1. devstack
  2. Commit b3a210f643989603d192b32a40b2001664f8ed73
Browse code

Enable bridge firewalling if iptables are used

With the plan [1] to stop enabling it by Neutron iptables firewall
driver itself, deployment tools should catch up and enable the firewall
themselves.

This is needed for distributions that decided to disable the kernel
firewall by default (upstream kernel has it enabled). This is also
needed for distributions that ship newer kernels but don't load the
br_netfilter module before starting nova-network or Neutron iptables
firewall driver. In the latter case, firewall may not work, depending on
the order of operations executed by the driver.

To isolate devstack setups from the difference in distribution
kernel configuration and version, the following steps are done:

- we load bridge kernel module, and br_netfilter if present, to get
access to sysctl knobs controlling the firewall;
- once knobs are available, we unconditionally set them to 1, to make
sure the firewall is in effect.

More details at:
http://wiki.libvirt.org/page/Net.bridge.bridge-nf-call_and_sysctl.conf

[1] I9137ea017624ac92a05f73863b77f9ee4681bbe7

Change-Id: Id6bfd9595f0772a63d1096ef83ebbb6cd630fafd
Related-Bug: #1622914

Ihar Hrachyshka authored on 2016/09/29 22:26:30
Showing 5 changed files
functions
History View file @ b3a210f
... ... 
@@ -646,6 +646,24 @@ function set_mtu {
646 646 
 }
647 647
648 648
649 
+# enable_kernel_bridge_firewall - Enable kernel support for bridge firewalling
650 
+function enable_kernel_bridge_firewall {
651 
+    # Load bridge module. This module provides access to firewall for bridged
652 
+    # frames; and also on older kernels (pre-3.18) it provides sysctl knobs to
653 
+    # enable/disable bridge firewalling
654 
+    sudo modprobe bridge
655 
+    # For newer kernels (3.18+), those sysctl settings are split into a separate
656 
+    # kernel module (br_netfilter). Load it too, if present.
657 
+    sudo modprobe br_netfilter 2>> /dev/null || :
658 
+    # Enable bridge firewalling in case it's disabled in kernel (upstream
659 
+    # default is enabled, but some distributions may decide to change it).
660 
+    # This is at least needed for RHEL 7.2 and earlier releases.
661 
+    for proto in arp ip ip6; do
662 
+        sudo sysctl -w net.bridge.bridge-nf-call-${proto}tables=1
663 
+    done
664 
+}
665 
+
666 
+
649 667 
 # Restore xtrace
650 668 
 $_XTRACE_FUNCTIONS
651 669
lib/neutron
History View file @ b3a210f
... ... 
@@ -182,6 +182,8 @@ function configure_neutron_new {
182 182 
             iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup iptables_hybrid
183 183 
             iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
184 184 
         fi
185 
+
186 
+        enable_kernel_bridge_firewall
185 187 
     fi
186 188
187 189 
     # DHCP Agent
lib/neutron_plugins/linuxbridge_agent
History View file @ b3a210f
... ... 
@@ -69,6 +69,7 @@ function neutron_plugin_configure_plugin_agent {
69 69 
     fi
70 70 
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
71 71 
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
72 
+        enable_kernel_bridge_firewall
72 73 
     else
73 74 
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
74 75 
     fi
lib/neutron_plugins/ovs_base
History View file @ b3a210f
... ... 
@@ -84,6 +84,7 @@ function _neutron_ovs_base_configure_debug_command {
84 84 
 function _neutron_ovs_base_configure_firewall_driver {
85 85 
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
86 86 
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
87 
+        enable_kernel_bridge_firewall
87 88 
     else
88 89 
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
89 90 
     fi
lib/nova
History View file @ b3a210f
... ... 
@@ -866,9 +866,13 @@ function start_nova_rest {
866 866 
     run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $compute_cell_conf"
867 867 
     run_process n-cell-region "$NOVA_BIN_DIR/nova-cells --config-file $api_cell_conf"
868 868 
     run_process n-cell-child "$NOVA_BIN_DIR/nova-cells --config-file $compute_cell_conf"
869 
-
870 869 
     run_process n-crt "$NOVA_BIN_DIR/nova-cert --config-file $api_cell_conf"
870 
+
871 
+    if is_service_enabled n-net; then
872 
+        enable_kernel_bridge_firewall
873 
+    fi
871 874 
     run_process n-net "$NOVA_BIN_DIR/nova-network --config-file $compute_cell_conf"
875 
+
872 876 
     run_process n-sch "$NOVA_BIN_DIR/nova-scheduler --config-file $compute_cell_conf"
873 877 
     run_process n-api-meta "$NOVA_BIN_DIR/nova-api-metadata --config-file $compute_cell_conf"
874 878