Description of problem:
OpenStack security-groups are currently not available for customers using the DPDK accelerated Open vSwitch (OVS+DPDK). This is due to the fact that our current Neutron firewall driver is based on iptables and relying on kernel functionality which is not available when using the DPDK datapath.
This RFE adds support for an alternative firewall driver which utilizes the conntrack feature on OVS. It should provide a working solution for OVS+DPDK starting with OVS 2.5, where the ct() action was implemented for the dpif-netdev datapath.
Neutron side is ready, as the conntrack-based firewall driver should work with both OVS and OVS+DPDK without special changes. That said, conntrack support for OVS+DPDK is not merged yet in upstream OVS and currently targeted to OVS 2.6.