fix_CVE-2014-8160_gre-tunneling-issue

[guessi]

fix side effect of CVE-2014-8160 patch:
after applying a kernel upgrade, netfilter default behavior changed,
without this change, guest instacnes running on node with gre tunnel
may have no network access, we need to load an extra kernel module
nf_conntrack_proto_gre explicitly to resolve this issue.

references:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=db29a9508a9246e77087c5531e45b2c88ec6988b
http://www.spinics.net/lists/netfilter-devel/msg33430.html
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8160

step for reproduce:

1. setup a compute node without CVE-2014-8160 patch

   Ubuntu, for example,

   • Ubuntu Precise (kernel version < 3.13.0-46.75~precise1), for havana.

   • Ubuntu Trusty (kernel version < 3.16.0-31.41~14.04.1), for icehouse, juno, kilo, etc.

     reference:

   • http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-8160.html

2. launch a guest instance

3. try to ping guest instance's gateway from inside guest instance
   ping test should passed

4. upgrade compute nodes' kernel

   Ubuntu, for example,

   • Ubuntu Precise (kernel version >= 3.13.0-46.75~precise1), for havana.

   • Ubuntu Trusty (kernel version >= 3.16.0-31.41~14.04.1), for icehouse, juno, kilo, etc.

     reference:

   • http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-8160.html

5. repeat step 2 & 3 again
   ping test should failed, guest instance have no access to the networks