Bug 1429331
| Summary: | iptables rule blocks traffic even with port_security_enabled set to False | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Masaki Furuta ( RH ) <mfuruta> |
| Component: | openstack-neutron | Assignee: | Daniel Alvarez Sanchez <dalvarez> |
| Status: | CLOSED ERRATA | QA Contact: | Eran Kuris <ekuris> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 9.0 (Mitaka) | CC: | adhingra, amaumene, amuller, asimonel, bcafarel, bschmaus, chrisw, cpaquin, dalvarez, ekuris, jlibosva, jschluet, k-akuta, mlopes, mschuppe, nyechiel, oblaut, pablo.iranzo, pmannidi, ragiman, sputhenp, srevivo, tbonds |
| Target Milestone: | async | Keywords: | Triaged, ZStream |
| Target Release: | 9.0 (Mitaka) | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | openstack-neutron-8.3.0-4.el7ost | Doc Type: | Bug Fix |
| Doc Text: |
Previously, when ports were created with port_security disabled, the explicit iptables rules were not applied to allow the traffic. This resulted in packets hitting a default REJECT rule, and all traffic was blocked.
With this fix, firewall rules are correctly installed on ports with port_security disabled and traffic is allowed.
|
Story Points: | --- |
| Clone Of: | 1406263 | Environment: | |
| Last Closed: | 2017-03-30 19:35:40 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1406263 | ||
| Bug Blocks: | 1369066 | ||
|
Comment 1
Masaki Furuta ( RH )
2017-03-06 06:43:13 UTC
Approved for hotfix for NEC. Package is built and doc flags updated. *** Bug 1428782 has been marked as a duplicate of this bug. *** 9 -p 2017-03-17.1 $ rpm -qa |grep openstack-neutron-8 openstack-neutron-8.3.0-5.el7ost.noarch verified and fixed steps - 1. neutron net-create net-64-2 --port_security_enabled false 2. neutron subnet-create net-64-2 10.0.5.0/24 --name subnet_4 --enable_dhcp true 3. neutron router-create Router_eNet 4. neutron router-interface-add Router_eNet dd073541-b444-4ab6-8187-346d7a8eb96a 5. neutron router-gateway-set Router_eNet 25df8c01-0632-4b49-ac8c-31d0155bfb0e 6. nova boot --flavor 3 --image cirros VM1 --nic net-id=551f3ab9-2292-4d43-b8bd-b7bd59951799 7. neutron port-show 104ab04f-3b1f-408e-bee0-10ba0d6dab35 |grep security verify port_security_enabled = False 8. connectivity check from qrouter to VM1 ip net exec qrouter-5d10b101-4bc5-4261-aa3d-9c192e85ee06 ping 10.0.5.3 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:0856 Clear INFO |