original_docstring: Apply secgroups to a port if all constructs are available
  
          This is an idempotent function to set up port security.  It
          relies on the pre-existence of the ACLs corresponding to
          security groups, so it may or may not be possible to apply
          security at this moment in time.  If it is, the port is
          recorded as secure (allowing binding to complete), and if it
          isn't we will attempt to reapply as more security groups are
          created.
  
          It is reapplied if the security group list changes on the
          port.  It is not reapplied if the security group content is
          changed, because the ACL number remains the same and therefore
          so does the port config.
  
          
docstring: Apply secgroups to a port if all constructs are available
  This is an idempotent function to set up port security.  It
  relies on the pre-existence of the ACLs corresponding to
  security groups, so it may or may not be possible to apply
  security at this moment in time.  If it is, the port is
  recorded as secure (allowing binding to complete), and if it
  isn't we will attempt to reapply as more security groups are
  created.
  
  It is reapplied if the security group list changes on the
  port.  It is not reapplied if the security group content is
  changed, because the ACL number remains the same and therefore
  so does the port config.
docstring_tokens: Apply secgroups to a port if all constructs are available This is an idempotent function to set up port security . It relies on the pre - existence of the ACLs corresponding to security groups so it may or may not be possible to apply security at this moment in time . If it is the port is recorded as secure ( allowing binding to complete ) and if it isn ' t we will attempt to reapply as more security groups are created . It is reapplied if the security group list changes on the port . It is not reapplied if the security group content is changed because the ACL number remains the same and therefore so does the port config .
code: def maybe_apply_secgroups(self, iface_idx):
  
          """Apply secgroups to a port if all constructs are available
  
          This is an idempotent function to set up port security.  It
          relies on the pre-existence of the ACLs corresponding to
          security groups, so it may or may not be possible to apply
          security at this moment in time.  If it is, the port is
          recorded as secure (allowing binding to complete), and if it
          isn't we will attempt to reapply as more security groups are
          created.
  
          It is reapplied if the security group list changes on the
          port.  It is not reapplied if the security group content is
          changed, because the ACL number remains the same and therefore
          so does the port config.
  
          """
  
          secgroup_ids = self.iface_awaiting_secgroups[iface_idx]
  
          try:
              (id, bound_callback, props) = self.iface_state[iface_idx]
          except KeyError:  # The port was unbound before we could apply ACLs
              LOG.info("Interface idx %s unbound before "
                       "security-group(s) could be applied", iface_idx)
              self.iface_awaiting_secgroups.pop(iface_idx, None)
              return
  
          # TODO(ijw): this is a convenience for spotting L3 and DHCP
          # ports, but it's not the right way
          # (TODO(ijw) it's also the only reason we go to iface_state)
          is_secured_port = props['bind_type'] == 'vhostuser'
  
          # If security-groups are enabled and it's a port needing
          # security proceed to set L3/L2 ACLs, else skip security.
          # If security-groups are empty, apply the default spoof-acls.
          # This is the correct behavior when security-groups are enabled but
          # not set on a port.
          if (self.secgroup_enabled and
                  secgroup_ids is not None and  # port security off
                  is_secured_port):
              if not self.vppf.maybe_set_acls_on_port(
                      secgroup_ids,
                      iface_idx):
                  # The ACLs for secgroups are not yet ready
                  # Leave ourselves in the pending list
                  return
  
          else:
              LOG.debug("Clearing port_security on "
                        "port %s", id)
              self.vppf.remove_acls_on_port(
                  iface_idx)
  
          # Remove with no error if not present
          self.iface_awaiting_secgroups.pop(iface_idx, None)
  
          self.maybe_up(iface_idx)
code_tokens: def maybe_apply_secgroups ( self , iface_idx ) : secgroup_ids = self . iface_awaiting_secgroups [ iface_idx ] try : ( id , bound_callback , props ) = self . iface_state [ iface_idx ] except KeyError : LOG . info ( "Interface idx %s unbound before " "security-group(s) could be applied" , iface_idx ) self . iface_awaiting_secgroups . pop ( iface_idx , None ) return is_secured_port = props [ 'bind_type' ] == 'vhostuser' if ( self . secgroup_enabled and secgroup_ids is not None and is_secured_port ) : if not self . vppf . maybe_set_acls_on_port ( secgroup_ids , iface_idx ) : return else : LOG . debug ( "Clearing port_security on " "port %s" , id ) self . vppf . remove_acls_on_port ( iface_idx ) self . iface_awaiting_secgroups . pop ( iface_idx , None ) self . maybe_up ( iface_idx )
short_docstring: Apply secgroups to a port if all constructs are available
  This is an idempotent function to set up port security.
short_docstring_tokens: Apply secgroups to a port if all constructs are available This is an idempotent function to set up port security .
comment: """Apply secgroups to a port if all constructs are available
  
          This is an idempotent function to set up port security.  It
          relies on the pre-existence of the ACLs corresponding to
          security groups, so it may or may not be possible to apply
          security at this moment in time.  If it is, the port is
          recorded as secure (allowing binding to complete), and if it
          isn't we will attempt to reapply as more security groups are
          created.
  
          It is reapplied if the security group list changes on the
          port.  It is not reapplied if the security group content is
          changed, because the ACL number remains the same and therefore
          so does the port config.
  
          """$SEP$# The port was unbound before we could apply ACLs$SEP$# TODO(ijw): this is a convenience for spotting L3 and DHCP$SEP$# ports, but it's not the right way$SEP$# (TODO(ijw) it's also the only reason we go to iface_state)$SEP$# If security-groups are enabled and it's a port needing$SEP$# security proceed to set L3/L2 ACLs, else skip security.$SEP$# If security-groups are empty, apply the default spoof-acls.$SEP$# This is the correct behavior when security-groups are enabled but$SEP$# not set on a port.$SEP$# port security off$SEP$# The ACLs for secgroups are not yet ready$SEP$# Leave ourselves in the pending list$SEP$# Remove with no error if not present