Files

Isaku Yamahata 8aff29509f import neutron master of cba140daccd7c4f715263cda422d5cec27af069d

Merge Neutron master branch to tacker master branch with modification
of tox.ini and .gitreview.
This patch imports the following change set of Neutron.

  > commit cba140daccd7c4f715263cda422d5cec27af069d
  > Merge: 63d8237 6bed4a0
  > Author: Jenkins <jenkins@review.openstack.org>
  > Date:   Sun Jun 22 16:02:56 2014 +0000
  >
  >     Merge "Adding static routes data for members"

Change-Id: I5a0f522bc20530c46e35dc9e03fe72d72ad04577

2014-07-01 17:11:09 +09:00

2.5 KiB

Raw Blame History

Guided Tour: The Neutron Security Group API

https://wiki.openstack.org/wiki/Neutron/SecurityGroups

API Extension

The API extension is the 'front' end portion of the code, which handles defining a REST-ful API, which is used by tenants.

Database API

The Security Group API extension adds a number of methods to the database layer of Neutron

Agent RPC

This portion of the code handles processing requests from tenants, after they have been stored in the database. It involves messaging all the L2 agents running on the compute nodes, and modifying the IPTables rules on each hypervisor.

Plugin RPC classes
- SecurityGroupServerRpcCallbackMixin - defines the RPC API that the plugin uses to communicate with the agents running on the compute nodes
- SecurityGroupServerRpcMixin - Defines the API methods used to fetch data from the database, in order to return responses to agents via the RPC API
Agent RPC classes
- The SecurityGroupServerRpcApiMixin defines the API methods that can be called by agents, back to the plugin that runs on the Neutron controller
- The SecurityGroupAgentRpcCallbackMixin defines methods that a plugin uses to call back to an agent after performing an action called by an agent.

IPTables Driver

prepare_port_filter takes a port argument, which is a dictionary object that contains information about the port - including the security_group_rules
prepare_port_filter appends the port to an internal dictionary, filtered_ports which is used to track the internal state.
Each security group has a chain in Iptables.
The IptablesFirewallDriver has a method to convert security group rules into iptables statements

2.5 KiB Raw Blame History