "-/sbin/ethtool -K bond0 gso off sg off tso off tx off"
- "-/sbin/ethtool -K bond1 gso off sg off tso off tx off"
@@ -233,7 +232,6 @@
- "-/bin/ip link set br-lbaas-veth up"
- "-/sbin/ethtool -K eth14 gso off sg off tso off tx off"
execstops:
- "/sbin/iptables -D POSTROUTING -t mangle -p tcp --dport 22 -j CHECKSUM --checksum-fill"
- "/sbin/iptables -t nat -D POSTROUTING -o {{ bootstrap_host_public_interface }} -j MASQUERADE"
enabled: yes
state: started

View File

@@ -29,9 +29,6 @@ galera_innodb_log_buffer_size: 4M
galera_wsrep_provider_options:
- { option: "gcache.size", value: "4M" }
## Neutron settings
neutron_metadata_checksum_fix: True
### Set workers for all services to optimise memory usage
## Repo