OpenStack Compute (Nova)

nova-api should add iptables rules to accept metadata API requests

Reported by Mark McLoughlin on 2011-09-22
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Medium
Mark McLoughlin

Bug Description

On systems where the default policy for the iptables INPUT filter is DROP, I'm seeing metadata requests being dropped.

Something similar to:

  $> sudo iptables -t filter -A nova-network-INPUT \
                   -s 0.0.0.0/0 -d $ec2_dmz_host \
                   -m tcp -p tcp --dport $ec2_port -j ACCEPT

fixes it for me

To explain fully, this on Fedora where the the default policy is actually ACCEPT but the last rule in the INPUT chain is:

  -A INPUT -j REJECT --reject-with icmp-host-prohibited

See also:

  https://bugs.launchpad.net/nova/+bug/844935

Related branches

Mark McLoughlin (markmc) on 2011-09-22
Changed in nova:
assignee: nobody → Mark McLoughlin (markmc)
status: New → In Progress
Thierry Carrez (ttx) on 2011-09-26
Changed in nova:
importance: Undecided → Medium

Reviewed: https://review.openstack.org/558
Committed: http://github.com/openstack/nova/commit/d503dd6de4f45f149dfa295fd3137f4944ed7f66
Submitter: Jenkins
Branch: master

 status fixcommitted
 done

commit d503dd6de4f45f149dfa295fd3137f4944ed7f66
Author: Mark McLoughlin <email address hidden>
Date: Mon Sep 5 07:10:52 2011 +0100

    Add INPUT chain rule for EC2 metadata requests (lp:856385)

    On Fedora, the default policy for the INPUT chain in the filter table
    is DROP. This means that EC2 metadata requests from guests get dropped.

    Add this rule to let it through:

    $> sudo iptables -t filter -A nova-network-INPUT \
                     -s 0.0.0.0/0 -d $ec2_dmz_host \
                     -m tcp -p tcp --dport $ec2_port -j ACCEPT

    It makes no sense to have nova-network add an iptables rule for the EC2
    metadata service, since they may not actually be on the same host.

    Instead, nova-api should add it directly. In order to do that, we add a
    manager class for API services and allow the EC2 manager use the network
    driver to add the rule.

    Change-Id: I7c1f973c662a6d290e555b6a2ce8fc301f27b543

Changed in nova:
status: In Progress → Fix Committed
Thierry Carrez (ttx) on 2011-11-09
Changed in nova:
milestone: none → essex-1
Thierry Carrez (ttx) on 2011-11-17
Changed in nova:
status: Fix Committed → Fix Released
Thierry Carrez (ttx) on 2012-04-05
Changed in nova:
milestone: essex-1 → 2012.1
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers