Add stateless firewall support to OVS firewall
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
neutron |
Confirmed
|
Wishlist
|
LIU Yulong |
Bug Description
In Ussuri, we added support for stateless firewall [1]
This added support for stateful attribute in security group, with needed parts in API extensions "stateful-
However implementation is currently only done for the iptables drivers, this limitation is noted in release notes for the feature.
As proposed discussed in the Victoria PTG [3], we should add support for this attribute in OVS firewall driver (default in devstack, and also needed for hardware offlad).
Most changes would be around skipping any parts involving conntrack. An implementation example also existed in networking-ovs-dpdk [4]
[1] https:/
[2] https:/
[3] https:/
[4] https:/
Changed in neutron: | |
status: | New → Confirmed |
importance: | Undecided → Wishlist |
Is there anyone going to implement this?