yahoo-eng-team team mailing list archive

[Jesse <jesse@xxxxxxxxxxxx>]

Public bug reported:

port's allowed_address_pairs allow different IP and MAC set for port.

The current ovsfw implementation has this issue for allowed_address_pairs with different MAC with VM's MAC:
1. Packets with allowed_address_pairs' MAC and IP (different MAC with VM's MAC) cannot come out from VM because the table=72 OpenFlow only check dl_src=VM-MAC in br-int.
2. Cannot ping from outside to VM's allowed_address_pairs' MAC and IP (different MAC with VM's MAC)  because the table=0 OpenFlow only check dl_dst=VM-MAC.

We need to allow the situation that address_pairs with different MAC
with VM's MAC.

Suggest change:
1. Do not check dl_src in table=72 because table=72 has checked dl_src for Egress
2. Add all allowed MACs in table=0 and table=73 for Ingress
3. Check dl_dst and nw_dst in table=81 like table=71 do
4. Do not check dl_dst in table=82 because this check has done in table=0 and table=73

** Affects: neutron
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1697593

Title:
  ovsfw issue for allowed_address_pairs

Status in neutron:
  New

Bug description:
  port's allowed_address_pairs allow different IP and MAC set for port.

  The current ovsfw implementation has this issue for allowed_address_pairs with different MAC with VM's MAC:
  1. Packets with allowed_address_pairs' MAC and IP (different MAC with VM's MAC) cannot come out from VM because the table=72 OpenFlow only check dl_src=VM-MAC in br-int.
  2. Cannot ping from outside to VM's allowed_address_pairs' MAC and IP (different MAC with VM's MAC)  because the table=0 OpenFlow only check dl_dst=VM-MAC.

  We need to allow the situation that address_pairs with different MAC
  with VM's MAC.

  Suggest change:
  1. Do not check dl_src in table=72 because table=72 has checked dl_src for Egress
  2. Add all allowed MACs in table=0 and table=73 for Ingress
  3. Check dl_dst and nw_dst in table=81 like table=71 do
  4. Do not check dl_dst in table=82 because this check has done in table=0 and table=73

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1697593/+subscriptions