On 7/7/26 2:19 PM, Mairtin O'Loingsigh via dev wrote:
> When transit traffic arrives on an l3dgw port with TTL=0 or TTL=1,
> northd generates an ICMP Time Exceeded reply. Previously, the action
> for l3dgw ports used "ip4.dst <-> ip4.src", which swaps the source
> and destination addresses. This sets the ICMP reply source to the
> original packet's destination, instead of the receiving router port
> address. For example, a packet from 203.0.113.50 destined to
> 10.0.0.5 would produce an ICMP error with source 10.0.0.5 instead
> of the router port's own address.
>
> Use "ip4.dst = ip4.src; ip4.src = <router_port_ip>" unconditionally
> for both l3dgw and non-l3dgw ports, so the ICMP reply source is
> always the router port's address in the matching subnet. The
> is_chassis_resident() check for l3dgw ports is retained to ensure
> only the gateway chassis generates the reply.
>
> Fixes: b56d5097c4b0 ("northd: Improvements of ICMP TTL exceeded behavior.")
Hi. Mairtin. This doesn't look like the right tag. First, it should
point to commit on the main branch and not to a cherry-pick. Second,
it doesn't seem like that commit introduced the behavior you're trying
to fix. Shouldn't it be:
4ecc61247d86 ("northd: fix ttl exceeded with FIP")
?
At the same time, there was a reason for the ip swap instead of using
the router ip. It's in the bugzilla linked to the original patch:
- since the traffic is managed locally for FIP, we could send the ICMP
error messages with src ip set to the logical router ip (172.17.1.254)
but ovn will use the FIP mac (00:00:00:00:00:11) as src mac.
This can poison the receiver arp cache.
I guess, that can still be a concern?
Best regards, Ilya Maximets.
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
