openstack
/
neutron
Code Issues Proposed changes
neutron/neutron/tests/unit
History
Cedric Brandily 1d776bc16c Allow to request metadata proxy only with redirection 
metadata service should be requested on 169.254.169.254:80 and router
namespace iptables rules redirect the request to the metadata-ns-proxy
on 127.0.0.1:$metadata_port. But currently the metadata-ns-proxy can be
requested directly on $router-ip:$metadata_port.

To avoid such behavior, this change marks packets redirection in mangle
table (PREROUTING), redirects (PREROUTING) them in nat table, accepts
them in filter table (INPUT) using the mark. Packets send to the
metadata proxy port without mark (so directly) are dropped. The
mark can be configured through the new option metadata_access_mark.

Remark: redirected packets are not local packets (in general), so
setting metadata proxy server host to 127.0.0.1 will disallow direct
queries but so redirected queries.

DocImpact
Partial-Bug: #1187102
Change-Id: I6a9bb12c8bf68c6fcf4e4060f8dfe44a309a41da
 		2015-01-30 09:34:49 +00:00
..
agent Allow to request metadata proxy only with redirection 2015-01-30 09:34:49 +00:00
api Migrate to oslo.utils 2014-11-26 10:31:03 +01:00
bigswitch Add and use SecurityGroupAgentRpc 2015-01-26 08:06:02 -05:00
brocade Migrate to oslo.context 2014-12-11 20:49:11 +01:00
cisco Updated keystone_admin conf section to reflect changes in middleware 2015-01-05 12:29:00 +01:00
db Merge "Remove DBDuplicateEntry columns check" 2015-01-22 21:33:33 +00:00
embrane tests: drop unit tests that only check default configuration values 2014-12-18 21:28:55 +01:00
extensions switch to oslo.serialization 2014-11-14 09:28:12 +00:00
hyperv Add and use SecurityGroupAgentRpc 2015-01-26 08:06:02 -05:00
ibm Add OVSDB abstract API 2015-01-26 12:38:24 -06:00
linuxbridge linuxbridge: untangle SecurityGroupAgentRpcMixin 2015-01-22 15:39:07 -05:00
metaplugin Use db constraint to ensure mac address uniqueness 2015-01-22 19:08:47 +00:00
ml2 Merge "Extract l2pop/DVR controller logic to common method" 2015-01-26 23:26:52 +00:00
mlnx mlnx: untangle SecurityGroupAgentRpcMixin 2015-01-22 15:39:07 -05:00
nec hacking: enable H238 (old style class declaration, use new style) 2015-01-12 23:46:11 +01:00
notifiers fix event_send for re-assign floating ip 2014-11-10 18:20:10 -08:00
nuage Use "if dict.get(key):" instead "if key in dict and dict[key]:" 2015-01-12 14:05:54 -08:00
ofagent Add OVSDB abstract API 2015-01-26 12:38:24 -06:00
oneconvergence Add and use SecurityGroupAgentRpc 2015-01-26 08:06:02 -05:00
opencontrail Updated keystone_admin conf section to reflect changes in middleware 2015-01-05 12:29:00 +01:00
openvswitch Add OVSDB abstract API 2015-01-26 12:38:24 -06:00
plumgrid PLUMgrid plugin: Fix for delete subnet with admin context 2014-12-22 01:30:48 -08:00
services Merge "Backward compatibility for advanced services" 2014-12-18 20:18:05 +00:00
sriovnicagent sriovnicagent: untangle SecurityGroupAgentRpcMixin 2015-01-22 15:39:07 -05:00
vmware make delete_router send delete_port to core_plugin 2015-01-15 16:19:08 +01:00
__init__.py Fix state_path in tests 2014-08-29 17:42:07 +03:00
_test_extension_portbindings.py Set vif_details to reflect enable_security_group 2014-09-21 17:41:38 +09:00
database_stubs.py Avoid unnecessary explicit str() conversion around exceptions 2014-12-16 11:19:09 +03:00
dummy_plugin.py Remove the useless vim modelines 2014-06-21 15:07:31 +08:00
extension_stubs.py Remove the useless vim modelines 2014-06-21 15:07:31 +08:00
test_agent_config.py Remove the useless vim modelines 2014-06-21 15:07:31 +08:00
test_agent_ext_plugin.py tests: initialize admin context after super().setUp call 2014-12-15 12:09:55 +01:00
test_agent_linux_utils.py Add Process class helper to manage processes with namespace 2015-01-07 11:20:27 +01:00
test_agent_rpc.py Merge "Fix AttributeError during startup of ovs agent in DVR mode" 2014-12-19 02:49:58 +00:00
test_api_api_common.py Remove @author(s) from copyright statements 2014-09-15 21:40:09 +09:00
test_api_v2.py hacking: enable H238 (old style class declaration, use new style) 2015-01-12 23:46:11 +01:00
test_api_v2_extension.py Remove @author(s) from copyright statements 2014-09-15 21:40:09 +09:00
test_api_v2_resource.py Cleanup req_format in test_api_v2_resource 2014-12-17 13:02:54 +03:00
test_attributes.py attributes: Additional IP address validation 2015-01-26 11:55:31 +09:00
test_auth.py Migrate to oslo.middleware 2014-11-26 22:12:21 +01:00
test_basetestcase.py Prevent SystemExits when running tests 2014-09-01 15:05:16 -07:00
test_common_log.py Use method's logger in log decorator 2014-07-15 11:08:33 +02:00
test_common_utils.py Replace FLOATING_IP_CIDR_SUFFIX constant with utils 2015-01-21 11:15:38 -05:00
test_config.py tests: drop unit tests that only check default configuration values 2014-12-18 21:28:55 +01:00
test_db_migration.py Remove @author(s) from copyright statements 2014-09-15 21:40:09 +09:00
test_db_plugin.py Merge "Use db constraint to ensure mac address uniqueness" 2015-01-23 08:41:38 +00:00
test_db_plugin_level.py Refactor plugin setup helpers out of test.base 2014-08-25 14:44:27 +02:00
test_debug_commands.py Remove the useless vim modelines 2014-06-21 15:07:31 +08:00
test_dhcp_agent.py dhcp: move dnsmasq version check to sanity_check 2015-01-26 16:56:59 +01:00
test_dhcp_rpc.py Improve performance of get_active_networks_info 2014-12-15 16:20:21 +08:00
test_dhcp_scheduler.py Improve test coverage of dhcp agent scheduling 2015-01-20 15:24:28 +05:30
test_extension_allowedaddresspairs.py Fixed test test_update_port_security_off_address_pairs 2014-12-15 00:13:01 -08:00
test_extension_ext_gw_mode.py Allow reading a tenant router's external IP 2014-10-01 06:55:27 -07:00
test_extension_ext_net.py Remove XML support 2014-10-24 15:18:49 +00:00
test_extension_extended_attribute.py remove openvswitch plugin 2014-10-01 21:16:27 -07:00
test_extension_extradhcpopts.py Remove @author(s) from copyright statements 2014-09-15 21:40:09 +09:00
test_extension_extraroute.py Remove XML support 2014-10-24 15:18:49 +00:00
test_extension_firewall.py Remove XML support 2014-10-24 15:18:49 +00:00
test_extension_pnet.py Remove @author(s) from copyright statements 2014-09-15 21:40:09 +09:00
test_extension_portsecurity.py UTs: Disable auto deletion of ports/subnets/nets 2014-09-09 07:09:02 -07:00
test_extension_security_group.py Change description of default security group 2014-11-27 07:27:51 +00:00
test_extensions.py switch to oslo.serialization 2014-11-14 09:28:12 +00:00
test_hacking.py Update hacking to 0.10 2015-01-12 23:46:06 +01:00
test_iptables_firewall.py IpsetManager refactoring 2014-12-06 18:21:43 +01:00
test_iptables_manager.py Don't log a warning if an iptables chain doesn't exist 2015-01-15 21:30:57 +00:00
test_ipv6.py Fix IPv6 Subnet Slaac Check 2015-01-12 15:18:09 +08:00
test_l3_agent.py Add coverage for extra routes extension 2015-01-26 16:40:49 -05:00
test_l3_dvr.py Move classes out of l3_agent.py 2014-12-10 15:19:28 -07:00
test_l3_plugin.py Use "if dict.get(key):" instead "if key in dict and dict[key]:" 2015-01-12 14:05:54 -08:00
test_l3_schedulers.py Do not count dvr agents while creating HA ports 2014-12-25 11:22:50 +05:30
test_linux_daemon.py Do not run neutron-ns-metadata-proxy as root on L3 agent 2014-12-24 01:21:44 +01:00
test_linux_dhcp.py dhcp: move dnsmasq version check to sanity_check 2015-01-26 16:56:59 +01:00
test_linux_external_process.py Implements ProcessMonitor in the dhcp_agent 2015-01-23 11:55:44 +00:00
test_linux_interface.py Add OVSDB abstract API 2015-01-26 12:38:24 -06:00
test_linux_ip_lib.py Create arping helper in ip_lib 2015-01-15 05:43:10 +00:00
test_metadata_agent.py Move metadata agent entry to its own file 2015-01-09 19:49:45 -08:00
test_metadata_namespace_proxy.py Do not run neutron-ns-metadata-proxy as root on L3 agent 2014-12-24 01:21:44 +01:00
test_netns_cleanup.py Implements ProcessMonitor in the dhcp_agent 2015-01-23 11:55:44 +00:00
test_neutron_context.py add auth token to context 2014-08-12 11:17:21 +09:00
test_neutron_manager.py Refactor plugin setup helpers out of test.base 2014-08-25 14:44:27 +02:00
test_ovs_cleanup.py Move agent cleanup scripts to cmd module 2015-01-14 10:01:44 -08:00
test_policy.py Migrate to oslo.utils 2014-11-26 10:31:03 +01:00
test_post_mortem_debug.py Cleanup recent generalization in post mortem debugger 2014-12-04 15:28:11 +01:00
test_provider_configuration.py Backward compatibility for advanced services 2014-12-18 09:27:28 -08:00
test_quota_ext.py Remove XML support 2014-10-24 15:18:49 +00:00
test_router_processing_queue.py Move classes out of l3_agent.py 2014-12-10 15:19:28 -07:00
test_security_groups_rpc.py Add and use SecurityGroupAgentRpc 2015-01-26 08:06:02 -05:00
test_servicetype.py Remove XML support 2014-10-24 15:18:49 +00:00
test_wsgi.py hacking: enable H238 (old style class declaration, use new style) 2015-01-12 23:46:11 +01:00
testlib_api.py Remove XML support 2014-10-24 15:18:49 +00:00
testlib_plugin.py Use oslo function for parsing bool from env var 2014-12-02 14:40:07 +00:00