yahoo-eng-team team mailing list archive

[Thierry Carrez <thierry.carrez+lp@xxxxxxxxx>]

** Changed in: neutron
       Status: Fix Committed => Fix Released

** Changed in: neutron
    Milestone: None => liberty-3

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1477553

Title:
  Efficiently mark packets related to metadata agent

Status in neutron:
  Fix Released

Bug description:
  Actually when metadata is enabled on L3 agent, the following is
  generated by L3 agent (only rules related to metadata are displayed in
  the following) :

  sudo ip netns exec qrouter-cad6171a-aa76-4e24-bf6d-dbbfb276c47a iptables -S -t mangle
  ...
  -A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x1/0xffffffff
  ...

  sudo ip netns exec qrouter-cad6171a-aa76-4e24-bf6d-dbbfb276c47a iptables -S -t nat
  ...
  -A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -i qr-+ -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9697
  ...

  sudo ip netns exec qrouter-cad6171a-aa76-4e24-bf6d-dbbfb276c47a iptables -S -t filter
  ...
  -A neutron-l3-agent-INPUT -m mark --mark 0x1 -j ACCEPT
  -A neutron-l3-agent-INPUT -p tcp -m tcp --dport 9697 -j DROP
  ...

  The mark 0x1 set in MANGLE table could be more restrictive to avoid
  marking packets from external interfaces.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1477553/+subscriptions