We are amped to announce the release of: neutron-fwaas 12.0.0: OpenStack Networking FWaaS This release is part of the queens release series. Download the package from: https://tarballs.openstack.org/neutron-fwaas/ For more details, please see below. Changes in neutron-fwaas 11.0.0.0rc1..12.0.0 -------------------------------------------- 358c2ed Validating if a port is supported by FWaaS L2 driver 66d4431 Remove disable option for default FWG and allow only on VM ports 4b1ba9a Updated from global requirements f7350df Fixing OVS driver coexistence check 9d08ae4 Enable to associate ports with default fwg for non-admin users 9ff85d6 Support IPv6 for netlink_conntrack 5f69f91 Updated from global requirements b860883 Add Zuul v3 native midonet cross test 63c8431 Adding new tables for future consumption 8a58c51 Updated from global requirements 816dce1 Apply default firewall group for new VM ports 6b36e15 Updated from global requirements 450b886 use EGRESS_DIRECTION and INGRESS_DIRECTION from neutron-lib 4d64670 Co-existing between fwg and sg 24b25cc Enable to use conntrack driver in fwaas_v2 4eefecf Add doc8 to pep8 check for neutron-fwaas project d756639 Replace jsonutils by common json package 586b269 Imported Translations from Zanata be3d36e Trivial-fix: Remove unused method b0b8d9e Add reno for "OVS based l2 Firewall driver for FWaaS v2" 2a962ba Adding unique constraint for port_id 8cfc604 Updated from global requirements 3b7093b OVS based l2 Firewall driver for FWaaS v2 dbac4b8 FWaaS v2 extension for L2 agent 74eac2c Imported Translations from Zanata d5e0033 Remove setting of version/release from releasenotes 1b1a1bc Updated from global requirements aa292f8 Updated from global requirements 66d3d57 Updated from global requirements d5a4355 Refactor _get_routers_in_project method d3c3d72 Adopt a new abstract method ha_state_change 8a82773 Fix UTs gate failed 30ae6f8 Introduce default firewall groups 43f7ae3 Updated from global requirements c27a945 Introduce firewall l2 driver base df919a3 Updated from global requirements 1728cf1 Fix mismatch in error messages 562e00f Use shim tool for ostestr 6723081 Updated from global requirements a831bd7 Updated from global requirements 40af3e5 Remove unused constant for topics 8b15755 Extend FWaaS V2 ICMP reachability test scenarios 4a1cfe2 Remove vestigate HUDSON_PUBLISH_DOCS reference 2c9f059 devstack: Use entrypoint name for service_plugin 77b5003 Use neutron-lib FirewallInternalDriverError 0fac0d5 Fix router update on L3 agent restart 6a53316 Remove log translations f6deeab Updated from global requirements 675a0a2 Drop MANIFEST.in - it's not needed by pbr b12d430 Updated from global requirements f8a86e7 Fix filtering parameter to get firewall_group a9b2af9 Update policy on rule addition/removal 21d18e3 [DevStack] Configure iptables_v2 firewall driver for FWaaS V2. 465023a Updated from global requirements f589293 FW rule applied incorrectly if port specified is a range d5224f1 Imported Translations from Zanata 55fed40 Add firewall_policy_id in FWaaS v2 a5e6986 Get default client config from config module c76e12c FirewallGroupPortInvalidProject can be raised now 80fe2ba Don't return 404 when deleting a non-existant FWG 2a008ce consume load_class_by_alias_or_classname from neutron-lib 0258c4f fix releasenotes build dc3f001 Update reno for stable/pike 6003d37 Trivial-fix: Omit 'tests/*' in coverage result 4bf8180 Update links in README 3b67b1b Enable some off-by-default checks Diffstat (except docs and test files) ------------------------------------- .coveragerc | 2 +- .gitignore | 1 + .zuul.yaml | 22 + MANIFEST.in | 11 - README.rst | 4 +- devstack/README.rst | 6 +- devstack/plugin.sh | 5 +- devstack/settings | 8 +- neutron_fwaas/_i18n.py | 10 - neutron_fwaas/common/exceptions.py | 24 + neutron_fwaas/common/fwaas_constants.py | 15 +- neutron_fwaas/db/firewall/v2/firewall_db_v2.py | 476 +++++++-- .../alembic_migrations/versions/EXPAND_HEAD | 2 +- ...2258a43_create_default_firewall_groups_table.py | 67 ++ ...e5bff_uniq_firewallgroupportassociation0port.py | 71 ++ .../locale/en_GB/LC_MESSAGES/neutron_fwaas.po | 116 +++ neutron_fwaas/privileged/netlink_constants.py | 4 + neutron_fwaas/privileged/netlink_lib.py | 30 +- .../services/firewall/agents/firewall_agent_api.py | 9 +- .../services/firewall/agents/l2/__init__.py | 0 .../services/firewall/agents/l2/fwaas_v2.py | 493 ++++++++++ .../agents/l3reference/firewall_l3_agent.py | 74 +- .../agents/l3reference/firewall_l3_agent_v2.py | 154 +-- .../services/firewall/drivers/conntrack_base.py | 20 + .../firewall/drivers/linux/iptables_fwaas.py | 66 +- .../firewall/drivers/linux/iptables_fwaas_v2.py | 93 +- .../services/firewall/drivers/linux/l2/__init__.py | 0 .../firewall/drivers/linux/l2/driver_base.py | 63 ++ .../firewall/drivers/linux/l2/noop/__init__.py | 0 .../firewall/drivers/linux/l2/noop/noop_driver.py | 40 + .../linux/l2/openvswitch_firewall/__init__.py | 19 + .../linux/l2/openvswitch_firewall/constants.py | 64 ++ .../linux/l2/openvswitch_firewall/exceptions.py | 26 + .../linux/l2/openvswitch_firewall/firewall.py | 1034 ++++++++++++++++++++ .../drivers/linux/l2/openvswitch_firewall/rules.py | 206 ++++ .../firewall/drivers/linux/legacy_conntrack.py | 197 +++- .../firewall/drivers/linux/netlink_conntrack.py | 6 + neutron_fwaas/services/firewall/fwaas_plugin.py | 7 +- neutron_fwaas/services/firewall/fwaas_plugin_v2.py | 182 +++- .../functional/privileged/test_netlink_lib.py | 126 ++- .../unit/db/firewall/v2/test_firewall_db_v2.py | 516 ++++++++-- .../unit/services/firewall/agents/l2/__init__.py | 0 .../unit/services/firewall/agents/l2/fake_data.py | 153 +++ .../services/firewall/agents/l2/test_fwaas_v2.py | 769 +++++++++++++++ .../agents/l3reference/test_firewall_l3_agent.py | 14 +- .../l3reference/test_firewall_l3_agent_v2.py | 92 +- .../services/firewall/drivers/linux/l2/__init__.py | 0 .../firewall/drivers/linux/l2/noop/__init__.py | 0 .../drivers/linux/l2/noop/test_noop_driver.py | 43 + .../linux/l2/openvswitch_firewall/__init__.py | 0 .../linux/l2/openvswitch_firewall/test_firewall.py | 690 +++++++++++++ .../linux/l2/openvswitch_firewall/test_rules.py | 338 +++++++ .../drivers/linux/test_iptables_fwaas_v2.py | 121 ++- .../drivers/linux/test_legacy_conntrack.py | 67 +- .../unit/services/firewall/test_fwaas_plugin_v2.py | 116 ++- ...es-for-future-consumption-ffd537c1f82e2e01.yaml | 13 + ...on-default-firewall-group-7e9faf1afca1df85.yaml | 14 + .../notes/bug-1702242-c917c832ac2fa4e1.yaml | 11 + .../notes/bug-1746404-493a66faac333403.yaml | 10 + ...stence-between-sg-and-fwg-1f77a755539a9463.yaml | 16 + .../ovs-firewall-driver-c347ea0a560b7e38.yaml | 16 + ...tion_if_port_is_supported-639d0df705eb67f9.yaml | 8 + releasenotes/source/conf.py | 11 +- releasenotes/source/index.rst | 3 +- .../locale/en_GB/LC_MESSAGES/releasenotes.po | 287 ++++++ .../source/locale/fr/LC_MESSAGES/releasenotes.po | 66 ++ releasenotes/source/pike.rst | 6 + requirements.txt | 23 +- setup.cfg | 5 + test-requirements.txt | 27 +- tox.ini | 16 +- 79 files changed, 6848 insertions(+), 639 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index e0b5e8d..b1ed3cb 100644 --- a/requirements.txt +++ b/requirements.txt @@ -7 +7 @@ eventlet!=0.18.3,!=0.20.1,<0.21.0,>=0.18.2 # MIT -netaddr!=0.7.16,>=0.7.13 # BSD +netaddr>=0.7.18 # BSD @@ -10,11 +10,10 @@ alembic>=0.8.10 # MIT -six>=1.9.0 # MIT -neutron-lib>=1.9.0 # Apache-2.0 -oslo.config!=4.3.0,!=4.4.0,>=4.0.0 # Apache-2.0 -oslo.db>=4.24.0 # Apache-2.0 -oslo.log>=3.22.0 # Apache-2.0 -oslo.messaging!=5.25.0,>=5.24.2 # Apache-2.0 -oslo.serialization!=2.19.1,>=1.10.0 # Apache-2.0 -oslo.service>=1.10.0 # Apache-2.0 -oslo.utils>=3.20.0 # Apache-2.0 -oslo.privsep!=1.17.0,>=1.9.0 # Apache-2.0 -pyroute2>=0.4.17 # Apache-2.0 (+ dual licensed GPL2) +six>=1.10.0 # MIT +neutron-lib>=1.13.0 # Apache-2.0 +oslo.config>=5.1.0 # Apache-2.0 +oslo.db>=4.27.0 # Apache-2.0 +oslo.log>=3.36.0 # Apache-2.0 +oslo.messaging>=5.29.0 # Apache-2.0 +oslo.service!=1.28.1,>=1.24.0 # Apache-2.0 +oslo.utils>=3.33.0 # Apache-2.0 +oslo.privsep>=1.23.0 # Apache-2.0 +pyroute2>=0.4.21;sys_platform!='win32' # Apache-2.0 (+ dual licensed GPL2) diff --git a/test-requirements.txt b/test-requirements.txt index 653091c..9a655fd 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -9,7 +9,7 @@ flake8-import-order==0.12 # LGPLv3 -mock>=2.0 # BSD -python-subunit>=0.0.18 # Apache-2.0/BSD -requests-mock>=1.1 # Apache-2.0 -sphinx>=1.6.2 # BSD -openstackdocstheme>=1.16.0 # Apache-2.0 -oslo.concurrency>=3.8.0 # Apache-2.0 -os-testr>=0.8.0 # Apache-2.0 +mock>=2.0.0 # BSD +python-subunit>=1.0.0 # Apache-2.0/BSD +requests-mock>=1.1.0 # Apache-2.0 +sphinx!=1.6.6,>=1.6.2 # BSD +openstackdocstheme>=1.18.1 # Apache-2.0 +oslo.concurrency>=3.25.0 # Apache-2.0 +os-testr>=1.0.0 # Apache-2.0 @@ -17,2 +17,2 @@ testrepository>=0.0.18 # Apache-2.0/BSD -testresources>=0.2.4 # Apache-2.0/BSD -testtools>=1.4.0 # MIT +testresources>=2.0.0 # Apache-2.0/BSD +testtools>=2.2.0 # MIT @@ -21,3 +21,3 @@ WebOb>=1.7.1 # MIT -WebTest>=2.0 # MIT -oslotest>=1.10.0 # Apache-2.0 -reno!=2.3.1,>=1.8.0 # Apache-2.0 +WebTest>=2.0.27 # MIT +oslotest>=3.2.0 # Apache-2.0 +reno>=2.5.0 # Apache-2.0 @@ -25 +25,2 @@ PyMySQL>=0.7.6 # MIT License -psycopg2>=2.5 # LGPL/ZPL +psycopg2>=2.6.2 # LGPL/ZPL +doc8>=0.6.0 # Apache-2.0