From: Numan Siddique <[email protected]> Similar to router ports and localnet ports, we need to skip switch ports from conntrack checks. Otherwise the packets received from remote ports of a spine switch will enter the peer switch's ingress pipeline and will be marked as inv when sent to conntrack and dropped.
Signed-off-by: Numan Siddique <[email protected]> --- northd/northd.c | 16 ++++++++++++++++ northd/northd.h | 3 ++- tests/ovn-northd.at | 35 +++++++++++++++++++++++++++++++++++ 3 files changed, 53 insertions(+), 1 deletion(-) diff --git a/northd/northd.c b/northd/northd.c index adaa94e859..e998c80817 100644 --- a/northd/northd.c +++ b/northd/northd.c @@ -561,6 +561,7 @@ ovn_datapath_create(struct hmap *datapaths, const struct uuid *key, sset_init(&od->router_ips); od->ls_peers = VECTOR_EMPTY_INITIALIZER(struct ovn_datapath *); od->router_ports = VECTOR_EMPTY_INITIALIZER(struct ovn_port *); + od->switch_ports = VECTOR_EMPTY_INITIALIZER(struct ovn_port *); od->l3dgw_ports = VECTOR_EMPTY_INITIALIZER(struct ovn_port *); od->localnet_ports = VECTOR_EMPTY_INITIALIZER(struct ovn_port *); od->lb_with_stateless_mode = false; @@ -589,6 +590,7 @@ ovn_datapath_destroy(struct ovn_datapath *od) ovn_destroy_tnlids(&od->port_tnlids); destroy_ipam_info(&od->ipam_info); vector_destroy(&od->router_ports); + vector_destroy(&od->switch_ports); vector_destroy(&od->ls_peers); vector_destroy(&od->localnet_ports); vector_destroy(&od->l3dgw_ports); @@ -1616,6 +1618,10 @@ join_logical_ports_lsp(struct hmap *ports, vector_push(&od->localnet_ports, &op); } + if (lsp_is_switch(nbsp)) { + vector_push(&od->switch_ports, &op); + } + if (lsp_is_vtep(nbsp)) { od->has_vtep_lports = true; } @@ -6210,6 +6216,11 @@ build_ls_stateful_rec_pre_acls( S_SWITCH_IN_PRE_ACL, S_SWITCH_OUT_PRE_ACL, 110, lflows, lflow_ref); } + VECTOR_FOR_EACH (&od->switch_ports, op) { + skip_port_from_conntrack(od, op, true, + S_SWITCH_IN_PRE_ACL, S_SWITCH_OUT_PRE_ACL, + 110, lflows, lflow_ref); + } struct ovn_port *lp; VECTOR_FOR_EACH (&od->localnet_ports, lp) { skip_port_from_conntrack(od, lp, true, S_SWITCH_IN_PRE_ACL, @@ -6420,6 +6431,11 @@ build_ls_stateful_rec_pre_lb(const struct ls_stateful_record *ls_stateful_rec, S_SWITCH_IN_PRE_LB, S_SWITCH_OUT_PRE_LB, 110, lflows, lflow_ref); } + VECTOR_FOR_EACH (&od->switch_ports, op) { + skip_port_from_conntrack(od, op, true, + S_SWITCH_IN_PRE_LB, S_SWITCH_OUT_PRE_LB, + 110, lflows, lflow_ref); + } /* Localnet ports have no need for going through conntrack, unless * the logical switch has a load balancer. Then, conntrack is necessary diff --git a/northd/northd.h b/northd/northd.h index e4d7de9f9e..eb5c15f34f 100644 --- a/northd/northd.h +++ b/northd/northd.h @@ -419,7 +419,8 @@ struct ovn_datapath { /* Logical switch data. */ struct vector router_ports; /* Vector of struct ovn_port *. */ - + struct vector switch_ports; /* Vector of struct ovn_port * of + * type 'switch'. */ struct hmap port_tnlids; uint32_t port_key_hint; diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at index 0bcb5e90b3..3fa9d4b9e3 100644 --- a/tests/ovn-northd.at +++ b/tests/ovn-northd.at @@ -19337,3 +19337,38 @@ AT_CHECK([grep "lr_in_policy[[^_]]" lr0flows | ovn_strip_lflows | sort], [0], [d OVN_CLEANUP_NORTHD AT_CLEANUP ]) + +AT_SETUP([Conntrack skip for switch ports connected to spine switch]) +ovn_start + +check ovn-nbctl ls-add spine +check ovn-nbctl ls-add ls1 + +# Connect ls1 to spine. +check ovn-nbctl lsp-add spine spine-to-ls1 +check ovn-nbctl lsp-add ls1 ls1-to-spine +check ovn-nbctl lsp-set-type spine-to-ls1 switch peer=ls1-to-spine +check ovn-nbctl lsp-set-type ls1-to-spine switch peer=spine-to-ls1 + +check ovn-nbctl lsp-add ls1 ls1-p1 -- \ +lsp-set-addresses ls1-p1 "f0:00:00:01:02:01 172.16.1.1" + +check ovn-nbctl acl-add ls1 from-lport 1003 "ip4" allow-related + + +check ovn-nbctl --wait=sb sync + +AT_CHECK([ovn-sbctl dump-flows ls1 > ls1flows]) +AT_CAPTURE_FILE([ls1flows]) + +AT_CHECK([grep "ls1-to-spine" ls1flows | ovn_strip_lflows | sort], [0], [dnl + table=??(ls_in_lookup_fdb ), priority=100 , match=(inport == "ls1-to-spine"), action=(reg0[[11]] = lookup_fdb(inport, eth.src); next;) + table=??(ls_in_pre_acl ), priority=110 , match=(ip && inport == "ls1-to-spine"), action=(next;) + table=??(ls_in_pre_lb ), priority=110 , match=(ip && inport == "ls1-to-spine"), action=(next;) + table=??(ls_in_put_fdb ), priority=100 , match=(inport == "ls1-to-spine" && reg0[[11]] == 0), action=(put_fdb(inport, eth.src); next;) + table=??(ls_out_pre_acl ), priority=110 , match=(ip && outport == "ls1-to-spine"), action=(next;) + table=??(ls_out_pre_lb ), priority=110 , match=(ip && outport == "ls1-to-spine"), action=(next;) +]) + +OVN_CLEANUP_NORTHD +AT_CLEANUP -- 2.52.0 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
