)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8313,"name":"Lajos Katona","display_name":"lajoskatona","email":"katonalala@gmail.com","username":"elajkat","status":"Ericsson Software Technology"},"change_message_id":"312c0a764ecc56301fe508e19ed7639e1f62188c","unresolved":true,"context_lines":[{"line_number":33,"context_line":"risk of learning a flow that would otherwise be rejected due to port"},{"line_number":34,"context_line":"security."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Note that there is a complementary change [1] in OVN that allows secured"},{"line_number":37,"context_line":"LSPs to participate in FDB learning by removing a legacy constraint that"},{"line_number":38,"context_line":"port security must be disabled for an LSP to be eligible. The"},{"line_number":39,"context_line":"accompanying OVN change is also required for the desired architecture to"},{"line_number":40,"context_line":"work."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"[1] https://github.com/ovn-org/ovn/commit/873ac74eb7553737f57f8dc4f79fb6408524296b"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"90f7c42e_90bc1631","line":40,"range":{"start_line":36,"start_character":0,"end_line":40,"end_character":5},"updated":"2026-10-16 10:07:57.000000000","message":"so we have to bump our OVN version in the CI jobs and our docs when the OVN commit is not just merged bu released ?","commit_id":"c3d074e1bce6f9458179072770087280d91f2ffe"},{"author":{"_account_id":8313,"name":"Lajos Katona","display_name":"lajoskatona","email":"katonalala@gmail.com","username":"elajkat","status":"Ericsson Software Technology"},"change_message_id":"95d504c204e7b179ca69c3a23d92089828a44913","unresolved":true,"context_lines":[{"line_number":33,"context_line":"risk of learning a flow that would otherwise be rejected due to port"},{"line_number":34,"context_line":"security."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Note that there is a complementary change [1] in OVN that allows secured"},{"line_number":37,"context_line":"LSPs to participate in FDB learning by removing a legacy constraint that"},{"line_number":38,"context_line":"port security must be disabled for an LSP to be eligible. The"},{"line_number":39,"context_line":"accompanying OVN change is also required for the desired architecture to"},{"line_number":40,"context_line":"work."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"[1] https://github.com/ovn-org/ovn/commit/873ac74eb7553737f57f8dc4f79fb6408524296b"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"88806b48_73039dab","line":40,"range":{"start_line":36,"start_character":0,"end_line":40,"end_character":5},"in_reply_to":"19066c17_d2c31e8b","updated":"2026-10-21 10:44:56.000000000","message":"thanks for the explanation, could you please add a releasenote to describe shortly this case?","commit_id":"c3d074e1bce6f9458179072770087280d91f2ffe"},{"author":{"_account_id":37309,"name":"Bryan Fraschetti","display_name":"Bryan Fraschetti","email":"bryan.fraschetti@canonical.com","username":"bryanfraschetti"},"change_message_id":"7a05ddea3165df8e465879f52a33bcee07da27f6","unresolved":true,"context_lines":[{"line_number":33,"context_line":"risk of learning a flow that would otherwise be rejected due to port"},{"line_number":34,"context_line":"security."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Note that there is a complementary change [1] in OVN that allows secured"},{"line_number":37,"context_line":"LSPs to participate in FDB learning by removing a legacy constraint that"},{"line_number":38,"context_line":"port security must be disabled for an LSP to be eligible. The"},{"line_number":39,"context_line":"accompanying OVN change is also required for the desired architecture to"},{"line_number":40,"context_line":"work."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"[1] https://github.com/ovn-org/ovn/commit/873ac74eb7553737f57f8dc4f79fb6408524296b"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"19066c17_d2c31e8b","line":40,"range":{"start_line":36,"start_character":0,"end_line":40,"end_character":5},"in_reply_to":"90f7c42e_90bc1631","updated":"2026-10-16 16:54:09.000000000","message":"Well, so without the OVN change basically there won\u0027t behaviour change. If this is merged without an OVN version bump to contain the OVN-side fix (once the fix is in a tagged release), the duplicate flow problem will be resolved but FDB learning will remain disabled because port security is enabled. From a user perspective this means the overall setup will continue to behave as it currently does in that the desired behvaiour will still be broken. There won\u0027t be a regression without version bumping OVN, it just won\u0027t be fully fixed.\nAnother route to avoid version bumping OVN would be backporting their fix into maintained OVN releases. I plan to attend the next OVN meeting and ask whether their patch is backportable as a bug-fix or if they consider it a new feature","commit_id":"c3d074e1bce6f9458179072770087280d91f2ffe"}],"neutron/plugins/ml2/drivers/ovn/mech_driver/ovsdb/ovn_client.py":[{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"002ee1c3744fc303447226e88f04b132dbdd3de0","unresolved":true,"context_lines":[{"line_number":508,"context_line":"                # OVN allows any mac address from a port if \"unknown\""},{"line_number":509,"context_line":"                # is added to the Logical_Switch_Port.addresses column."},{"line_number":510,"context_line":"                # So add it."},{"line_number":511,"context_line":"                addresses.append(ovn_const.UNKNOWN_ADDR)"},{"line_number":512,"context_line":""},{"line_number":513,"context_line":"        # HA Chassis Group will bind the port to the highest"},{"line_number":514,"context_line":"        # priority Chassis"}],"source_content_type":"text/x-python","patch_set":2,"id":"a351eaae_25c6c2af","line":511,"range":{"start_line":511,"start_character":16,"end_line":511,"end_character":56},"updated":"2026-10-22 06:12:23.000000000","message":"I won\u0027t accept this patch because:\n1) In order to fix a very specific scenario (AAP with VIP+VMAC in ML2/OVN), we always add `unknown` to all port addresses. If port security is disabled in this port, it will receive all unknown unicast traffic, with no filter.\n2) FDB poisoning across chassis: before creating an FDB entry, OVN checks the port security of a port. It verifies that, for example, a MAC address is in `port_security`. With `unknown` in all ports, every port will participate in FDB learning, creating a large attack surface.\n3) Unknown unicast flood amplification (DoS). If a frame with an unknown address arrives to the cluster, OVN floods the frame to every port that has `unknown` in `addresses`.\n\nThe bug in OVN is legit [1], I filled it some weeks ago. But it is better not to have this functionality for now rather than accepting this workaround.\n\n[1]https://redhat.atlassian.net/browse/FDP-4270","commit_id":"c3d074e1bce6f9458179072770087280d91f2ffe"}]}