[ovs-dev] [PATCH 3/3] ovn: Add address_set() support for ACLs.

[Ben Pfaff]

On Tue, Apr 05, 2016 at 05:24:19PM -0400, Russell Bryant wrote:
> This feature was originally proposed here:
> 
>   http://openvswitch.org/pipermail/dev/2016-March/067440.html
> 
> A common use case for OVN ACLs involves needing to match a set of IP
> addresses.
> 
>    outport == "lp1" && ip4.src == {10.0.0.5, 10.0.0.25, 10.0.0.50}
> 
> This example match only has 3 addresses, but it could easily have
> hundreds of addresses.  In some cases, the same large set of addresses
> needs to be used in several ACLs.
> 
> This patch adds a new Address_Set table to OVN_Northbound so that a set
> of addresses can be specified once and then referred to by name in ACLs.
> To recreate the above example, you would first create an address set:
> 
>   $ ovn-nbctl create Address_Set name=set1 addresses=10.0.0.5,10.0.0.25,10.0.0.50
> 
> Then you can refer to this address set by name in an ACL match:
> 
>   outport == "lp1" && ip4.src == address_set(set1)
> 
> Signed-off-by: Russell Bryant <russell at ovn.org>

It might be worth making address sets scoped somehow.  Otherwise it
might eventually become a bottleneck if there are many address sets that
a given hypervisor does not need to know about.

I am not sure that I am in favor of the restriction that all of the
addresses in a given set have the same form, described here:

+      Each row in this table represents a named set of addresses.
+      An address set may contain MAC, IPv4, or IPv6 addresses, but
+      a single address set must contain addresses all of the same type.

This restriction might be surprising to someone already familiar with
the OVN matching language, which otherwise doesn't have such a
restriction.

I don't see anything that indicates that an address set can include CIDR
or bitwise matches, e.g. 192.168.0.0/24 or
01:00:00:00:00:00/01:00:00:00:00:00.  I don't know why that would be
restricted.

I haven't done a detailed review yet but it sounds like you plan to post
a v2.