Support protocol numbers in security group API
Somewhere along the way we broke supporting numbers in
the security group API that were not in our known list
of protocols. In order to fix this properly we must
use the correct arguments when using iptables-save, as
it could use a name instead of a number, or vice-versa.
Determined the list of mappings by doing:
for num in {0..255}; do iptables -A INPUT -p $num; done
# iptables-save
Change-Id: I5895250b47ddf664d214cf085be693c3897e0c87
Closes-bug: #1716045
Closes-bug: #1716790
This commit is contained in:
Brian Haley
parent
1665395b19
commit
7ff492c5bb
@ -636,9 +636,12 @@ class IptablesFirewallDriver(firewall.FirewallDriver):
|
||||
def _protocol_arg(self, protocol, is_port):
|
||||
if not protocol:
|
||||
return []
|
||||
if protocol == 'icmpv6':
|
||||
protocol = 'ipv6-icmp'
|
||||
iptables_rule = ['-p', protocol]
|
||||
rule_protocol = protocol
|
||||
if (protocol in n_const.IPTABLES_PROTOCOL_NAME_MAP):
|
||||
rule_protocol = n_const.IPTABLES_PROTOCOL_NAME_MAP[protocol]
|
||||
# protocol zero is a special case and requires no '-p'
|
||||
if rule_protocol:
|
||||
iptables_rule = ['-p', rule_protocol]
|
||||
|
||||
if (is_port and protocol in constants.IPTABLES_PROTOCOL_MAP):
|
||||
# iptables adds '-m protocol' when the port number is specified
|
||||
|
||||
@ -48,6 +48,67 @@ IP_PROTOCOL_NAME_ALIASES = {lib_constants.PROTO_NAME_IPV6_ICMP_LEGACY:
|
||||
IP_PROTOCOL_NUM_TO_NAME_MAP = {
|
||||
str(v): k for k, v in lib_constants.IP_PROTOCOL_MAP.items()}
|
||||
|
||||
# When using iptables-save we specify '-p {proto}',
|
||||
# but sometimes those values are not identical. This is a map
|
||||
# of known protocol names or numbers that require a name change.
|
||||
# This legacy mapping can go away once neutron-lib is updated.
|
||||
IPTABLES_PROTOCOL_LEGACY_NUM_MAP = {3: 'ggp',
|
||||
4: 'ipencap',
|
||||
5: 'st',
|
||||
9: 'igp',
|
||||
12: 'pup',
|
||||
20: 'hmp',
|
||||
22: 'xns-idp',
|
||||
27: 'rdp',
|
||||
29: 'iso-tp4',
|
||||
36: 'xtp',
|
||||
37: 'ddp',
|
||||
38: 'idpr-cmtp',
|
||||
45: 'idrp',
|
||||
57: 'skip',
|
||||
73: 'rspf',
|
||||
81: 'vmtp',
|
||||
88: 'eigrp',
|
||||
93: 'ax.25',
|
||||
94: 'ipip',
|
||||
97: 'etherip',
|
||||
98: 'encap',
|
||||
103: 'pim',
|
||||
108: 'ipcomp',
|
||||
115: 'lt2p',
|
||||
124: 'isis',
|
||||
133: 'fc',
|
||||
135: 'mobility-header',
|
||||
137: 'mpls-in-ip',
|
||||
138: 'manet',
|
||||
139: 'hip',
|
||||
140: 'shim6',
|
||||
141: 'wesp',
|
||||
142: 'rohc'}
|
||||
|
||||
# - protocol 0 uses no -p argument
|
||||
# - 'ipv6-encap' uses 'ipv6'
|
||||
# - 'icmpv6' uses 'ipv6-icmp'
|
||||
# - 'pgm' uses number 113 instead of its name
|
||||
IPTABLES_PROTOCOL_NAME_MAP = {0: None,
|
||||
lib_constants.PROTO_NAME_IPV6_ENCAP:
|
||||
'ipv6',
|
||||
lib_constants.PROTO_NAME_IPV6_ICMP_LEGACY:
|
||||
'ipv6-icmp',
|
||||
lib_constants.PROTO_NAME_PGM: '113'}
|
||||
IPTABLES_PROTOCOL_NAME_MAP.update(IPTABLES_PROTOCOL_LEGACY_NUM_MAP)
|
||||
|
||||
# When using iptables-save we specify '-p {proto} -m {module}',
|
||||
# but sometimes those values are not identical. This is a map
|
||||
# of known protocols that require a '-m {module}', along with
|
||||
# the module name that should be used.
|
||||
IPTABLES_PROTOCOL_MAP = {lib_constants.PROTO_NAME_DCCP: 'dccp',
|
||||
lib_constants.PROTO_NAME_ICMP: 'icmp',
|
||||
lib_constants.PROTO_NAME_IPV6_ICMP: 'icmp6',
|
||||
lib_constants.PROTO_NAME_SCTP: 'sctp',
|
||||
lib_constants.PROTO_NAME_TCP: 'tcp',
|
||||
lib_constants.PROTO_NAME_UDP: 'udp'}
|
||||
|
||||
# TODO(boden): consume with I9642ed9b513a43c5558f9611f43227299707284a
|
||||
# Special provisional prefix for IPv6 Prefix Delegation
|
||||
PROVISIONAL_IPV6_PD_PREFIX = '::/64'
|
||||
|
||||
@ -183,7 +183,7 @@ class IpProtocolEnum(obj_fields.Enum):
|
||||
valid_values=list(
|
||||
itertools.chain(
|
||||
lib_constants.IP_PROTOCOL_MAP.keys(),
|
||||
[str(v) for v in lib_constants.IP_PROTOCOL_MAP.values()]
|
||||
[str(v) for v in range(256)]
|
||||
)
|
||||
),
|
||||
**kwargs)
|
||||
|
||||
@ -13,7 +13,6 @@
|
||||
|
||||
import abc
|
||||
import itertools
|
||||
import random
|
||||
|
||||
from neutron_lib import constants as const
|
||||
from neutron_lib.db import constants as db_const
|
||||
@ -226,27 +225,10 @@ class IpProtocolEnumFieldTest(test_base.BaseTestCase, TestField):
|
||||
(val, val)
|
||||
for val in itertools.chain(
|
||||
const.IP_PROTOCOL_MAP.keys(),
|
||||
[str(v) for v in const.IP_PROTOCOL_MAP.values()]
|
||||
[str(v) for v in range(256)]
|
||||
)
|
||||
]
|
||||
self.coerce_bad_values = ['test', 'Udp', 256]
|
||||
try:
|
||||
# pick a random protocol number that is not in the map of supported
|
||||
# protocols
|
||||
self.coerce_bad_values.append(
|
||||
str(
|
||||
random.choice(
|
||||
list(
|
||||
set(range(256)) -
|
||||
set(const.IP_PROTOCOL_MAP.values())
|
||||
)
|
||||
)
|
||||
)
|
||||
)
|
||||
except IndexError:
|
||||
# stay paranoid and guard against the impossible future when all
|
||||
# protocols are in the map
|
||||
pass
|
||||
self.to_primitive_values = self.coerce_good_values
|
||||
self.from_primitive_values = self.coerce_good_values
|
||||
|
||||
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
fixes:
|
||||
- |
|
||||
Adding security group rules by protocol number is documented,
|
||||
but somehow was broken without being noticed in one of the
|
||||
last couple of releases. This is now fixed. For more
|
||||
information see bug
|
||||
`1716045 <https://bugs.launchpad.net/neutron/+bug/1716045>`_.
|
||||
Loading…
Reference in New Issue
Block a user