<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
text-align:justify;
text-justify:inter-ideograph;
font-size:10.5pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
/* Page Definitions */
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="ZH-CN" link="blue" vlink="purple" style="text-justify-trim:punctuation">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hi Salvatore and Kyle,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thanks for your review the following bug:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><a href="https://review.openstack.org/#/c/97516/">https://review.openstack.org/#/c/97516/</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><a href="https://launchpad.net/bugs/1325986">https://launchpad.net/bugs/1325986</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I think I did not make myself clear in the bug description.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">And you have the following comments:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I have a question regarding the removal of the following rule<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">'-m mac --mac-source %s -j RETURN'<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">It was originally added to allow passing traffic to the specified additional MAC regardless. As a side effect however, it is also passing traffic for all the IPs, which is the bug you're trying to fix.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">As you're removing the rule, would you agree that setting an allowed address pair with MAC only now does not make a lot of sense anymore? If you agree we should add this restriction to the API.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Otherwise we should build iptables rules for the specified MAC and all the IPs on that port known to neutron.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">In my opinion, We have ip snooping feature to protect the VM to use IP which is not its fixed IP.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">So If the VM have a fixed IP, the rules are something like following:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Chain neutron-openvswi-sdcd32e11-1 (1 references)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">pkts bytes target prot opt in out source destination
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> 3026 382K RETURN all -- * * 10.224.148.121 0.0.0.0/0 MAC FA:16:3E:4E:A9:3D
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">We will only allowed Source IP(10.224.148.121) and Source MAC(FA:16:3E:4E:A9:3D) to go out of VM in this case.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">This means even I modify the IP(for example, I use 10.224.148.122) in the VM, It still can't work.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Then, If I remove the fixed ip of the VM, the port do not have any fixed ip, the rule will be :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Chain neutron-openvswi-sdcd32e11-1 (1 references)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">pkts bytes target prot opt in out source destination
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> 3026 382K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 MAC FA:16:3E:4E:A9:3D
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">This will allow all the MAC with FA:16:3E:4E:A9:3D to go out of the VM.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">In this case, if I add IP in the VM(for example, I use 10.224.148.121), the IP can work.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">So I think in this case anti-ip-snooping does not work well. I think when we do not have fixed IP, the rule should be :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Chain neutron-openvswi-sdcd32e11-1 (1 references)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">pkts bytes target prot opt in out source destination<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">with this rules, If I add ip in VM, the IP can't work.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">So my patch is used to remove the rule “'-m mac --mac-source %s -j RETURN'” when port does not have fixed ip.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">And in your comments, you said that "setting an allowed address pair with MAC only now does not make a lot of sense anymore"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I don't think so, because we still need this feature in many case. For example, If we need to use DSR(Direct Server Return) in the VM, we need to allow all the ips.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thanks again for your review, and please let me know, if I have any misunstanding.
</span><span lang="EN-US" style="font-family:Wingdings">J</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Liping Mao<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>