Metaswitch/calico — pull request #4 by Lukasa (2014-07-11 10:22:58+00:00)
Title: Add metadata function to Felix.

This patch updates Felix to allow it to orchestrate the metadata proxy. This ensures that Calico-based OpenStack deployments can continue to use the metadata function to provide configuration to their guest VMs.

This change comes in a few parts:

1. Felix can now launch the metadata proxy. This was previously done by the L3 Agent, but this agent is not valid in Calico networks so cannot be responsible for launching the proxy.
2. Felix now programs NAT ACLs to capture traffic leaving VMs destined for 169.254.169.254:80 and redirects them to the metadata proxy. Note that using `j REDIRECT` in the iptables rule is not sufficient as the packets don't appear get rewritten on their way back, so `-j DNAT` is required instead.
3. Felix also enables local routing on each of the VM tap devices as they're created. This is to prevent the kernel treating the NATted packet from step 2 as a martian and dropping it on the floor.

Note that step 3 adds a security vulnerability, in that guest VMs can emit packets with destination IP 127.0.0.1 and have them routed to the host by the host. This vulnerability is not particularly alarming (they can already route to the host's IP directly), but should be fixed when we start toughening up the ACLs.

Note that step 2 adds an OpenStack `IptablesManager` into Felix itself, in addition to the one owned by the FirewallDriver. This should allow us to program our own ACLs that take effect _before_ the rules programmed by OpenStack. For now its only purpose is to add the NAT rule.

This should resolve #3, along with Metaswitch/calico-neutron#2.