yahoo-eng-team team mailing list archive

[OpenStack Infra <1896587@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://review.opendev.org/755766
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=f57b59a1791d5d5bf2b7a7d292fc36cfa1cec9c9
Submitter: Zuul
Branch:    master

commit f57b59a1791d5d5bf2b7a7d292fc36cfa1cec9c9
Author: Slawek Kaplonski <skaplons@xxxxxxxxxx>
Date:   Fri Oct 2 13:26:27 2020 +0200

    [Doc] Add section about diffs between ovs and iptables fw drivers
    
    And add note about different handling of packets marked as INVALID
    by both those drivers.
    
    Change-Id: I3d436289073e95312e5f5077acabd136266b9e8a
    Closes-Bug: #1896587


** Changed in: neutron
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1896587

Title:
  iptables firewall driver don't drops invalid packets which match some
  SG rule

Status in neutron:
  Fix Released

Bug description:
  In case if there is e.g. SG rule which allows SCTP traffic defined by user, iptables firewall driver will match such traffic always, even if it's marked as INVALID by conntrack.
  It is like that due to order of rules in iptables:

  Chain neutron-openvswi-i0133d93d-e (1 references)
   pkts bytes target     prot opt in     out     source               destination         
     61  5493 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */
      2   728 RETURN     udp  --  *      *       0.0.0.0/0            10.0.0.55            udp spt:67 dpt:68
      0     0 RETURN     udp  --  *      *       0.0.0.0/0            255.255.255.255      udp spt:67 dpt:68
      0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set NIPv408140248-6eff-4e0d-aadf- src
      0     0 RETURN     sctp --  *      *       0.0.0.0/0            0.0.0.0/0           
      0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */
      0     0 neutron-openvswi-sg-fallback  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* Send unmatched traffic to the fallback chain. */

  
  In case of openvswitch firewall driver it works properly, so INVALID packets are dropped even if they could match some SG rules.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1896587/+subscriptions