GRE firewall rule is incorrect

[Brent Eagles]

GRE tenant networks do not work with the current firewall rule.
From https://bugzilla.redhat.com/show_bug.cgi?id=1397964:

controller nodes have following iptables rule for allowing gre tunneling for Neutron:
-A INPUT -p gre -m comment --comment "136 neutron gre networks" -m state --state NEW -j ACCEPT

But gre doesn't support conntrack which means this rule won't get matched and all GRE packets coming to controller nodes are rejected. Including DHCP discoveries, so impact is that instances never get IP.

The iptables rule shouldn't use -m state and allow all GRE packets.

Version-Release number of selected component (if applicable):
openstack-tripleo-heat-templates-5.1.0-3.el7ost.noarch

How reproducible:
Always

Steps to Reproduce:
1. Deploy OSP 10 with director
2. Create GRE tenant network
3. Boot instance on GRE network

Actual results:
Instance won't get IP address because GRE packets on controllers are dropped

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/401461

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/401461
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=688a79c6c68422c0f873074370b1bbc87c6d1007
Submitter: Jenkins
Branch: master

commit 688a79c6c68422c0f873074370b1bbc87c6d1007
Author: Brent Eagles <email address hidden>
Date: Wed Nov 23 18:59:58 2016 -0330

    Do not configure state matching when using GRE

    The firewall rule quite reasonably sets up a default state matching rule
    but this is invalid for GRE. This patch conditionally adds the state
    matching if the protocol is not GRE.

    Closes-Bug: #1644360
    Change-Id: Ie4ca41d0f36e79ba6822c358e21b827105736dd7

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/402709

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/402709
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=0626631cf0619110b71ce23b843d431bcc46124e
Submitter: Jenkins
Branch: stable/newton

commit 0626631cf0619110b71ce23b843d431bcc46124e
Author: Brent Eagles <email address hidden>
Date: Wed Nov 23 18:59:58 2016 -0330

    Do not configure state matching when using GRE

    The firewall rule quite reasonably sets up a default state matching rule
    but this is invalid for GRE. This patch conditionally adds the state
    matching if the protocol is not GRE.

    Closes-Bug: #1644360
    Change-Id: Ie4ca41d0f36e79ba6822c358e21b827105736dd7
    (cherry picked from commit 688a79c6c68422c0f873074370b1bbc87c6d1007)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 6.1.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 5.5.0 release.