arp spoofing protection flow install failed

[shihanzhang]

Now ovs-agent failed to install arp spoofing protection flow for new VMs, because it will firstly install arp spoofing protection flow in funstion 'treat_devices_added_or_updated':
    def treat_devices_added_or_updated(self, devices, ovs_restarted):
            .....
            .....

            if self.prevent_arp_spoofing:
               self.setup_arp_spoofing_protection(self.int_br, port, details)

but then in function '_bind_devices', it will clear all flows for this new port, so the arp spoofing protection flow is also be clean

    def _bind_devices(self, need_binding_ports):
            .....
            ....
            if cur_tag != lvm.vlan:
                self.int_br.set_db_attribute(
                    "Port", port.port_name, "tag", lvm.vlan)
                if port.ofport != -1:
                    # NOTE(yamamoto): Remove possible drop_port flow
                    # installed by port_dead.
                    self.int_br.delete_flows(in_port=port.ofport)

[Kevin Benton (kevinbenton)]

where is the patch for this? can you please link it here?

[shihanzhang (shihanzhang)]

hi kevin, I don't know why jenkins does not link the patch automatically.
https://review.openstack.org/#/c/199425

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/199425
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=ff8bd9d1e9a1f5c7445af2c8a4489623634cb417
Submitter: Jenkins
Branch: master

commit ff8bd9d1e9a1f5c7445af2c8a4489623634cb417
Author: shihanzhang <email address hidden>
Date: Wed Jul 8 09:32:39 2015 +0800

    Install arp spoofing protection flow after setting port tag

    when ovs-agent set a tag for a port, it will first remove all
    flows on this port, because it should guarantee that no drop_port
    flow installed by port_dead remains, so arp spoofing protection
    flow must be installed after it.

    Closes-Bug: #1472452

    Change-Id: I566d0fd93b39e81a34214f1a7a0a1decc9a169d6

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: feature/pecan
Review: https://review.openstack.org/211492

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/211492
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=a7b91632fc65ab9d2687298c68b1d715866d0356
Submitter: Jenkins
Branch: feature/pecan

commit 966203f89dee8fe61fb2dce654e36e510e80380f
Author: Sukhdev Kapur <email address hidden>
Date: Wed Jul 1 16:30:44 2015 -0700

    Neutron-Ironic integration patch

    This patch is in preparation for the integration
    of Ironic and Neutron. A new vnic_type is being
    added so that ML2 drivers can filter for all
    Ironic ports based upon match for 'baremetal'.
    Nova/Ironic will set this vnic_type when issuing
    port-create request to neutron.
    (e.g. binding:vnic_type = 'baremetal' )

    Change-Id: I25dc9472b31db052719db503a10c1fb1a55572ef
    Partial-Implements: blueprint neutron-ironic-integration

commit 236e408272bcb9b8e957524864e571b5afdc4623
Author: Oleg Bondarev <email address hidden>
Date: Tue Jul 7 12:02:58 2015 +0300

    DVR: fix router scheduling

    Fix scheduling of DVR routers to not stop scheduling once
    csnat portion was scheduled. See bug report for failing
    scenario.

    This partially reverts
    commit 3794b4a83e68041e24b715135f0ccf09a5631178
    and fixes bug 1374473 by moving csnat scheduling
    after general dvr router scheduling, so double binding does
    not happen.

    Closes-Bug: #1472163
    Related-Bug: #1374473
    Change-Id: I57c06e2be732e47b6cce7c724f6b255ea2d8fa32

commit e152f93878b9bb6af7cfedc9e045892fcf7d0615
Author: Assaf Muller <email address hidden>
Date: Sat Aug 8 21:15:03 2015 +0300

    TESTING.rst love

    Change-Id: I64b569048f8f87ea2fe63d861302b4020d36493d

commit 633c52cca1b383af2c900e1663c8682114acd177
Author: sridhargaddam <email address hidden>
Date: Wed Aug 5 10:49:33 2015 +0000

    Avoid dhcp_release for ipv6 addresses

    dhcp_release is only supported for IPv4 addresses [1] and not for
    IPv6 addresses [2]. There will be no effect when it is called with
    IPv6 address. This patch adds a corresponding note and avoids calling
    dhcp_release for IPv6 addresses.

    [1] http://manpages.ubuntu.com/manpages/trusty/man1/dhcp_release.1.html
    [2] http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2013q2/007084.html

    Change-Id: I8b8316c9d3d011c2a687a3a1e2a4da5cf1b5d604

commit 2de8fad17402f38bbc30204ee2f4f99cf21cb69d
Author: OpenStack Proposal Bot <email address hidden>
Date: Mon Aug 10 06:11:06 2015 +0000

    Imported Translations from Transifex

    For more information about this automatic import see:
    https://wiki.openstack.org/wiki/Translations/Infrastructure

    Change-Id: I2b423e83a7d0ac8b23239f81fe33dd8382c6fff6

commit fef79dc7b9162e03c8891645494c115b52d4d014
Author: Henry Gessau <email address hidden>
Date: Mon Aug 3 23:30:34 2015 -0400

    Consistent layout and headings for devref

    The lack of convention for heading levels among the independently
    written devref documents was starting to make the Table of Contents
    look rather messy when rendered in HTML.

    This patch does not cover the "Neutron Internals" section since its
    layo...