From: "jun.gu" <[email protected]>
When an ICMPv6 packet with icmp_type=128 and icmp_code=0 traverses
the OFTABLE_CHK_IN_PORT_SEC_ND table, the nd_target and nd_tll fields
will be included in the megaflow. This causes the revalidator to
invalidate the flow, which in turn triggers an upcall. The root cause
is that the final-stage map is included in the wildcards during
classifier rule lookup.
By adding the missing nw_ttl field to the OpenFlow rule, the previous
three stage maps-metadata, L2, and L3-are only included in the
wildcards. As a result, the nd_target and nd_tll fields are excluded
from the megaflow, preventing unnecessary revalidation and upcalls.
Fixes: 8cab00b ("ovn-controller: Add OF rules for port security.")
Reported-at:
https://mail.openvswitch.org/pipermail/ovs-discuss/2025-December/053889.html
Signed-off-by: Jun Gu <[email protected]>
---
controller/lflow.c | 1 +
tests/ovn.at | 12 ++++++------
2 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/controller/lflow.c b/controller/lflow.c
index e84fb2486..784a0d2dd 100644
--- a/controller/lflow.c
+++ b/controller/lflow.c
@@ -2773,6 +2773,7 @@ build_in_port_sec_nd_flows(const struct
sbrec_port_binding *pb,
match_set_dl_src(m, ps_addr->ea);
match_set_dl_type(m, htons(ETH_TYPE_IPV6));
match_set_nw_proto(m, IPPROTO_ICMPV6);
+ match_set_nw_ttl(m, 255);
match_set_icmp_type(m, 136);
match_set_icmp_code(m, 0);
match_set_arp_tha(m, eth_addr_zero);
diff --git a/tests/ovn.at b/tests/ovn.at
index 58127f0d3..2b3d893d0 100644
--- a/tests/ovn.at
+++ b/tests/ovn.at
@@ -35687,12 +35687,12 @@ echo " table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=80,arp,reg14=0x$sw0p2_key,meta
table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,arp,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,arp_spa=10.0.0.4,arp_sha=00:00:00:00:00:04
actions=load:0->NXM_NX_REG10[[12]]
table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,arp,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,arp_spa=20.0.0.4,arp_sha=00:00:00:00:00:04
actions=load:0->NXM_NX_REG10[[12]]
table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,arp,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,arp_spa=30.0.0.0/16,arp_sha=00:00:00:00:00:04
actions=load:0->NXM_NX_REG10[[12]]
- table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,icmp_type=136,icmp_code=0,nd_target=1000::4,nd_tll=00:00:00:00:00:00
actions=load:0->NXM_NX_REG10[[12]]
- table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,icmp_type=136,icmp_code=0,nd_target=1000::4,nd_tll=00:00:00:00:00:04
actions=load:0->NXM_NX_REG10[[12]]
- table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,icmp_type=136,icmp_code=0,nd_target=2000::/64,nd_tll=00:00:00:00:00:00
actions=load:0->NXM_NX_REG10[[12]]
- table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,icmp_type=136,icmp_code=0,nd_target=2000::/64,nd_tll=00:00:00:00:00:04
actions=load:0->NXM_NX_REG10[[12]]
- table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:13,icmp_type=136,icmp_code=0,nd_target=aef0::4,nd_tll=00:00:00:00:00:00
actions=load:0->NXM_NX_REG10[[12]]
- table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:13,icmp_type=136,icmp_code=0,nd_target=aef0::4,nd_tll=00:00:00:00:00:13
actions=load:0->NXM_NX_REG10[[12]]
+ table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,nw_ttl=255,icmp_type=136,icmp_code=0,nd_target=1000::4,nd_tll=00:00:00:00:00:00
actions=load:0->NXM_NX_REG10[[12]]
+ table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,nw_ttl=255,icmp_type=136,icmp_code=0,nd_target=1000::4,nd_tll=00:00:00:00:00:04
actions=load:0->NXM_NX_REG10[[12]]
+ table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,nw_ttl=255,icmp_type=136,icmp_code=0,nd_target=2000::/64,nd_tll=00:00:00:00:00:00
actions=load:0->NXM_NX_REG10[[12]]
+ table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,nw_ttl=255,icmp_type=136,icmp_code=0,nd_target=2000::/64,nd_tll=00:00:00:00:00:04
actions=load:0->NXM_NX_REG10[[12]]
+ table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:13,nw_ttl=255,icmp_type=136,icmp_code=0,nd_target=aef0::4,nd_tll=00:00:00:00:00:00
actions=load:0->NXM_NX_REG10[[12]]
+ table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:13,nw_ttl=255,icmp_type=136,icmp_code=0,nd_target=aef0::4,nd_tll=00:00:00:00:00:13
actions=load:0->NXM_NX_REG10[[12]]
table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,nw_ttl=255,icmp_type=135,icmp_code=0,nd_sll=00:00:00:00:00:00
actions=load:0->NXM_NX_REG10[[12]]
table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,nw_ttl=255,icmp_type=135,icmp_code=0,nd_sll=00:00:00:00:00:04
actions=load:0->NXM_NX_REG10[[12]]
table=OFTABLE_CHK_IN_PORT_SEC_ND,
priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,nw_ttl=255,icmp_type=135,icmp_code=0,nd_sll=00:00:00:00:00:13
actions=load:0->NXM_NX_REG10[[12]]
--
2.34.1
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
