Add stateless firewall support to OVS firewall

[Bernard Cafarelli]

In Ussuri, we added support for stateless firewall [1]

This added support for stateful attribute in security group, with needed parts in API extensions "stateful-security-group", database, ... [2]

However implementation is currently only done for the iptables drivers, this limitation is noted in release notes for the feature.

As proposed discussed in the Victoria PTG [3], we should add support for this attribute in OVS firewall driver (default in devstack, and also needed for hardware offlad).

Most changes would be around skipping any parts involving conntrack. An implementation example also existed in networking-ovs-dpdk [4]

[1] https://bugs.launchpad.net/neutron/+bug/1753466
[2] https://review.opendev.org/#/c/572767/
[3] https://etherpad.opendev.org/p/neutron-victoria-ptg L162
[4] https://opendev.org/x/networking-ovs-dpdk/src/branch/stable/rocky/networking_ovs_dpdk/agent/ovs_dpdk_firewall.py

[LIU Yulong (dragon889)]

Is there anyone going to implement this?

[LIU Yulong (dragon889)]

OK, long time no response. I'm going to take over this. This clould be easily to accomplish with some mirrored code of [4].

[4] https://opendev.org/x/networking-ovs-dpdk/src/branch/stable/rocky/networking_ovs_dpdk/agent/ovs_dpdk_firewall.py

[Lajos Katona (lajos-katona)]

For reference I link here the logs from the Team meeting when we discussed the topic:
https://meetings.opendev.org/meetings/networking/2021/networking.2021-09-28-14.00.log.html#l-124

and the drivers meeting logs when we discussed this:
https://meetings.opendev.org/meetings/neutron_drivers/2021/neutron_drivers.2021-10-01-14.07.log.html

The agreement is to have this new fw driver intree as a new driver, and have a spec where the details can be discussed and formed