<div dir="ltr">That is true... Back to "LibvirtHybridOVSBridgeDriver", Security Groups is working again... </div><div class="gmail_extra"><br><br><div class="gmail_quote">On 6 November 2013 15:03, Simon Pasquier <span dir="ltr"><<a href="mailto:simon.pasquier@bull.net" target="_blank">simon.pasquier@bull.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Answering myself as I investigated a little further and cross-posting to openstack-dev because I'd like to get feedback from Nova/Neutron devs.<br>
<br>
Users running Havana should configure libvirt_vif_driver=nova.virt.<u></u>libvirt.vif.<u></u>LibvirtHybridOVSBridgeDriver.<br>
This driver is still available in the Havana release although deprecated. AFAIU, this is the only option if you want effective security groups with KVM & OVS.<br>
<br>
For people using the master branch of nova, sorry but security groups are currently broken because LibvirtHybridOVSBridgeDriver is gone ([0]). Joe Gordon asked the Neutron devs about it few weeks ago [1] but no answer and in another review [2], the conclusion was that the Tempest tests passed with Neutron. However I don't see anywhere in the tests ([3], [4]) that we check if the security rules allow/block traffic.<br>
<br>
It would be nice if core devs could confirm or refute.<br>
<br>
Regards,<br>
<br>
Simon<br>
<br>
[0] <a href="https://review.openstack.org/#/c/49660/" target="_blank">https://review.openstack.org/#<u></u>/c/49660/</a><br>
[1] <a href="http://lists.openstack.org/pipermail/openstack-dev/2013-October/016886.html" target="_blank">http://lists.openstack.org/<u></u>pipermail/openstack-dev/2013-<u></u>October/016886.html</a><br>
[2] <a href="https://review.openstack.org/#/c/44349" target="_blank">https://review.openstack.org/#<u></u>/c/44349</a><br>
[3] <a href="https://github.com/openstack/tempest/blob/master/tempest/api/network/test_security_groups.py" target="_blank">https://github.com/openstack/<u></u>tempest/blob/master/tempest/<u></u>api/network/test_security_<u></u>groups.py</a><br>
[4] <a href="https://github.com/openstack/tempest/blob/master/tempest/api/network/test_security_groups_negative.py" target="_blank">https://github.com/openstack/<u></u>tempest/blob/master/tempest/<u></u>api/network/test_security_<u></u>groups_negative.py</a><br>
<br>
Le 05/11/2013 14:57, Simon Pasquier a écrit :<div class="HOEnZb"><div class="h5"><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi all,<br>
<br>
I'm struggling with security groups on Havana with Neutron and OVS<br>
plugin (GRE tunnels). No problem to create/delete security group rules<br>
but even though iptables configuration is updated, traffic to my<br>
instances is never filtered [0].<br>
<br>
I'm running DevStack on 2 nodes (1 controller + 1 compute):<br>
- OS: Ubuntu 12.04.3 (LTS) with the Havana cloud archive repository.<br>
- Open vSwitch package version: 1.10.2-0ubuntu2~cloud0<br>
- libvirt package version: 1.1.1-0ubuntu8~cloud2<br>
- localrc, nova.conf, neutron.conf and ovs_neutron_plugin.ini files<br>
pasted at [1] (I didn't modify any of these files after the DevStack run)<br>
<br>
According to [2], [3] and [4], iptables is not compatible with TAP<br>
devices connectd directly to Open vSwitch ports, this is why there used<br>
to be the additional veth + bridge interfaces [5]. But in my setup, this<br>
is not the case anymore as shown in [6] ('ovs-vsctl show' +<br>
'iptables-save' ouptut). I've also pasted the libvirt XML configuration<br>
[7] that shows that the instance is directly connected to the Open vSwitch.<br>
<br>
Are the security groups supposed to work when the instance is directly<br>
connected to OVS? If yes, what am I doing wrong?<br>
<br>
Regards,<br>
<br>
[0] <a href="http://paste.openstack.org/show/50490/" target="_blank">http://paste.openstack.org/<u></u>show/50490/</a><br>
[1] <a href="http://paste.openstack.org/show/50448/" target="_blank">http://paste.openstack.org/<u></u>show/50448/</a><br>
[2] <a href="http://www.spinics.net/linux/fedora/libvirt-users/msg05384.html" target="_blank">http://www.spinics.net/linux/<u></u>fedora/libvirt-users/msg05384.<u></u>html</a><br>
[3] <a href="http://openvswitch.org/pipermail/discuss/2013-October/011461.html" target="_blank">http://openvswitch.org/<u></u>pipermail/discuss/2013-<u></u>October/011461.html</a><br>
[4]<br>
<a href="http://docs.openstack.org/havana/config-reference/content/under_the_hood_openvswitch.html" target="_blank">http://docs.openstack.org/<u></u>havana/config-reference/<u></u>content/under_the_hood_<u></u>openvswitch.html</a><br>
<br>
[5]<br>
<a href="http://docs.openstack.org/havana/config-reference/content/figures/7/a/a/common/figures/under-the-hood-scenario-2-ovs-compute.png" target="_blank">http://docs.openstack.org/<u></u>havana/config-reference/<u></u>content/figures/7/a/a/common/<u></u>figures/under-the-hood-<u></u>scenario-2-ovs-compute.png</a><br>
<br>
[6] <a href="http://paste.openstack.org/show/50486/" target="_blank">http://paste.openstack.org/<u></u>show/50486/</a><br>
[7] <a href="http://paste.openstack.org/show/50487/" target="_blank">http://paste.openstack.org/<u></u>show/50487/</a><br>
</blockquote>
<br>
<br>
-- <br>
Simon Pasquier<br>
Software Engineer<br>
Bull, Architect of an Open World<br>
Phone: <a href="tel:%2B%2033%204%2076%2029%2071%2049" value="+33476297149" target="_blank">+ 33 4 76 29 71 49</a><br>
<a href="http://www.bull.com" target="_blank">http://www.bull.com</a><br>
<br>
______________________________<u></u>_________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/<u></u>cgi-bin/mailman/listinfo/<u></u>openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/<u></u>cgi-bin/mailman/listinfo/<u></u>openstack</a><br>
</div></div></blockquote></div><br></div>