openstack
/
neutron
Code Issues Proposed changes
neutron/neutron/agent/linux/openvswitch_firewall
History
Thomas Morin f2caa7c823 OVS firewall: do strip_vlan in TRANSIENT_TABLE 
This change moves the strip_vlan action from RULES_INGRESS/82 to
TRANSIENT_TABLE after the point where the traffic from local VM ports
has been moved to BASE_EGRESS. A reason for this move is that strip_vlan
is only needed for traffic *not* coming from VM ports and coming on a
patch  port from br-*, and that it is hence simpler do do the strip_vlan
in TRANSIENT_TABLE rather than in mutliple places that also happen to be
common with traffic from local VMs.

This change also addresses another need:
I16a35b5d6c54901899d24fc94bd3438c1f1be05e results in add_flow being
possibly done with an Openflow version higher than OF1.0. The
strip_action as currently done is not compatible with OF>1.0, because
later versions require matching on dl_vlan first (the "strip vlan if
there is one" behavior of OF1.0 is not supported anymore). For this
reason this change adds a match on dl_vlan for the strip_vlan rule.

Change-Id: I76ee34a614237bbc99989ce9c1b96a30456be282
 		2017-07-19 11:05:59 +00:00
..
__init__.py Open vSwitch conntrack based firewall driver 2016-02-16 16:47:21 +00:00
constants.py ovsfw: Support protocol numbers instead of just tcp and udp 2017-01-20 11:17:40 -05:00
exceptions.py ovsfw: Raise exception if tag cannot be found in other_config 2016-12-19 08:07:47 -05:00
firewall.py OVS firewall: do strip_vlan in TRANSIENT_TABLE 2017-07-19 11:05:59 +00:00
rules.py OVS firewall: do strip_vlan in TRANSIENT_TABLE 2017-07-19 11:05:59 +00:00