Neutron分析（5）—— neutron-l3-agent中的iptables

        # Add a neutron-filter-top chain. It‘s intended to be shared
        # among the various nova components. It sits at the very top
        # of FORWARD and OUTPUT.
        for tables in [self.ipv4, self.ipv6]:
            tables[‘filter‘].add_chain(‘neutron-filter-top‘, wrap=False)
            tables[‘filter‘].add_rule(‘FORWARD‘, ‘-j neutron-filter-top‘,
                                      wrap=False, top=True)
            tables[‘filter‘].add_rule(‘OUTPUT‘, ‘-j neutron-filter-top‘,
                                      wrap=False, top=True)

            tables[‘filter‘].add_chain(‘local‘)
            tables[‘filter‘].add_rule(‘neutron-filter-top‘, ‘-j $local‘,
                                      wrap=False)

        # Wrap the built-in chains
        builtin_chains = {4: {‘filter‘: [‘INPUT‘, ‘OUTPUT‘, ‘FORWARD‘]},
                          6: {‘filter‘: [‘INPUT‘, ‘OUTPUT‘, ‘FORWARD‘]}}

        if not state_less:
            self.ipv4.update(
                {‘nat‘: IptablesTable(binary_name=self.wrap_name)})
            builtin_chains[4].update({‘nat‘: [‘PREROUTING‘,
                                      ‘OUTPUT‘, ‘POSTROUTING‘]})

        for ip_version in builtin_chains:
            if ip_version == 4:
                tables = self.ipv4
            elif ip_version == 6:
                tables = self.ipv6

            for table, chains in builtin_chains[ip_version].iteritems():
                for chain in chains:
                    tables[table].add_chain(chain)
                    tables[table].add_rule(chain, ‘-j $%s‘ %
                                           (chain), wrap=False)

        if not state_less:
            # Add a neutron-postrouting-bottom chain. It‘s intended to be
            # shared among the various nova components. We set it as the last
            # chain of POSTROUTING chain.
            self.ipv4[‘nat‘].add_chain(‘neutron-postrouting-bottom‘,
                                       wrap=False)
            self.ipv4[‘nat‘].add_rule(‘POSTROUTING‘,
                                      ‘-j neutron-postrouting-bottom‘,
                                      wrap=False)

            # We add a snat chain to the shared neutron-postrouting-bottom
            # chain so that it‘s applied last.
            self.ipv4[‘nat‘].add_chain(‘snat‘)
            self.ipv4[‘nat‘].add_rule(‘neutron-postrouting-bottom‘,
                                      ‘-j $snat‘, wrap=False)

            # And then we add a float-snat chain and jump to first thing in
            # the snat chain.
            self.ipv4[‘nat‘].add_chain(‘float-snat‘)
            self.ipv4[‘nat‘].add_rule(‘snat‘, ‘-j $float-snat‘)

    def _router_added(self, router_id, router):
        ri = RouterInfo(router_id, self.root_helper,
                        self.conf.use_namespaces, router)
        self.router_info[router_id] = ri
        if self.conf.use_namespaces:
            self._create_router_namespace(ri)
        for c, r in self.metadata_filter_rules():
            ri.iptables_manager.ipv4[‘filter‘].add_rule(c, r)
        for c, r in self.metadata_nat_rules():
            ri.iptables_manager.ipv4[‘nat‘].add_rule(c, r)
        ri.iptables_manager.apply()
        super(L3NATAgent, self).process_router_add(ri)
        if self.conf.enable_metadata_proxy:
            self._spawn_metadata_proxy(ri.router_id, ri.ns_name)

    def metadata_filter_rules(self):
        rules = []
        if self.conf.enable_metadata_proxy:
            rules.append((‘INPUT‘, ‘-s 0.0.0.0/0 -d 127.0.0.1 ‘
                          ‘-p tcp -m tcp --dport %s ‘
                          ‘-j ACCEPT‘ % self.conf.metadata_port))
        return rules

    def metadata_nat_rules(self):
        rules = []
        if self.conf.enable_metadata_proxy:
            rules.append((‘PREROUTING‘, ‘-s 0.0.0.0/0 -d 169.254.169.254/32 ‘
                          ‘-p tcp -m tcp --dport 80 -j REDIRECT ‘
                          ‘--to-port %s‘ % self.conf.metadata_port))
        return rules

    def _handle_router_snat_rules(self, ri, ex_gw_port, internal_cidrs,
                                  interface_name, action):
        # Remove all the rules
        # This is safe because if use_namespaces is set as False
        # then the agent can only configure one router, otherwise
        # each router‘s SNAT rules will be in their own namespace
        ri.iptables_manager.ipv4[‘nat‘].empty_chain(‘POSTROUTING‘)
        ri.iptables_manager.ipv4[‘nat‘].empty_chain(‘snat‘)

        # Add back the jump to float-snat
        ri.iptables_manager.ipv4[‘nat‘].add_rule(‘snat‘, ‘-j $float-snat‘)

        # And add them back if the action if add_rules
        if action == ‘add_rules‘ and ex_gw_port:
            # ex_gw_port should not be None in this case
            # NAT rules are added only if ex_gw_port has an IPv4 address
            for ip_addr in ex_gw_port[‘fixed_ips‘]:
                ex_gw_ip = ip_addr[‘ip_address‘]
                if netaddr.IPAddress(ex_gw_ip).version == 4:
                    rules = self.external_gateway_nat_rules(ex_gw_ip,
                                                            internal_cidrs,
                                                            interface_name)
                    for rule in rules:
                        ri.iptables_manager.ipv4[‘nat‘].add_rule(*rule)
                    break
        ri.iptables_manager.apply()

    def external_gateway_nat_rules(self, ex_gw_ip, internal_cidrs,
                                   interface_name):
        rules = [(‘POSTROUTING‘, ‘! -i %(interface_name)s ‘
                  ‘! -o %(interface_name)s -m conntrack ! ‘
                  ‘--ctstate DNAT -j ACCEPT‘ %
                  {‘interface_name‘: interface_name})]
        for cidr in internal_cidrs:
            rules.extend(self.internal_network_nat_rules(ex_gw_ip, cidr))
        return rules

    def internal_network_nat_rules(self, ex_gw_ip, internal_cidr):
        rules = [(‘snat‘, ‘-s %s -j SNAT --to-source %s‘ %
                 (internal_cidr, ex_gw_ip))]
        return rules