Mercurial Mercurial > upstream > oracle > userland-gate / changeset
summary | shortlog | changelog | graph | tags | bookmarks | branches | files | changeset | raw | help
Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
19898528 PBR rule must not forward packets addressed to internal default gateway s11-update
authorGirish Moodalbail <Girish.Moodalbail@oracle.COM>
Tue, 28 Oct 2014 14:36:14 -0700
branchs11-update
changeset 3435 25a421888935
parent 3434 f326739c9f89
child 3440 573f3b6b1987
19898528 PBR rule must not forward packets addressed to internal default gateway
components/openstack/neutron/files/agent/evs_l3_agent.py file | annotate | diff | comparison | revisions 
--- a/components/openstack/neutron/files/agent/evs_l3_agent.py	Tue Oct 28 08:22:31 2014 -0700
+++ b/components/openstack/neutron/files/agent/evs_l3_agent.py	Tue Oct 28 14:36:14 2014 -0700
@@ -264,8 +264,9 @@
             # Routing (PBR) rule
             for port in ri.internal_ports:
                 internal_dlname = self.get_internal_device_name(port['id'])
-                rules = ['pass in on %s to %s:%s from any to any' %
-                         (internal_dlname, external_dlname, gw_ip)]
+                rules = ['pass in on %s to %s:%s from any to !%s' %
+                         (internal_dlname, external_dlname, gw_ip,
+                          port['subnet']['cidr'])]
                 ipversion = netaddr.IPNetwork(port['subnet']['cidr']).version
                 ri.ipfilters_manager.add_ipf_rules(rules, ipversion)
 
@@ -277,8 +278,9 @@
             # remove PBR rules
             for port in ri.internal_ports:
                 internal_dlname = self.get_internal_device_name(port['id'])
-                rules = ['pass in on %s to %s:%s from any to any' %
-                         (internal_dlname, external_dlname, gw_ip)]
+                rules = ['pass in on %s to %s:%s from any to !%s' %
+                         (internal_dlname, external_dlname, gw_ip,
+                          port['subnet']['cidr'])]
                 ipversion = netaddr.IPNetwork(port['subnet']['cidr']).version
                 ri.ipfilters_manager.remove_ipf_rules(rules, ipversion)
 
@@ -359,8 +361,9 @@
         ex_gw_ip = (ex_gw_port['subnet']['gateway_ip'] if ex_gw_port else None)
         if ex_gw_ip:
             external_dlname = self.get_external_device_name(ex_gw_port['id'])
-            rules.append('pass in on %s to %s:%s from any to any' %
-                         (internal_dlname, external_dlname, ex_gw_ip))
+            rules.append('pass in on %s to %s:%s from any to !%s' %
+                         (internal_dlname, external_dlname, ex_gw_ip,
+                          port_subnet))
 
         ipversion = netaddr.IPNetwork(port_subnet).version
         ri.ipfilters_manager.add_ipf_rules(rules, ipversion)
@@ -384,8 +387,9 @@
         ex_gw_ip = (ex_gw_port['subnet']['gateway_ip'] if ex_gw_port else None)
         if ex_gw_ip:
             external_dlname = self.get_external_device_name(ex_gw_port['id'])
-            rules.append('pass in on %s to %s:%s from any to any' %
-                         (internal_dlname, external_dlname, ex_gw_ip))
+            rules.append('pass in on %s to %s:%s from any to !%s' %
+                         (internal_dlname, external_dlname, ex_gw_ip,
+                          port_subnet))
         ipversion = netaddr.IPNetwork(port['subnet']['cidr']).version
         ri.ipfilters_manager.remove_ipf_rules(rules, ipversion)
upstream/oracle/userland-gate