Commit Graph

11 Commits

Author SHA1 Message Date
Rodolfo Alonso Hernandez f616f84e95 Implement conntrack command privsep context
This context has only "CAP_NET_ADMIN" capability.

Story: #2007686
Task: #42240

Change-Id: I8522c9c1e2243ea471d51fa50d04db476655e6d0
2021-04-09 15:36:03 +00:00
Mitya_Eremeev c156c7d883 Proper log translation
The main idea of the commit is to fix code
according with the latest oslo.i18n requirements
https://docs.openstack.org/oslo.i18n/latest/

1. removed log translation if log is not seen by users
   in raised exception or api call response.
2. keep translated log if it's used in raised exception.
3. removed log message 'Error while reading %s'
   which was "dead" (unused) code in the function
   "_get_value_from_conf_file"
   of module "agent/linux/dhcp.py".

Partial-Bug: 1600788
Change-Id: Ifb5455336b06c2c87a930b816c90b4a766856b1e
2021-01-21 19:07:04 +03:00
Brian Haley eaf990b2bc Fix pep8 E128 warnings in non-test code
Reduces E128 warnings by ~260 to just ~900,
no way we're getting rid of all of them at once (or ever).
Files under neutron/tests still have a ton of E128 warnings.

Change-Id: I9137150ccf129bf443e33428267cd4bc9c323b54
Co-Authored-By: Akihiro Motoki <amotoki@gmail.com>
2019-03-12 21:22:33 +00:00
Boden R 68fd13af40 remove neutron.common.exceptions
Today the neutron common exceptions already live in neutron-lib and are
shimmed from neutron. This patch removes the neutron.common.exceptions
module and changes neutron's imports over to use their respective
neutron-lib exception module instead.

NeutronLibImpact

Change-Id: I9704f20eb21da85d2cf024d83338b3d94593671e
2019-02-01 14:35:00 -07:00
Ben Nemec 85e1b1b0dc Correct arguments to nfct_open
While working on this module, I noticed a couple of inconsistencies
in how we were calling nfct. Specifically, the NFNL_SUBSYS_CTNETLINK
value is supposed to be 1[1], and the order of arguments to nfct_open
is subsys_id then subscriptions[2]. We were passing them in the
opposite order, which didn't particularly matter because both were
defined to be 0. Now that the subsystem identifier is correctly
defined it does matter though.

Change-Id: I9fb74a9ef7a83cd630afa1e1ea0e2fc0c6df3943
1: https://git.netfilter.org/libnfnetlink/tree/include/libnfnetlink/linux_nfnetlink.h#n45
2: https://git.netfilter.org/libnetfilter_conntrack/tree/src/main.c#n68
2019-01-24 08:41:38 +00:00
Akihiro Motoki abe8f6023b Fix indent level of netlink_lib.py
Change-Id: I91bda8d66c8e5a65f1bb9b63fc33b0f0a10e088a
2019-01-18 02:44:11 +00:00
Ben Nemec c6d358d4c6 Define types for C calls in netlink_lib
Previously this was not done, which meant all arguments were
assumed to be ints. As long as we didn't get any large pointer
addresses this worked fine, but for some reason the addition of
threading to oslo.privsep triggered larger addresses that were then
truncated. This caused segfaults in the underlying C library because
we were passing it invalid pointers.

This change sets argument and return types for all of the calls
that are used in the module.

Change-Id: I9dbbb01eac8cf7cded7794f8ba69797d6357eeec
Closes-Bug: 1810518
2019-01-09 16:26:40 +00:00
Bernard Cafarelli 144d3abf7c
python3: fix netlink_lib delete_entries
libc and netfilter_conntrack calls, as C bindings, do not work with
python3 strings
This fixes netlink_lib by using bytes type for addresses manipulation

Update corresponding unit test by removing str() conversions

Change-Id: I0044d943de3dcde7c4337f396ae9d10cede381f3
Closes-bug: #1779170
2018-06-29 00:30:19 +02:00
Jakub Libosvar ec0760a40e py3: Fix list_entries for netlink_lib
As privsep communicates with main process via socket, data passed
through this socket must be string type in Python 3. This patch converts
bytes to string, then privsep works correctly.

Change-Id: I6838d13b5acc32e939fba3c9abfea7cd483e971b
Closes-bug: #1771410
2018-05-15 19:06:36 +00:00
Inessa Vasilevskaya 7322bd6efb Make code follow log translation guideline
Since Pike log messages should not be translated.
This patch removes calls to i18n _LC, _LI, _LE, _LW from
logging logic throughout the code. Translators definition
from neutron._i18n is removed as well.
This patch also removes log translation verification from
ignore directive in tox.ini.

Change-Id: If9aa76fcf121c0e61a7c08088006c5873faee56e
2017-08-14 02:01:48 +00:00
Cuong Nguyen 1e5432cccd Add netlink-lib to manage conntrack entries
When the security group is updated, the conntrack entries will be deleted
by conntrack-tools with each rule associated with each SG rule.

In large scale system, updating so much rules will call a large number
of subprocesses to implement the "conntrack -D" commands. That will
consume the system resource and time.

This netlink-lib will be used by netlink conntrack driver to improve
conntrack management performance.

Original solution and performance from neutron-fwaas [1]

[1] https://review.openstack.org/#/c/438445/

Co-Authored-By: Cao Xuan Hoang <hoangcx@vn.fujitsu.com>
Change-Id: I7503c87900eb0f7bc5386f915b925bb2576502cc
2017-07-27 13:56:40 +07:00