Incorrect iptables INPUT rules on l3-agent for metadata proxy

[Cedric Brandily]

On the l3-agent, 2 iptables rules are defined to ensure the metadata proxy is reachable from vms on 169.254.169.254:80:
* REDIRECT 169.254.169.254:80 packets to the router on port 9697(metadata proxy port)
    -A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9697
* ACCEPT traffic to 127.0.0.1 on port 9697
    -A neutron-l3-agent-INPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 9697 -j ACCEPT

The 2nd rule is invalid as REDIRECT replaces destination ip by:
 * router ip (the one on the input interface)
 * 127.0.0.1 if the packet is a LOCAL packet (not metadata proxy case).

So ACCEPT rule filter is not matched ... the metadata proxy is only reachable because INPUT policy is ACCEPT.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/141045

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/141045
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=2d9d77747d2a16a1bf944e15bf5a7b6fc5e3fe08
Submitter: Jenkins
Branch: master

commit 2d9d77747d2a16a1bf944e15bf5a7b6fc5e3fe08
Author: Cedric Brandily <email address hidden>
Date: Thu Dec 11 13:10:30 2014 +0000

    Correct l3-agent iptables rule for metadata proxy

    2 iptables rules are defined to ensure the metadata proxy is reachable
    from vms on 169.254.169.254:80:
    * REDIRECT 169.254.169.254:80 packets to the router on port 9697
    * ACCEPT traffic to 127.0.0.1 on port 9697

    The REDIRECT rule replaces destination ip by:
     * 127.0.0.1 if the packet is local,
     * router ip (the one on the input interface, metadata proxy case).

    So ACCEPT rule filter is not matched ... the metadata proxy is only
    reachable because INPUT policy is ACCEPT.

    This change removes the destination constraint in the ACCEPT rule.

    Change-Id: Iea700bdd121bbc56a3489a63e2a5391867fad0d6
    Closes-Bug: #1399462