[RFE] Support allowed address pairs without ip address

[Trevor McCasland]

Allowed address pairs simply pairs IP addresses and mac addresses.

This RFE asks to allow '0.0.0.0/0' to be specified for the ip address or to make it optional, so that a user can configure ports to filter traffic with only a mac list.

[Ihar Hrachyshka (ihar-hrachyshka)]

Sorry, this RFE got triaged too quickly, we need clarification on use case here.

Also, don't we already allow 0.0.0.0/0 for ip address for pairs? For example, I see this patch: https://review.openstack.org/#/c/194741/ that correctly disables spoofing protection for 0.0.0.0/0

Let's start with a use case, and then we can figure out what you miss in the current neutron API.

[Ian Wells (ijw-ubuntu)]

0.0.0.0/0 works as far as I can tell for IP packets (though it doesn't allow non-IP packets, so there's that).

[Trevor McCasland (twm2016)]

Ihar, we want spoofing protection without the IP and only the MAC address. So in the case of 0.0.0.0/0, all IPs are acceptable only if the MAC the IP is associated with is in the list of configured MAC addresses.

We can ammend the if statement to something like the following (where get_mac() is fake):

if any(netaddr.IPNetwork(ip).prefixlen == 0 and not get_mac(ip) for ip in addresses)
    return

Use cases are for network security, I will ask for a specific scenario.

[LIU Yulong (dragon889)]

I may say this should make it 0.0.0.0/0 work for ml2 ovs driver:
https://review.opendev.org/#/c/712632/

[Slawek Kaplonski (slaweq)]

As was discussed on the PTG, we decided to close this RFE for now. Feel free to reopen it if there will be valid use case for that and if You will want to work on that. Then we can discuss it again in the drivers team meeting.