Comment 6 for bug 1428887

Reviewed: https://review.openstack.org/161947
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=5154d974fdce4625710d3b4f360d45568678eb2f
Submitter: Jenkins
Branch: master

commit 5154d974fdce4625710d3b4f360d45568678eb2f
Author: Itsuro Oda <email address hidden>
Date: Wed Feb 25 13:34:04 2015 +0900

    Make floatingip reachable from the same network

    The problem is that if one tries to communicate from a tenant network
    to floatingip which attached to a port on the same network, the
    communication fails.

    This problem is a regression cased by [1].
    [1] https://review.openstack.org/131905/

    Before [1] SNAT rule is as follows:
    -s %(internal_cidr)s -j SNAT --to-source ...
    (for each internal interface)

    After [1] SNAT rule is as follows:
    -o %(interface_name)s -j SNAT --to-source ...
    (for an external interface)

    The new rule was considered a super-set of the packets going out to
    the external interface compared to the old rules. This is true but
    there is a lack of consideration.

    Note that the packet is 'going out to external interface' OR 'DNATed'
    at this point since the rule:
    ! -o %(interdace_name)s -m conntrack ! --ctstate DNAT -j ACCEPT
    was applied already. So we should consider the following three cases.

    1) going out to external interface
    should be SNATed. It is OK under the new rule but there was a lack
    of rules for packets from indirectly connected to the router under the
    old rules. ([1] fixed this.)

    2) DNATed (and going out to internal interface)
    2-1) came in from internal interface
    should be SNATed because the return traffic needs to go through the
    router to complete the conntrack association and to reverse the effect
    of DNAT on the return packets. If a packet is not SNATed, the return
    packet may be sent directly to the private IP of the initiator.
    The old rules done SNAT in this case but the new rule doesn't.

    2-2) came in from external interface
    nothing to do.

    This patch adds a rule for the case 2-1).
    This patch also adds mangle rules to examine whether a packet came from
    external interface.

    Change-Id: Ifa695ac5428fb0edba60129a4d61ec0e127a5818
    Closes-Bug: #1428887