Allow to request metadata proxy only from internal interfaces

Currently the metadata service can be requested on 169.254.169.254:80
from all interfaces including external interfaces. This change updates
PREROUTING rules to allow request on 169.254.169.254:80 only from
internal interfaces.

Change-Id: I44a9e03992f9e2a7bd4d798ae69d8aa7d75d3078
Closes-Bug: #1187102

diff --git a/neutron/agent/metadata/driver.py b/neutron/agent/metadata/driver.py
index 1e36460eedabb0eba20fe29edec1dda238bb9921..bdb01354c90ce93ebd3eee5726c6e7813e01a2a2 100644 (file)
--- a/neutron/agent/metadata/driver.py
+++ b/neutron/agent/metadata/driver.py
@@ -19,6 +19,7 @@ from oslo_config import cfg
 from oslo_log import log as logging
 
 from neutron.agent.common import config
+from neutron.agent.l3 import namespaces
 from neutron.agent.linux import external_process
 from neutron.common import exceptions
 from neutron.services import advanced_service
@@ -104,8 +105,11 @@ class MetadataDriver(advanced_service.AdvancedService):
     @classmethod
     def metadata_nat_rules(cls, port):
         return [('PREROUTING', '-d 169.254.169.254/32 '
+                 '-i %(interface_name)s '
                  '-p tcp -m tcp --dport 80 -j REDIRECT '
-                 '--to-port %s' % port)]
+                 '--to-port %(port)s' %
+                 {'interface_name': namespaces.INTERNAL_DEV_PREFIX + '+',
+                  'port': port})]
 
     @classmethod
     def _get_metadata_proxy_user_group(cls, conf):

diff --git a/neutron/tests/unit/agent/metadata/test_driver.py b/neutron/tests/unit/agent/metadata/test_driver.py
index afd97d9c2e83242957d725b61902b48a157d459c..efd8ed564937f7751d09d4b0073130ac8db1e991 100644 (file)
--- a/neutron/tests/unit/agent/metadata/test_driver.py
+++ b/neutron/tests/unit/agent/metadata/test_driver.py
@@ -33,7 +33,7 @@ _uuid = uuidutils.generate_uuid
 class TestMetadataDriverRules(base.BaseTestCase):
 
     def test_metadata_nat_rules(self):
-        rules = ('PREROUTING', '-d 169.254.169.254/32 '
+        rules = ('PREROUTING', '-d 169.254.169.254/32 -i qr-+ '
                  '-p tcp -m tcp --dport 80 -j REDIRECT --to-port 8775')
         self.assertEqual(
             [rules],