Bug 1569067 - OVS firewall should drop iptables rules if it detects a bridge
Summary: OVS firewall should drop iptables rules if it detects a bridge
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-neutron
Version: 12.0 (Pike)
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: z3
: 12.0 (Pike)
Assignee: Jakub Libosvar
QA Contact: Roee Agiman
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-18 14:45 UTC by Jakub Libosvar
Modified: 2018-08-20 12:52 UTC (History)
5 users (show)

Fixed In Version: openstack-neutron-11.0.2-6.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-08-20 12:51:31 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Launchpad 136134 0 None None None 2018-04-18 15:11:38 UTC
Launchpad 1721895 0 None None None 2018-04-18 14:46:15 UTC
Red Hat Product Errata RHBA-2018:2514 0 None None None 2018-08-20 12:52:18 UTC

Description Jakub Libosvar 2018-04-18 14:45:57 UTC
When a user switches from the hybrid firewall to the OVS native firewall the iptables rules will be left behind on the filtering bridge. Since removing the bridge would require difficult coordination with Nova and it would be disruptive to traffic, that is currently not a viable approach.

To make the transition easier, the OVS firewall should at least detect when one of its VM ports contains a filtering bridge and drop all of the iptables rules on it so we don't have stale rules interfering with the traffic.

Comment 9 errata-xmlrpc 2018-08-20 12:51:31 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:2514


Note You need to log in before you can comment on or make changes to this bug.