-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
The OVS Firewall blocks traffic that does not have either the IPv4 or IPv6 ethertypes at present. This is a behavior change compared to the iptables_hybrid firewall, which only operates on IP packets and thus does not address other ethertypes. This is a lightweight change that sets a configuration option in the neutron openvswitch agent configuration file for permitted ethertypes and then ensures that the requested ethertypes are permitted on initialization. This addresses the security and usability concerns on both master and stable branches while a full-fledged extension to the security groups API is considered. Change-Id: Ide78b0b90cf6d6069ce3787fc60766be52062da0 Related-Bug: #1832758 (cherry picked from commit 9ea6a61)
- Loading branch information
1 parent
3888448
commit 55a503b
Showing
3 changed files
with
38 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
--- | ||
security: | ||
- | | ||
The OVS Firewall blocks traffic that does not have either the IPv4 or IPv6 | ||
ethertypes at present. This is a behavior change compared to the | ||
iptables_hybrid firewall, which only operates on IP packets and thus does | ||
not address other ethertypes. There is now a configuration option in the | ||
neutron openvswitch agent configuration file for permitted ethertypes and | ||
then ensures that the requested ethertypes are permitted on initialization. |