---
features:
  - |
    In this release the OVS plugin was extended to always plug VIFs even when
    libvirt could plug the vif. This will enable faster migration leveraging
    the multiple port bindings work completed in the Rocky release.
security:
  - |
    In this release an edgecase where libvirt plugged the VIF instead of os-vif
    was addressed. Previously if ``ovs_hybrid_plug`` was set to ``False`` in
    the port binding details, os-vif would only ensure the ovs bridge existed
    and the plugging would be done by libvirt. As a result during live
    migration, there was a short interval where a guest could receive tagged
    broadcast, multicast, or flooded traffic to/from another tenant.
    This vulnerability is described in `bug 1734320`_. By ensuring that
    os-vif always creates the OVS port as part of vif plugging we enable
    neutron to isolate the port prior to nova resuming the VM on the
    destination node. Note that as Nova cannot rely on Neutron to send
    ``network-vif-plugged`` events on completion of wiring up an interface
    it cannot wait to receive a notification before proceeding with the
    migration. As a result this is a partial mitigation and additional changes
    will be required to fully address this bug.

    .. _bug 1734320: https://bugs.launchpad.net/neutron/+bug/1734320
  - |
    A new config option was introduced for the OVS VIF plugin.
    The ``isolate_vif`` option was added as a partial mitigation of
    `bug 1734320`_. The ``isolate_vif`` option defaults to ``False`` for
    backwards compatibility with SDN controller based OpenStack deployments.
    For all deployments using the reference implementation of ML2/OVS with
    the neutron L2 agents, ``isolate_vif`` should be set to ``True``.
    This option instructs the OVS plugin to assign the VIF to the
    Neutron dead VLAN (4095) when attaching the interface to OVS. By setting
    the VIF's VLAN to this dead VLAN number, we eliminate the small attack
    vector that exists for other tenants to read packets during the VIF's
    bring up.