Currently, priority-80 ls_in_l2_lkup ARP/ND response flows are generated for all NAT entries except those associated with unreachable LB IPs. In contrast, these flows are correctly generated for unreachable non-LB NATs.
Generate the missing ARP/ND response flows for unreachable LB NATs as well, making their behavior consistent with other unreachable NAT entries. Signed-off-by: Amir Aslan Aslani <[email protected]> --- northd/northd.c | 8 ++++---- tests/ovn-northd.at | 11 ++++++++++- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/northd/northd.c b/northd/northd.c index 3a4afa063..22108dd82 100644 --- a/northd/northd.c +++ b/northd/northd.c @@ -9883,14 +9883,14 @@ build_lswitch_rport_arp_req_flows_for_lbnats( * expect ARP requests/NS for the DNAT external_ip. */ if (nat_entry_is_v6(nat_entry)) { - if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v6, + if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v6_reachable, nat->external_ip)) { build_lswitch_rport_arp_req_flow( nat->external_ip, AF_INET6, sw_op, sw_od, 80, lflows, stage_hint, lflow_ref); } } else { - if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v4, + if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v4_reachable, nat->external_ip)) { build_lswitch_rport_arp_req_flow( nat->external_ip, AF_INET, sw_op, sw_od, 80, lflows, @@ -9927,14 +9927,14 @@ build_lswitch_rport_arp_req_flows_for_lbnats( * expect ARP requests/NS for the SNAT external_ip. */ if (nat_entry_is_v6(nat_entry)) { - if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v6, + if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v6_reachable, nat->external_ip)) { build_lswitch_rport_arp_req_flow( nat->external_ip, AF_INET6, sw_op, sw_od, 80, lflows, stage_hint, lflow_ref); } } else { - if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v4, + if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v4_reachable, nat->external_ip)) { build_lswitch_rport_arp_req_flow( nat->external_ip, AF_INET, sw_op, sw_od, 80, lflows, diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at index 86cab3d5b..e19ead670 100644 --- a/tests/ovn-northd.at +++ b/tests/ovn-northd.at @@ -6339,7 +6339,16 @@ AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | ovn_strip_lflows], [0], [dnl # Make sure that there is no flow for VIP 192.168.4.100 as it is unreachable. -AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | grep "192.168.4.100" | grep -v clone | grep "_MC_flood" -c], [1], [0 +AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | grep "192.168.4.100" -c], [1], [0 +]) + +AS_BOX([Adding an dnat_and_snat for LB unreachable VIP on ro1]) +check ovn-nbctl --wait=sb lr-nat-add ro1 dnat_and_snat 192.168.4.100 192.168.1.100 + +ovn-sbctl lflow-list ls1 > ls1_lflows +AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | grep "192.168.4.100" | ovn_strip_lflows], [0], [dnl + table=??(ls_in_l2_lkup ), priority=80 , match=(flags[[1]] == 0 && eth.dst == ff:ff:ff:ff:ff:ff && arp.op == 1 && arp.tpa == 192.168.4.100), action=(clone {outport = "ls1-ro1"; output; }; outport = "_MC_unknown"; output;) + table=??(ls_in_l2_lkup ), priority=90 , match=(flags[[1]] == 0 && eth.dst == ff:ff:ff:ff:ff:ff && arp.op == 1 && arp.tpa == 192.168.4.100 && arp.spa == 192.168.4.100), action=(outport = "_MC_flood_l2"; output;) ]) OVN_CLEANUP_NORTHD -- 2.34.1 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
