IPv4 Link Local Addresses Not Supported in OVS firewall

[Drew Thorstensen]

There are certain workloads that require the ability to define IPv4 Link Local addresses dynamically, as defined in RFC3927.

The openvswitch_firewall service allows for IPv6 link local addresses (likely because they are deterministic), but does not account for IPv4 Link Local addresses. Without support of this, workloads that have not yet made the transition to IPv6 support won't be able to run with the openvswitch_firewall.

[Miguel Lavalle (minsel)]

@Drew,

I checked with a member of the FWaaS team (https://github.com/openstack/neutron-fwaas). This firewall is iptables based, not ovs. Are you referring to Neutron security groups?

[Drew Thorstensen (thorst)]

@Miguel,

I'm referring to this component: https://github.com/openstack/neutron/blob/master/neutron/agent/linux/openvswitch_firewall/firewall.py

My team actually has a patch that we're working on to propose up.

[Ravi Kumar Kota (ravkota3)]

@Miguel, I am going to propose a patch for this.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/462920

[Armando Migliaccio (armando-migliaccio)]

This bug has had a related patch abandoned and has been automatically un-assigned due to inactivity. Please re-assign yourself if you are continuing work or adjust the state as appropriate if it is no longer valid.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Armando Migliaccio (<email address hidden>) on branch: master
Review: https://review.openstack.org/462920
Reason: This review is > 4 weeks without comment and currently blocked by a core reviewer with a -2. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and contacting the reviewer with the -2 on this review to ensure you address their concerns.

[YAMAMOTO Takashi (yamamoto)]

if you mean openflow implementation and iptables implementation behaves differently, it sounds like a normal bug, rather than an RFE.
otherwise, i'm not sure what's wrong with allowed address pairs.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]