Route tags ("ic-route-tag") are a convenient way to identify where an
IC route comes from, but the only way to act on them when learning
routes is the "ic-route-filter-tag" option on a Logical_Router_Port,
and it is limited in two ways.First, it only ever worked with a single tag: the learned route's tag was compared to the option value with a plain strcmp(), so a comma-separated value silently matched nothing and the filter became a no-op. Patch 1 parses the option as a comma-separated list and matches the route tag against the resulting set, mirroring what the "ic-route-filter-adv" and "ic-route-filter-learn" prefix filters already do. A single tag keeps behaving exactly as before. Second, the option is a blocklist only. There is no way to express the opposite policy - "learn only routes carrying one of these tags" - which is what a router port wants when it should import routes from a known set of VPCs and drop everything else. Patch 2 adds a new "ic-route-allow-tag" option that takes a comma-separated list of tags: when set, only IC routes whose "ic-route-tag" is in that list are learned, and every other route, including untagged ones, is filtered out. "ic-route-filter-tag" still takes precedence, so a route whose tag is blocked is skipped even if the same tag is allowlisted. Both patches extend the existing route-tag test in tests/ovn-ic.at. Lucas Vargas Dias (2): ic: Support multiple tags in ic-route-filter-tag. ic: Add allowlist filter for learned IC route tags. NEWS | 4 ++++ ic/ovn-ic.c | 41 +++++++++++++++++++++++++++++----- ovn-nb.xml | 31 +++++++++++++++++++++++--- tests/ovn-ic.at | 58 +++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 125 insertions(+), 9 deletions(-) -- 2.43.0 -- _'Esta mensagem é direcionada apenas para os endereços constantes no cabeçalho inicial. Se você não está listado nos endereços constantes no cabeçalho, pedimos-lhe que desconsidere completamente o conteúdo dessa mensagem e cuja cópia, encaminhamento e/ou execução das ações citadas estão imediatamente anuladas e proibidas'._ * **'Apesar do Magazine Luiza tomar todas as precauções razoáveis para assegurar que nenhum vírus esteja presente nesse e-mail, a empresa não poderá aceitar a responsabilidade por quaisquer perdas ou danos causados por esse e-mail ou por seus anexos'.* _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
