commit 9a920fe0a561d36db95e27ac5673a9dba4d845d3
Author: Kevin Benton <email address hidden>
Date: Fri Mar 3 11:18:28 2017 -0800
Move conntrack zones to IPTablesFirewall
The regular IPTablesFirewall needs zones to support safely
clearly conntrack entries.
In order to support the single bridge use case, the conntrack
manager had to be refactored slightly to allow zones to be
either unique to ports or unique to networks.
Since all ports in a network share a bridge in the IPTablesDriver
use case, a zone per port cannot be used since there is no way
to distinguish which zone traffic should be checked against when
traffic enters the bridge from outside the system.
A zone per network is adequate for the single bridge per network
solution since it implicitly does not suffer from the double-bridge
cross in a single network that led to per port usage in OVS.[1]
This had to adjust the functional firewall tests to use the correct
bridge name now that it's relevant in the non hybrid IPTables case.
Reviewed: https:/ /review. openstack. org/455399 /git.openstack. org/cgit/ openstack/ neutron/ commit/ ?id=9a920fe0a56 1d36db95e27ac56 73a9dba4d845d3
Committed: https:/
Submitter: Jenkins
Branch: stable/ocata
commit 9a920fe0a561d36 db95e27ac5673a9 dba4d845d3
Author: Kevin Benton <email address hidden>
Date: Fri Mar 3 11:18:28 2017 -0800
Move conntrack zones to IPTablesFirewall
The regular IPTablesFirewall needs zones to support safely
clearly conntrack entries.
In order to support the single bridge use case, the conntrack
manager had to be refactored slightly to allow zones to be
either unique to ports or unique to networks.
Since all ports in a network share a bridge in the IPTablesDriver
use case, a zone per port cannot be used since there is no way
to distinguish which zone traffic should be checked against when
traffic enters the bridge from outside the system.
A zone per network is adequate for the single bridge per network
solution since it implicitly does not suffer from the double-bridge
cross in a single network that led to per port usage in OVS.[1]
This had to adjust the functional firewall tests to use the correct
bridge name now that it's relevant in the non hybrid IPTables case.
1. Ibe9e49653b2a28 0ea72cb95c2da64 cd94c7739da
Closes-Bug: #1668958 b712a7ec61eb932 748c38952cc ee3eb46b523a9ad 012f93dd51)
Closes-Bug: #1657260
Change-Id: Ie88237d3fe4807
(cherry picked from commit c76164c058a0cfe