d6bfd091b9
In case where Neutron logical port is placed directly to hypervisor,
hypervisor does a conntrack lookup before packets reach OVS integration
bridge. This patch introduces a rule with high priority that is placed
at the beginning of the egress pipeline. This rule removes conntrack
information from all packets if conntrack information is present. Then
packets continue in the egress pipeline.
That means all packets in egress pipeline are not tracked and ovs
firewall can do a lookup in correct zone. As for ingress pipeline, it
distinguishes between tracked - which are packets coming from egress
pipeline, and not tracked, which are inbound packets coming not from a
local port.
Change-Id: Ia4f524adce2b5ee6d98d3921cfb03d56ad6d0813
Closes-bug: #1747082
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| dashboards | ||
| internals | ||
| policies | ||
| stadium | ||
| testing | ||
| alembic_migrations.rst | ||
| client_command_extensions.rst | ||
| contribute.rst | ||
| development_environment.rst | ||
| effective_neutron.rst | ||
| index.rst | ||
| modules.rst | ||
| neutron_api.rst | ||