Commit: c6452a712e2cdd7b66329cd2cdaf41f9ce7027f1
Author: Kevin Benton <email address hidden>
Date: Thu Dec 10 14:30:46 2015
Process user iptables rules before INVALID
Process user-defined iptables rules before the INVALID DROP
rule. This is to allow scenarios where the VMs need to
legitimately receive packets that conntrack doesn't have an
entry for (e.g. SYN-ACK where the SYN wasn't sent by the VM).
A user can accomplish this by adding an allow rule that matches
the headers of these INVALID packets so they get permitted before
they hit the INVALID DROP rule.
Closes-Bug: #1515799
Cherry-pick from 58904f3626cdf09006bbb8ac9e60f9a24298f01e
Change-Id: Ie6ce5f3fa688f1bf25b77db5955211922d9fe85b
Reviewed: https:/ /review. fuel-infra. org/14560 ci/fuel- 6.1/2014. 2
Submitter: Vitaly Sedelnik <email address hidden>
Branch: openstack-
Commit: c6452a712e2cdd7 b66329cd2cdaf41 f9ce7027f1
Author: Kevin Benton <email address hidden>
Date: Thu Dec 10 14:30:46 2015
Process user iptables rules before INVALID
Process user-defined iptables rules before the INVALID DROP
rule. This is to allow scenarios where the VMs need to
legitimately receive packets that conntrack doesn't have an
entry for (e.g. SYN-ACK where the SYN wasn't sent by the VM).
A user can accomplish this by adding an allow rule that matches
the headers of these INVALID packets so they get permitted before
they hit the INVALID DROP rule.
Closes-Bug: #1515799
Cherry-pick from 58904f3626cdf09 006bbb8ac9e60f9 a24298f01e bf25b77db595521 1922d9fe85b
Change-Id: Ie6ce5f3fa688f1