Implement source IP spoofing protection

[Kyle Mestery]

Currently, networking-ovn isn't doing any spoofing protection for source IP.

[Russell Bryant (russellb)]

I think we can just add an ACL row for this.

[Han Zhou (zhouhan)]

Should it be implemented by port-security?

OVN already has the schema for port-security but it is only with MAC. I think we should update OVN to support MAC + IP and then in plugin we can add it to port_security when constructing ovn_port_info.

[Russell Bryant (russellb)]

Yes, that's another option. I remember discussing an updated schema for port security that included the ability to specify IP addresses, but I don't think it has been implemented yet.

We could accomplish the goal using ACLs today, but ideally we should use port_security once that work is completed.

[Numan Siddique (numansiddique)]

I think this thread has the discussion about port security and allowed addres pairs.
http://openvswitch.org/pipermail/dev/2015-July/057141.html

I was looking into the other bug on allowed address pair support in ovn. I guess its better to have port-security support first.
I can look into updating port security to support MAC + IP in OVN if no is looking into this already.

[Han Zhou (zhouhan)]

@Numan, yes, it would be great to support in OVN first. Thank you for working on it.

[Russell Bryant (russellb)]

Thanks, Numan! Yes, that's the proposal I had in mind.

[Numan Siddique (numansiddique)]

This is addressed in the port security support.