On Tue, Jul 07, 2026 at 03:33:55PM +0200, Ilya Maximets wrote:
> On 7/7/26 2:19 PM, Mairtin O'Loingsigh via dev wrote:
> > When transit traffic arrives on an l3dgw port with TTL=0 or TTL=1,
> > northd generates an ICMP Time Exceeded reply. Previously, the action
> > for l3dgw ports used "ip4.dst <-> ip4.src", which swaps the source
> > and destination addresses. This sets the ICMP reply source to the
> > original packet's destination, instead of the receiving router port
> > address. For example, a packet from 203.0.113.50 destined to
> > 10.0.0.5 would produce an ICMP error with source 10.0.0.5 instead
> > of the router port's own address.
> >
> > Use "ip4.dst = ip4.src; ip4.src = <router_port_ip>" unconditionally
> > for both l3dgw and non-l3dgw ports, so the ICMP reply source is
> > always the router port's address in the matching subnet. The
> > is_chassis_resident() check for l3dgw ports is retained to ensure
> > only the gateway chassis generates the reply.
> >
> > Fixes: b56d5097c4b0 ("northd: Improvements of ICMP TTL exceeded behavior.")
>
> Hi. Mairtin. This doesn't look like the right tag. First, it should
> point to commit on the main branch and not to a cherry-pick. Second,
> it doesn't seem like that commit introduced the behavior you're trying
> to fix. Shouldn't it be:
> 4ecc61247d86 ("northd: fix ttl exceeded with FIP")
> ?
>
> At the same time, there was a reason for the ip swap instead of using
> the router ip. It's in the bugzilla linked to the original patch:
>
> - since the traffic is managed locally for FIP, we could send the ICMP
> error messages with src ip set to the logical router ip (172.17.1.254)
> but ovn will use the FIP mac (00:00:00:00:00:11) as src mac.
> This can poison the receiver arp cache.
>
> I guess, that can still be a concern?
>
> Best regards, Ilya Maximets.
>
Thanks for the review Ilya,
Ill fix the "Fixes" comment and set the source MAC to the router ports
MAC.
Regards,
Mairtin
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
