Prior to this commit, once a connection had been committed to the
connection tracker, the connection would continue to be allowed, even
if the policy defined in the ACL table changed. This patch changes
the implementation so that existing connections are affected by policy
changes.
The implementation is based on the suggested approach in this mailing
list thread:
http://openvswitch.org/pipermail/dev/2016-February/065716.html
The implementation is covered in much more detail in the commit message
for patch 3, as well as code comments and doc updates.
Russell Bryant (3):
ovn: Update ACL flow docs.
ovn: Add ct_commit(ct_mark=INTEGER); action.
ovn: Apply ACL changes to existing connections.
ovn/lib/actions.c | 59 ++++++++++++++++++++--
ovn/northd/ovn-northd.8.xml | 33 +++++++++---
ovn/northd/ovn-northd.c | 119 +++++++++++++++++++++++++++++++++-----------
ovn/ovn-sb.xml | 20 +++++++-
4 files changed, 189 insertions(+), 42 deletions(-)
--
2.5.0
_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev
