OVS unnecessarily drops rule on setup_arp_protection

[Kevin Benton]

in the setup_arp_protection call of OVS, the first step is always to remove all of the rules for that port. However, in the majority of the cases, the jump rule will be added right back in so this is a waste of resources.

The linux bridge ARP spoofing only clears the rules if ARP spoofing protection needs to be removed.

https://github.com/openstack/neutron/blob/66eced001404064442f27f2fff28d5c4f2e18c18/neutron/plugins/ml2/drivers/linuxbridge/agent/arp_protect.py#L32

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/250090

[Armando Migliaccio (armando-migliaccio)]

This looks like may have a bit of a performance impact if run a gazillion times.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/liberty
Review: https://review.openstack.org/250119

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/kilo
Review: https://review.openstack.org/250121

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/250090
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=ea4165c2af2ad5c7b5423e25c507598ebd30f7b5
Submitter: Jenkins
Branch: master

commit ea4165c2af2ad5c7b5423e25c507598ebd30f7b5
Author: Kevin Benton <email address hidden>
Date: Wed Nov 25 15:42:46 2015 -0800

    Don't drop ARP table jump during OVS rewiring

    The previous OVS ARP spoofing code was dropping the rule to jump to
    the ARP protection table each time it was called. This call was
    unnecessary since the majority of port updates are not turning
    off port security.

    This patch adjusts the logic to only drop the jump rule if port-sec
    is disabled or if it is a network port. The existing functional tests
    ensure that connectivity works as expected.

    Closes-Bug: #1520013
    Change-Id: I7b396d758c2d4c7e1004257d432b210bf3ee5c66

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/250121
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=a6059a8b5feb6c372ccbabdbaa99652d7ffa217b
Submitter: Jenkins
Branch: stable/kilo

commit a6059a8b5feb6c372ccbabdbaa99652d7ffa217b
Author: Kevin Benton <email address hidden>
Date: Wed Nov 25 18:36:09 2015 -0800

    Don't drop ARP table jump during OVS rewiring

    The previous OVS ARP spoofing code was dropping the rule to jump to
    the ARP protection table each time it was called. This call was
    unnecessary since the majority of port updates are not turning
    off port security.

    This patch adjusts the logic to only drop the jump rule if port-sec
    is disabled or if it is a network port. The existing functional tests
    ensure that connectivity works as expected.

    Closes-Bug: #1520013
    Change-Id: I7b396d758c2d4c7e1004257d432b210bf3ee5c66
    (cherry picked from commit ea4165c2af2ad5c7b5423e25c507598ebd30f7b5)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/250119
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=c78ad00d6b0e0b9c0eec45c7fbd1ba732d6ee17e
Submitter: Jenkins
Branch: stable/liberty

commit c78ad00d6b0e0b9c0eec45c7fbd1ba732d6ee17e
Author: Kevin Benton <email address hidden>
Date: Wed Nov 25 15:42:46 2015 -0800

    Don't drop ARP table jump during OVS rewiring

    The previous OVS ARP spoofing code was dropping the rule to jump to
    the ARP protection table each time it was called. This call was
    unnecessary since the majority of port updates are not turning
    off port security.

    This patch adjusts the logic to only drop the jump rule if port-sec
    is disabled or if it is a network port. The existing functional tests
    ensure that connectivity works as expected.

    Closes-Bug: #1520013
    Change-Id: I7b396d758c2d4c7e1004257d432b210bf3ee5c66
    (cherry picked from commit ea4165c2af2ad5c7b5423e25c507598ebd30f7b5)

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/neutron 8.0.0.0b1 development milestone.

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/neutron 7.0.1 release.