Skip to content

Loading…

Removing duplicated 'drop' entries in scripts/setup-vif-rules #940

Closed
wants to merge 1 commit into from

5 participants

@amarao

reason: they are always before global 'drop everything else'.
Comments about specific icmp message types are saved as important info.

George Shuklin Removing excessive icmp ipv6 drops from setup-vif-rules
reason: they are always before global 'drop everything else'.
Comments about specific icmp message types are saved as important info.
d19a9fc
@xen-git
Xapi Project member

Can one of the admins verify this patch?

@robhoes robhoes was assigned
@jonludlam
Xapi Project member

@robhoes could you take a look, please?

@robhoes
Xapi Project member

The order in which the add_flow function is called by that bit of code is misleading. The actual flow table is sorted by priority. The rules you are removing have priority 6000, which is higher than some IPv6 rules with action=normal, a little further up in the code. Therefore, I think that removing those rules will lead to certain packets going through rather than getting dropped.

@djs55
Xapi Project member
@robhoes
Xapi Project member

@djs55 Some of the rules are generated in loops, and we won't be able to put the rules in priority order, unless we split the loops. It's possible, but I don't think it will make things much clearer...

@amarao
@jonludlam
Xapi Project member

I'm going to close this pull request for now - please resubmit if you feel there's still an issue here to fix. Thanks!

@jonludlam jonludlam closed this
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Commits on Dec 9, 2012
  1. Removing excessive icmp ipv6 drops from setup-vif-rules

    George Shuklin committed
    reason: they are always before global 'drop everything else'.
    Comments about specific icmp message types are saved as important info.
Showing with 9 additions and 16 deletions.
  1. +9 −16 scripts/setup-vif-rules
View
25 scripts/setup-vif-rules
@@ -211,22 +211,15 @@ def create_vswitch_rules(bridge_name, port, config):
# Drop all other neighbour discovery.
add_flow(bridge_name, "in_port=%s,priority=7000,icmp6,icmp_type=135,action=drop" % port)
add_flow(bridge_name, "in_port=%s,priority=7000,icmp6,icmp_type=136,action=drop" % port)
- # Drop other specific ICMPv6 types.
- # Router advertisement.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=134,action=drop" % port)
- # Redirect gateway.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=137,action=drop" % port)
- # Mobile prefix solicitation.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=146,action=drop" % port)
- # Mobile prefix advertisement.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=147,action=drop" % port)
- # Multicast router advertisement.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=151,action=drop" % port)
- # Multicast router solicitation.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=152,action=drop" % port)
- # Multicast router termination.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=153,action=drop" % port)
- # Drop everything else.
+ # Drop other specific ICMPv6 types:
+ # Router advertisement (icmp_type=134)
+ # Redirect gateway. (icmp_type=137)
+ # Mobile prefix solicitation. (icmp_type=146)
+ # Mobile prefix advertisement. (icmp_type=147)
+ # Multicast router advertisement. (icmp_type=151)
+ # Multicast router solicitation. (icmp_type=152)
+ # Multicast router termination. (icmp_type=153)
+ # ... and drop everything else.
add_flow(bridge_name, "in_port=%s,priority=4000,idle_timeout=0,action=drop" % port)
def handle_vswitch(vif_type, domid, devid, action):
Something went wrong with that request. Please try again.