On 21 June 2016 at 18:36, Chandra S Vejendla <[email protected]> wrote:
> By default all the ip traffic destined to router ip is dropped in > lr_in_ip_input stage. When the router ip is used as snat ip, allow > reverse snat traffic destined to the router ip. > > Signed-off-by: Chandra Sekhar Vejendla <[email protected]> > Thank you for the fix! This needs an update to ovn-northd.8.xml. If you are happy with the following incremental which does that (and also adds your name to AUTHORS and makes a couple of stylistic changes), I will apply it. diff --git a/AUTHORS b/AUTHORS index e2ac267..c39fdd3 100644 --- a/AUTHORS +++ b/AUTHORS @@ -39,6 +39,7 @@ Bruce Davie [email protected] Bryan Phillippe [email protected] Carlo Andreotti [email protected] Casey Barker [email protected] +Chandra Sekhar Vejendla [email protected] Christoph Jaeger [email protected] Chris Wright [email protected] Chuck Short [email protected] diff --git a/ovn/northd/ovn-northd.8.xml b/ovn/northd/ovn-northd.8.xml index 22edba9..6d52f7e 100644 --- a/ovn/northd/ovn-northd.8.xml +++ b/ovn/northd/ovn-northd.8.xml @@ -631,7 +631,10 @@ output; handled by one of the flows above, which amounts to ICMP (other than echo requests) and fragments with nonzero offsets. For each IP address <var>A</var> owned by the router, a priority-60 flow matches - <code>ip4.dst == <var>A</var></code> and drops the traffic. + <code>ip4.dst == <var>A</var></code> and drops the traffic. An + exception is made and the above flow is not added if the router + port's own IP address is used to SNAT packets passing through that + router. </li> </ul> diff --git a/ovn/northd/ovn-northd.c b/ovn/northd/ovn-northd.c index 6ff303e..1599e18 100644 --- a/ovn/northd/ovn-northd.c +++ b/ovn/northd/ovn-northd.c @@ -2047,9 +2047,9 @@ build_lrouter_flows(struct hmap *datapaths, struct hmap *ports, } /* Drop IP traffic to this router, unless the router ip is used as - * snat ip. */ + * SNAT ip. */ bool snat_ip_is_router_ip = false; - for (int i = 0; i < op->od->nbr->n_nat && !snat_ip_is_router_ip; i++) { + for (int i = 0; i < op->od->nbr->n_nat; i++) { const struct nbrec_nat *nat; ovs_be32 ip; @@ -2057,14 +2057,17 @@ build_lrouter_flows(struct hmap *datapaths, struct hmap *ports, if (strcmp(nat->type, "snat")) { continue; } + if (!ip_parse(nat->external_ip, &ip) || !ip) { static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1); VLOG_WARN_RL(&rl, "bad ip address %s in snat configuration " "for router %s", nat->external_ip, op->key); continue; } + if (ip == op->ip) { snat_ip_is_router_ip = true; + break; } } > --- > ovn/northd/ovn-northd.c | 33 ++++++++++++++++++++++++++++----- > 1 file changed, 28 insertions(+), 5 deletions(-) > > diff --git a/ovn/northd/ovn-northd.c b/ovn/northd/ovn-northd.c > index 17713ec..6ff303e 100644 > --- a/ovn/northd/ovn-northd.c > +++ b/ovn/northd/ovn-northd.c > @@ -2046,11 +2046,34 @@ build_lrouter_flows(struct hmap *datapaths, struct > hmap *ports, > free(actions); > } > > - /* Drop IP traffic to this router. */ > - match = xasprintf("ip4.dst == "IP_FMT, IP_ARGS(op->ip)); > - ovn_lflow_add(lflows, op->od, S_ROUTER_IN_IP_INPUT, 60, > - match, "drop;"); > - free(match); > + /* Drop IP traffic to this router, unless the router ip is used as > + * snat ip. */ > + bool snat_ip_is_router_ip = false; > + for (int i = 0; i < op->od->nbr->n_nat && !snat_ip_is_router_ip; > i++) { > + const struct nbrec_nat *nat; > + ovs_be32 ip; > + > + nat = op->od->nbr->nat[i]; > + if (strcmp(nat->type, "snat")) { > + continue; > + } > + if (!ip_parse(nat->external_ip, &ip) || !ip) { > + static struct vlog_rate_limit rl = > VLOG_RATE_LIMIT_INIT(5, 1); > + VLOG_WARN_RL(&rl, "bad ip address %s in snat > configuration " > + "for router %s", nat->external_ip, op->key); > + continue; > + } > + if (ip == op->ip) { > + snat_ip_is_router_ip = true; > + } > + } > + > + if (!snat_ip_is_router_ip) { > + match = xasprintf("ip4.dst == "IP_FMT, IP_ARGS(op->ip)); > + ovn_lflow_add(lflows, op->od, S_ROUTER_IN_IP_INPUT, 60, match, > + "drop;"); > + free(match); > + } > } > > /* NAT in Gateway routers. */ > -- > 2.6.1 > > _______________________________________________ > dev mailing list > [email protected] > http://openvswitch.org/mailman/listinfo/dev > _______________________________________________ dev mailing list [email protected] http://openvswitch.org/mailman/listinfo/dev
