Bug 1569067

Summary: OVS firewall should drop iptables rules if it detects a bridge
Product: Red Hat OpenStack Reporter: Jakub Libosvar <jlibosva>
Component: openstack-neutronAssignee: Jakub Libosvar <jlibosva>
Status: CLOSED ERRATA QA Contact: Roee Agiman <ragiman>
Severity: high Docs Contact:
Priority: high    
Version: 12.0 (Pike)CC: amuller, chrisw, jlibosva, nyechiel, srevivo
Target Milestone: z3Keywords: Triaged, ZStream
Target Release: 12.0 (Pike)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openstack-neutron-11.0.2-6.el7ost Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-08-20 12:51:31 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jakub Libosvar 2018-04-18 14:45:57 UTC 
When a user switches from the hybrid firewall to the OVS native firewall the iptables rules will be left behind on the filtering bridge. Since removing the bridge would require difficult coordination with Nova and it would be disruptive to traffic, that is currently not a viable approach.

To make the transition easier, the OVS firewall should at least detect when one of its VM ports contains a filtering bridge and drop all of the iptables rules on it so we don't have stale rules interfering with the traffic.
Comment 9 errata-xmlrpc 2018-08-20 12:51:31 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:2514