Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP

Loading…

Removing duplicated 'drop' entries in scripts/setup-vif-rules #940

Closed
wants to merge 1 commit into from

5 participants

@amarao

reason: they are always before global 'drop everything else'.
Comments about specific icmp message types are saved as important info.

George Shuklin Removing excessive icmp ipv6 drops from setup-vif-rules
reason: they are always before global 'drop everything else'.
Comments about specific icmp message types are saved as important info.
d19a9fc
@xen-git
Owner

Can one of the admins verify this patch?

@robhoes robhoes was assigned
@jonludlam
Owner

@robhoes could you take a look, please?

@robhoes
Owner

The order in which the add_flow function is called by that bit of code is misleading. The actual flow table is sorted by priority. The rules you are removing have priority 6000, which is higher than some IPv6 rules with action=normal, a little further up in the code. Therefore, I think that removing those rules will lead to certain packets going through rather than getting dropped.

@djs55
Owner
@robhoes
Owner

@djs55 Some of the rules are generated in loops, and we won't be able to put the rules in priority order, unless we split the loops. It's possible, but I don't think it will make things much clearer...

@amarao
@jonludlam
Owner

I'm going to close this pull request for now - please resubmit if you feel there's still an issue here to fix. Thanks!

@jonludlam jonludlam closed this
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Commits on Dec 9, 2012
  1. Removing excessive icmp ipv6 drops from setup-vif-rules

    George Shuklin authored
    reason: they are always before global 'drop everything else'.
    Comments about specific icmp message types are saved as important info.
This page is out of date. Refresh to see the latest.
Showing with 9 additions and 16 deletions.
  1. +9 −16 scripts/setup-vif-rules
View
25 scripts/setup-vif-rules
@@ -211,22 +211,15 @@ def create_vswitch_rules(bridge_name, port, config):
# Drop all other neighbour discovery.
add_flow(bridge_name, "in_port=%s,priority=7000,icmp6,icmp_type=135,action=drop" % port)
add_flow(bridge_name, "in_port=%s,priority=7000,icmp6,icmp_type=136,action=drop" % port)
- # Drop other specific ICMPv6 types.
- # Router advertisement.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=134,action=drop" % port)
- # Redirect gateway.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=137,action=drop" % port)
- # Mobile prefix solicitation.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=146,action=drop" % port)
- # Mobile prefix advertisement.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=147,action=drop" % port)
- # Multicast router advertisement.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=151,action=drop" % port)
- # Multicast router solicitation.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=152,action=drop" % port)
- # Multicast router termination.
- add_flow(bridge_name, "in_port=%s,priority=6000,icmp6,icmp_type=153,action=drop" % port)
- # Drop everything else.
+ # Drop other specific ICMPv6 types:
+ # Router advertisement (icmp_type=134)
+ # Redirect gateway. (icmp_type=137)
+ # Mobile prefix solicitation. (icmp_type=146)
+ # Mobile prefix advertisement. (icmp_type=147)
+ # Multicast router advertisement. (icmp_type=151)
+ # Multicast router solicitation. (icmp_type=152)
+ # Multicast router termination. (icmp_type=153)
+ # ... and drop everything else.
add_flow(bridge_name, "in_port=%s,priority=4000,idle_timeout=0,action=drop" % port)
def handle_vswitch(vif_type, domid, devid, action):
Something went wrong with that request. Please try again.