[prev in list] [next in list] [prev in thread] [next in thread] 

List:       openvswitch-dev
Subject:    [ovs-dev] [PATCH v4 0/2] ovn: Apply ACL changes to existing connections.
From:       russell () ovn ! org (Russell Bryant)
Date:       2016-04-01 18:20:19
Message-ID: 1459534821-23681-1-git-send-email-russell () ovn ! org
[Download RAW message or body]

Prior to this commit, once a connection had been committed to the
connection tracker, the connection would continue to be allowed, even
if the policy defined in the ACL table changed.  This patch changes
the implementation so that existing connections are affected by policy
changes.

The implementation is based on the suggested approach in this mailing
list thread:

    http://openvswitch.org/pipermail/dev/2016-February/065716.html

The implementation is covered in much more detail in the commit message
for patch 3, as well as code comments and doc updates.

v1->v2:
 - Address issue pointed out by Han Zhou where removing and then re-creating
   an ACL did not allow an established connection to continue.  The changes
   are in patch 3.
v2->v3:
 - rebase and resolve conflicts with master.
 - Use ct_label instead of ct_mark.
 - patch 1: add ACK from han, otherwise unchanged
 - patch 2: add support for setting ct_label. v2 only included ct_mark.
   I did not include Han's ACK here because the changes were non trivial.
 - patch 3: add ACK from han. The rest of the changes are trivial
   replacement of ct_mark with ct_label.
v3->v4:
 - Added tests for additions to the ct_commit() logical flow action.
 - Simplified ct_commit() logical flow action additions as suggested by Ben.
 - Lots of doc cleanup as suggested by Justin.

Russell Bryant (2):
  ovn: Add ct_commit(ct_mark=INT, ct_label=INT); action.
  ovn: Apply ACL changes to existing connections.

 ovn/lib/actions.c           | 120 ++++++++++++++++++++++++++++-
 ovn/northd/ovn-northd.8.xml |  58 +++++++++++---
 ovn/northd/ovn-northd.c     | 182 +++++++++++++++++++++++++++++++++-----------
 ovn/ovn-sb.xml              |  13 +++-
 tests/ovn.at                |   4 +
 5 files changed, 317 insertions(+), 60 deletions(-)

-- 
2.5.5


[prev in list] [next in list] [prev in thread] [next in thread]