On 8/27/26 11:00 AM, Ales Musil via dev wrote: > When an external router sends an ICMP "Redirect to Host" > (IPv4 type 5) or ICMPv6 Redirect (type 137) to an OVN > Logical Router Port IP, the packet is not matched by any > specific handler in lr_in_ip_input. On gateway and > distributed-gateway routers this causes the packet to fall > through to conntrack stages where ct() fails, spamming OVS > logs. On plain routers the priority-80 ICMP-unreachable > catch-all handles them, but that is guarded by > !is_gw_router so gateway routers are left unprotected. > > Per RFC 1812 section 5.2.7.2, a router SHOULD silently > discard any received ICMP Redirect. There is no reason for > an OVN logical router to route ICMP Redirect packets. > > Add priority-110 per-datapath flows in lr_in_ip_input that > unconditionally drop all ICMP Redirect packets (IPv4 type 5 > and ICMPv6 type 137) before the conntrack stages. This > covers all destination IPs including floating IPs and LB > VIPs, and gives uniform behavior across all router types. > > Reported-at: https://issues.redhat.com/browse/FDP-1936 > Assisted-by: Claude Opus 4.6, OpenCode > Signed-off-by: Ales Musil <[email protected]> > ---
Recheck-request: github-robot-_ovn-kubernetes _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
