ovsfw issue for allowed_address_pairs

[Jesse]

port's allowed_address_pairs allow different IP and MAC set for port.

The current ovsfw implementation has this issue for allowed_address_pairs with different MAC with VM's MAC:
1. Packets with allowed_address_pairs' MAC and IP (different MAC with VM's MAC) cannot come out from VM because the table=72 OpenFlow only check dl_src=VM-MAC in br-int.
2. Cannot ping from outside to VM's allowed_address_pairs' MAC and IP (different MAC with VM's MAC) because the table=0 OpenFlow only check dl_dst=VM-MAC.

We need to allow the situation that address_pairs with different MAC with VM's MAC.

Suggest change:
1. Do not check dl_src in table=72 because table=71 has checked
dl_src for Egress.
2. Add all allowed MACs in table=0 and table=73 for Ingress.
3. Check dl_dst and nw_dst in table=81 like table=71 does.
4. Do not check dl_dst in table=82 because this check has done
in table=0 and table=73.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/473751

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/473751
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=b7892b16b25c34edd9da6b4901b08a58c9725046
Submitter: Jenkins
Branch: master

commit b7892b16b25c34edd9da6b4901b08a58c9725046
Author: jufeng <email address hidden>
Date: Tue Jun 13 15:13:53 2017 +0800

    ovsfw: fix allowed_address_pairs MAC issue

    Current ovsfw implementation does not take care of the different
    MACs in allowed_address_pairs with the VM's MAC.
    This patch use the following method to fix this issue:
    1. Do not check dl_src in table=72 because table=71 has checked
    dl_src for Egress.
    2. Add all allowed MACs in table=0 and table=73 for Ingress.
    3. Do not check dl_dst in table=82 because this check has done
    in table=0 and table=73.
    4. Delete allowed MACs in table=0 and table=73 when needed.

    Change-Id: Iad59096f0c9855ebfd4a0d5b447e73b443d66c1d
    Closes-Bug: #1697593

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 11.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/510039

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/510039
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=dd153c3bbf9d10feaf05a0f088ce789e55e8bf96
Submitter: Zuul
Branch: stable/ocata

commit dd153c3bbf9d10feaf05a0f088ce789e55e8bf96
Author: jufeng <email address hidden>
Date: Tue Jun 13 15:13:53 2017 +0800

    ovsfw: fix allowed_address_pairs MAC issue

    Current ovsfw implementation does not take care of the different
    MACs in allowed_address_pairs with the VM's MAC.
    This patch use the following method to fix this issue:
    1. Do not check dl_src in table=72 because table=71 has checked
    dl_src for Egress.
    2. Add all allowed MACs in table=0 and table=73 for Ingress.
    3. Do not check dl_dst in table=82 because this check has done
    in table=0 and table=73.
    4. Delete allowed MACs in table=0 and table=73 when needed.

    Conflicts:
     doc/source/devref/openvswitch_firewall.rst
     neutron/agent/linux/openvswitch_firewall/firewall.py
     neutron/agent/linux/openvswitch_firewall/rules.py
     neutron/tests/unit/agent/linux/openvswitch_firewall/test_firewall.py
     neutron/tests/unit/agent/linux/openvswitch_firewall/test_rules.py

    Change-Id: Iad59096f0c9855ebfd4a0d5b447e73b443d66c1d
    Closes-Bug: #1697593
    (cherry picked from commit b7892b16b25c34edd9da6b4901b08a58c9725046)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 10.0.5 release.