Security Groups Aswin Suryanarayanan and Ravindra Kencheppa

Openstack Security Groups Fixed Security Rules Added despite of security group is selected or not It adds a predefined set of rules which is not customizable Security Group CRUD The rules needs to be applied to the port when SG is selected. It adds user customizable rules

Openstack Fixed Security Groups  Applied when a vm port is created. Ingress  Allows DHCP traffic and same net-traffic.  Drop all the other traffic Egress  Drop any Source IP/Mac pair other than of the connected vm  Drop any DHCP server traffic from the VM Conntrack Rules(Both Egress and Ingress)  Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack  Allow packets associated with a known session

Opendaylight Security Groups – Current Fixed Security Groups The DHCP rules are added. The rest of the rules needs to be added. Conntrack rules can be added only if OVS add support for the same Security Group CRUD Not supported

Modules to work on Neutron has AD-SAL code, needs to be ported to MD-SAL NetVirt Add listener for the MD-SAL notification Add logic to process the CRUD operations in PortSecuirtyHandler Uncomment the code in OF13Provider to enable SecurityGroup handling in an interface update. In Egress/IngressAclService add logic to support multiple protocols.

Thank You

Chain neutron-openvswi-sg-chain (4 references) target prot opt source destination neutron-openvswi-icd83346f-1 all -- anywhere anywhere PHYSDEV match --physdev-out tapcd83346f-19 --physdev-is-bridged /* Jump to the VM specific chain. */ neutron-openvswi-ocd83346f-1 all -- anywhere anywhere PHYSDEV match --physdev-in tapcd83346f-19 --physdev-is-bridged /* Jump to the VM specific chain. */ neutron-openvswi-i0627c187-f all -- anywhere anywhere PHYSDEV match --physdev-out tap0627c187-fe --physdev-is-bridged /* Jump to the VM specific chain. */ neutron-openvswi-o0627c187-f all -- anywhere anywhere PHYSDEV match --physdev-in tap0627c187-fe --physdev-is-bridged /* Jump to the VM specific chain. */ ACCEPT all -- anywhere anywhere Chain neutron-openvswi-i0627c187-f (1 references) target prot opt source destination DROP all -- anywhere anywhere state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */ RETURN all -- anywhere anywhere state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */ RETURN udp anywhere udp spt:bootps dpt:bootpc RETURN all -- anywhere anywhere match-set NIPv4247bf283-5cef-4171-b65b- src neutron-openvswi-sg-fallback all -- anywhere anywhere /* Send unmatched traffic to the fallback chain Chain neutron-openvswi-o0627c187-f (2 references) target prot opt source destination RETURN udp -- anywhere anywhere udp spt:bootpc dpt:bootps /* Allow DHCP client traffic. */ neutron-openvswi-s0627c187-f all -- anywhere anywhere DROP udp -- anywhere anywhere udp spt:bootps dpt:bootpc /* Prevent DHCP Spoofing by VM. */ DROP all -- anywhere anywhere state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */ RETURN all -- anywhere anywhere state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */ RETURN all -- anywhere anywhere neutron-openvswi-sg-fallback all -- anywhere anywhere /* Send unmatched traffic to the fallback chain. */ Chain neutron-openvswi-s0627c187-f (1 references) target prot opt source destination RETURN all anywhere MAC FA:16:3E:6B:36:60 /* Allow traffic from defined IP/MAC pairs. */ DROP all -- anywhere anywhere /* Drop traffic without an IP/MAC allow rule. */