yahoo-eng-team team mailing list archive

[Bertrand Lallau <bertrand.lallau@xxxxxxxxx>]

Public bug reported:

Actually when metadata is enabled on L3 agent, the following is
generated by L3 agent (only rules related to metadata are displayed in
the following) :

sudo ip netns exec qrouter-cad6171a-aa76-4e24-bf6d-dbbfb276c47a iptables -S -t mangle
...
-A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x1/0xffffffff
...

sudo ip netns exec qrouter-cad6171a-aa76-4e24-bf6d-dbbfb276c47a iptables -S -t nat
...
-A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -i qr-+ -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9697
...

sudo ip netns exec qrouter-cad6171a-aa76-4e24-bf6d-dbbfb276c47a iptables -S -t filter
...
-A neutron-l3-agent-INPUT -m mark --mark 0x1 -j ACCEPT
-A neutron-l3-agent-INPUT -p tcp -m tcp --dport 9697 -j DROP
...

The mark 0x1 set in MANGLE table could be more restrictive to avoid
marking packets from external interfaces.

** Affects: neutron
     Importance: Undecided
     Assignee: Bertrand Lallau (bertrand-lallau)
         Status: New

** Changed in: neutron
     Assignee: (unassigned) => Bertrand Lallau (bertrand-lallau)

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1477553

Title:
  Efficiently mark packets related to metadata agent

Status in neutron:
  New

Bug description:
  Actually when metadata is enabled on L3 agent, the following is
  generated by L3 agent (only rules related to metadata are displayed in
  the following) :

  sudo ip netns exec qrouter-cad6171a-aa76-4e24-bf6d-dbbfb276c47a iptables -S -t mangle
  ...
  -A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x1/0xffffffff
  ...

  sudo ip netns exec qrouter-cad6171a-aa76-4e24-bf6d-dbbfb276c47a iptables -S -t nat
  ...
  -A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -i qr-+ -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9697
  ...

  sudo ip netns exec qrouter-cad6171a-aa76-4e24-bf6d-dbbfb276c47a iptables -S -t filter
  ...
  -A neutron-l3-agent-INPUT -m mark --mark 0x1 -j ACCEPT
  -A neutron-l3-agent-INPUT -p tcp -m tcp --dport 9697 -j DROP
  ...

  The mark 0x1 set in MANGLE table could be more restrictive to avoid
  marking packets from external interfaces.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1477553/+subscriptions