yahoo-eng-team team mailing list archive

[Bence Romsics <1838760@xxxxxxxxxxxxxxxxxx>]

I believe regarding this bug report what could be done, has been done.
Other fixes are not going to happen, therefore I'm setting this to Won't
Fix, to clean up the open bug list.

** Changed in: neutron
       Status: Confirmed => Won't Fix

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1838760

Title:
  Security groups don't work for trunk ports with iptables_hybrid fw
  driver

Status in neutron:
  Won't Fix

Bug description:
  When iptables_hybrid firewall driver is used, security groups don't
  work for trunk ports as vlan tagged packes on qbr bridge aren't
  filtered by default at all.

  I found it when I was trying to add new CI job
  https://review.opendev.org/#/c/670738/ and I noticed that this job is
  failing constantly on Queens release.

  On Rocky and newer this new job is fine and the difference between
  those jobs is firewall_driver - since rocky we are using openvswitch
  fw driver instead of iptables_hybrid. I also confirmed locally that
  when I switched firewall driver to openvswitch, same test worked fine
  for me.

  I did some debugging on Queens release locally and it looks that flag
  /proc/sys/net/bridge/bridge-nf-filter-vlan-tagged should be set to 1
  to make it possible to filter vlan tagged traffic in iptables, see
  https://ebtables.netfilter.org/documentation/bridge-nf.html for
  details.

  But even if this knob is switched to "1", there are probably bigger
  changes required as vlan header which belongs to those packets should
  be included in iptables rules to match on proper packets.

  My test was done on stable/queens branch of neutron but I'm pretty
  sure that the same issue exists still in master. We simply don't see
  it as we are testing it with openvswitch fw driver.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1838760/+subscriptions